Hacker News Reader

Comment by DashRattlesnake | Hacker News Reader

> When I first saw an image of the browser I was awe-struck to see that it made a request to an adddress (http://10.76.1.11/) upon first run.

...

> Here’s where things start to go off the rails: what this means is that all of the DPRK’s national network is non-routable IP space. [emphasis mine]

That's quite an unsupported leap. He found some software that uses non-routable IPs, that doesn't mean the entire country's network only uses them.

View on HN

It's not a leap too far; it just needs a few data points to confirm with reasonable confidence.

The DPRK has exactly one known ISP (Star JV, AS131279) and (as far as I can tell from various looking glasses) they advertise exactly three /24s out of their 175.45.176.0/22 allocation, via exactly one Chinese transit provider (China169, AS4837 which is China Unicom's backbone).

We can also see from registries and generally poking around that 175.45.176/24 is used for authoritative nameservice (e.g. the DNS servers for .kp and reverse delegations for the Star JV /24s are here) and website hosting, which makes it very unlikely to be used for non-infrastructure host addresses. Being an old ISP lag I might also guess that there'll be an pair of NTP peers in there, an MTA, and separate source addresses for DNS resolvers (although I'd concede that with the DPRK no guess is reliable)

That leaves a total of 508 globally reachable IPv4 host addresses for the whole country. I suggest that this is insufficient even for the devices allocated to the relatively small group of individuals permitted to access the internet, from which it is not unreasonable to infer that everything else is in RFC1918 (or equivalent) space behind a proxy, which this article suggests is 10/8 or (my guess) most likely some structured sub-allocations thereof.

While the conclusions in the article may not stand on their own, I think he may be implying the common usage of web browsers in the DPRK. Rather than using DNS, users connect directly to 10.* IP addresses.

Here are a couple of pics I took of IP addresses printed on the walls in a school's computer lab:

Portal: http://i.imgur.com/MTYlNVo.jpg

Bookmarks: http://i.imgur.com/QWEooy5.jpg

Are you sure those are bookmarks in the second image and not some examples of IP addresses? It seems unlikely that they'd be visiting addresses in all three of the RFC1918 spaces.

Far from unlikely, I have seen government-operated metropolitan-scale networks that allocated extravagantly in their early days and ended up using all of RFC1918 space, being unable to renumber (because change in government systems is Too Hard) and moving on to more esoteric non-globally-routable space.

For those intrigued as to what those addresses might've been, have a read of Bill Manning's roll up of the special case IP allocations: https://tools.ietf.org/html/draft-manning-dsua-08

It's hard to be sure of anything there.

Could just as easily be 10/8 nationally, 172.16/16 within the school board, 192.168/16 within the school or something equally innocuous.

The second one is not even printed, it's hand-drawn.

Actually it's not difficult to determine, this is not in the article, North Korea has VERY small allocations of publicly routable ipv4 space from APNIC. It used to be as small as a single /24. It's also possible they're using IP space from several of their upstream Chinese ISPs that they are dependent upon, in which case it would be much more difficult to determine than an IP is physically located in .KP rather than on the Chinese side of the border.

A guy who spent a year teaching in North Korea touched on this at CCC a couple years back.

North Korea's intranet has its own DNS system, and they also (contrary to the article) assign a bunch of IP blocks not in RFC 4192 internally.

People who do have access to the outside Internet do so through an HTTP or SOCKS proxy with login credentials.

https://youtu.be/zuxlLLeKZZ8?t=421

amusing about the new TLDs for their internal use, it looks like Donuts LLC (the company which runs a shitload of new GTLDs) and north korea have similar lines of thinking, but for very different reasons.

http://www.donuts.domains/services/domain-names

Reply on news.ycombinator.com