Slashdot Mirror
Red Star Linux Adds Secret Watermarks To Files
An anonymous reader writes: ERNW security analyst Florian Grunow says that North Korea's Red Star Linux operating system is tracking users by tagging content with unique hidden tags. He particularizes that files including Word documents and JPEG images connected to but not necessarily executed in Red Star will have a tag introduced into its code that includes a number based on hardware serial numbers. Red Star's development team seems to have created some quite interesting custom additions to Linux kernel and userspace, based on which Grunow has written a technical analysis.
>> privacy of potential users (especially from North Korea) may be impacted
I didn't know privacy was a thing in North Korea.
Is this any different that our government forcing printer manufacturers to put secret watermarks on pages printed?
Should we be surprised
no.
or otherwise care?
Yes.
http://www.geoffreylandis.com
Ken Thompson's C compiler is an interesting read on the subject:
http://programmers.stackexchan...
http://www.reddit.com/comments...
Basically, It's a compiler with a backdoor that injects it's source code when it's compiling itself. pretty interesting idea for 1984.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion. -- Spazmania (174582)
Desktop software is really horrible these days. To preserve your freedoms, use Chrome OS or Android and organize your collaborations and activities over Facebook. Capitalist computing is much more trustworthy than that evil communist Linux thing.
Seriously?
Most North Koreans don't have access to the internet. Most North Koreans don't know a damned thing about Linux. Most North Koreans don't know a damned thing about kernels or spying modules installed on their computers.
Do you really think people are going to compile a custom kernel to get around the brutal dictatorships surveillance and risk their lives for something they probably don't know exists?
Come on, guys, learn a little about North Korea before suggesting the populace just whips up a custom kernel to work around this.
Under a third generation pisspot dictator, the overwhelming majority of North Koreans will only know what they've been told. They're poor, starving, and isolated from much of the rest of the world.
And the suggestion is to go to kernel.org? Pathetic.
Lost at C:>. Found at C.
My guess (and I admit, it's pure speculation) is that only a select few who created the OS have access to such sources -- that and perhaps NK sponsored hackers. Everyone else is restricted to the national intranet. Well, everyone else that is lucky enough to even see, much less use a computer in NK. The country has enough trouble providing food, much less electronics for its citizens.
Luckily we are safe :) !\:&%4-n|S.#%'K5:G%M],%"&$ W78]E_EOF
Does it make a difference whether the software is doing this or your printer/copier does it? For a long, long time, laser printers and copiers have been doing the same thing to show where the document came from. Isn't this just the paperless version of what we've all been living with for a a very long time?
Before: https://i.imgur.com/oOoWssF.pn...
Open in Red Star 3.0: https://i.imgur.com/MiORhD3.jp...
After: https://i.imgur.com/uqAvXC6.pn...
The above uses an MS Word document created in Office 2011.
I've tried jpg, docx created in MS Word, docx from LibreOffice, and numerous other random file formats copied onto my thumb drive - the MD5 remains exactly the same in every case.
He particularizes
I don't know what makes me sadder: that he used that word or that it apparently is a word.
All I want is a secure system where it's easy to do anything I want. Is that too much to ask ~~ Randall Munroe
Okay, I know this is North Korea we are talking about, but non-secret watermarks can be useful in some "overlord" situations.
Back before cell-phone cameras became common, I worked for a company where every photocopier put a visible, human-readable watermark. They also banned cameras without a permit from corporate security. It was never stated outright but I'm sure this was either to deter industrial espionage or to comply with a contractual obligation that they take such steps.
Most North Koreans don't have access to the internet.
This sort of thing is aimed at government employees who might become disaffected and begin working for some western intelligence agency. Your office PC watermarks every document on its way to the thumb drive (or floppy disk). In the event the media is intercepted on its way out of the country, they know whose desk to visit.
Have gnu, will travel.
As far as you know.
Actually we do know, we have the source code, have had it for about 15 years. Its been in the mainline Linux kernel for about 12 years. In case you haven't heard changes to the kernel get, uh, ... reviewed.
This is one of those eternal security arguments; without manually reviewing the code YOURSELF, and compiling the kernel from that manually reviewed code YOURSELF, it's "as far as you know." Maybe you do that, I don't know; I'm just aware that the security of my linux installs relies on a chain of trust, and even if that chain is 100% verifiable from source to binary, there's still no guarantee that there isn't an obfuscated back door or malicious code exploit that was overlooked.
The kernel is heavily viewed, studied, etc. Its changes are reviewed, at multiple levels in a hierarchy. Its probably the one part of Linux where the many eyeballs notion is reality rather than myth.
I've heard of this country that tortures people and then denies it, imprisons others without ever charging them of a crime, has a byzantine legal system where only the wealthy come out unscathed (hell, you can rape and murder if you are rich enough, and get away with it).
This country also has classes of people based on skin color, sexual orientation and other factors, yet is ruled by a party or parties that claim they represent all their people; in reality they represent none. Corruption is rampant, politicians routinely earn gifts of millions; but because these corrupt people have classified it as "legal", you can't even call it corruption there.
Trust me, you want to stay away from that place.
If telephones are outlawed, then only outlaws will have telephones.
And yet, regressions and other bugs still get in. I'm a big fan of the many eyeballs theory, but there are limitations to it.
And yet, regressions and other bugs still get in. I'm a big fan of the many eyeballs theory, but there are limitations to it.
Yes, but successful exploitation is a very different story. And such attempts are a bit unlikely when the code is publicly coming from the NSA. Anything coming from them will get extra scrutiny by some.
Comment removed based on user account deletion
We have had source code for Bash for decades, and it got reviewed multiple times, yet, we got shellshock exploit. Who knows how long it was being exploited before discovery.