Slashdot Mirror
Red Star Linux Adds Secret Watermarks To Files
An anonymous reader writes: ERNW security analyst Florian Grunow says that North Korea's Red Star Linux operating system is tracking users by tagging content with unique hidden tags. He particularizes that files including Word documents and JPEG images connected to but not necessarily executed in Red Star will have a tag introduced into its code that includes a number based on hardware serial numbers. Red Star's development team seems to have created some quite interesting custom additions to Linux kernel and userspace, based on which Grunow has written a technical analysis.
>> privacy of potential users (especially from North Korea) may be impacted
I didn't know privacy was a thing in North Korea.
Where are the MOOs?
Should we be surprised or otherwise care?
Supreme Glorious Idiot with bad haircut and tiny penis is a draconian asshole. Does draconian things.
Film at 11. Kill off Supreme Glorious Idiot with bad haircut and tiny penis. Hang tiny penis on wall for all to laugh at.
Is www.kernel.org accessible from North Korea? One can then pull the sources and compile a custom kernel omitting their "rtscan" module.
Looks like NK isn't too happy about this. Site down.
Is this any different that our government forcing printer manufacturers to put secret watermarks on pages printed?
This would be news if it did not add a tracking watermarks. I expect pretty much everything in North Korea to be track to the nth degree.
North Korea may not be the worst country in the world, but it's the worst non-Muslim country by far
Desktop software is really horrible these days. To preserve your freedoms, use Chrome OS or Android and organize your collaborations and activities over Facebook. Capitalist computing is much more trustworthy than that evil communist Linux thing.
Luckily we are safe :) !\:&%4-n|S.#%'K5:G%M],%"&$ W78]E_EOF
Does it make a difference whether the software is doing this or your printer/copier does it? For a long, long time, laser printers and copiers have been doing the same thing to show where the document came from. Isn't this just the paperless version of what we've all been living with for a a very long time?
would put CDN links in the summary by default.
Before: https://i.imgur.com/oOoWssF.pn...
Open in Red Star 3.0: https://i.imgur.com/MiORhD3.jp...
After: https://i.imgur.com/uqAvXC6.pn...
The above uses an MS Word document created in Office 2011.
I've tried jpg, docx created in MS Word, docx from LibreOffice, and numerous other random file formats copied onto my thumb drive - the MD5 remains exactly the same in every case.
He particularizes
I don't know what makes me sadder: that he used that word or that it apparently is a word.
All I want is a secure system where it's easy to do anything I want. Is that too much to ask ~~ Randall Munroe
Okay, I know this is North Korea we are talking about, but non-secret watermarks can be useful in some "overlord" situations.
Back before cell-phone cameras became common, I worked for a company where every photocopier put a visible, human-readable watermark. They also banned cameras without a permit from corporate security. It was never stated outright but I'm sure this was either to deter industrial espionage or to comply with a contractual obligation that they take such steps.
As far as you know.
Actually we do know, we have the source code, have had it for about 15 years. Its been in the mainline Linux kernel for about 12 years. In case you haven't heard changes to the kernel get, uh, ... reviewed.
This is one of those eternal security arguments; without manually reviewing the code YOURSELF, and compiling the kernel from that manually reviewed code YOURSELF, it's "as far as you know." Maybe you do that, I don't know; I'm just aware that the security of my linux installs relies on a chain of trust, and even if that chain is 100% verifiable from source to binary, there's still no guarantee that there isn't an obfuscated back door or malicious code exploit that was overlooked.
The GTA V intranet.. Must be about the same size.
The kernel is heavily viewed, studied, etc. Its changes are reviewed, at multiple levels in a hierarchy. Its probably the one part of Linux where the many eyeballs notion is reality rather than myth.
Leah in Star Wars said "the more you tighten your grasp, the more fall through your fingers". That is interestingly true here.
If any node in their network is compromised by a nation-state it can, through such watermarks in traffic, both fully characterize the nature of users of all traffic going through the node, and "sculpt" it - transform it - to present false data to the system managers. The more of a trust imbalance they put into or requier out from their data, the more powerful any corruption of that data is at sculpting their decision-making.
The source code, documentation, and research developed employees of companies are owned by companies in the majority of cases. Tracking stolen materials back to a leaker is a desirable and there is a market for such a capability.
I wonder if the CLI program "jhead" and the GUI program "MAT" (see mat.boum.org) can sanitize these.
And yet, regressions and other bugs still get in. I'm a big fan of the many eyeballs theory, but there are limitations to it.
And yet, regressions and other bugs still get in. I'm a big fan of the many eyeballs theory, but there are limitations to it.
Yes, but successful exploitation is a very different story. And such attempts are a bit unlikely when the code is publicly coming from the NSA. Anything coming from them will get extra scrutiny by some.
Comment removed based on user account deletion
We have had source code for Bash for decades, and it got reviewed multiple times, yet, we got shellshock exploit. Who knows how long it was being exploited before discovery.