North Korea’s Naenara Web Browser: It’s Weirder Than We Thought

    They use the same tracking system Google uses to create unique keys, except
    they built their own. That means the microtime of installation is sent to
    the mothership every single time someone pulls down the anti-phishing and
    anti-malware lists (from 10.76.1.11) in the browser. This microtime is
    easily enough information to decloak people, which is presumably the same
    reason Google built it into the browser.

I spent two weeks traveling around in North Korea in August 2012. One of our visits were in a military museum that had computers available (actually running RedStar OS!), containing some CD/DVD with MOV files (as far as I remember) and some other things.

I remember the machine having a 10.x IP address but it was definitely not able to access any internet, but I wonder if it was connected to their actual intranet, or if they simply had some local network there.

>I was always under the impression they were just pretending that they owned large blocks of public IP space from a networking perspective, blocking everything and selectively turning on outbound traffic via access control lists. Apparently not

It was always public knowledge that NK has more or less one publicly routed /22. That's far removed from "large blocks of public IP space".

> This microtime is easily enough information to decloak people, which is presumably the same reason Google built it into the browser

I doubt that was Google's intention behind the Safe Browsing API (https://developers.google.com/safe-browsing/developers_guide...)

>So every time the browser fails for some reason they get information about it. Useful for debugging and also for finding exploits in Firefox, without necessarily giving that information back to Mozilla – a U.S. company

Or if could be that most of the users of the browser in question do not in fact have full internet access and thus no reports would be sent anyways. Also, FF 3.6 is long out of support, so by getting access to these crash reports, the people behind Naenara get a chance at fixing issues (I'm not saying they do or don't, but getting the crash reports directly is the only way for remaining crashes to actually be fixed)

>. Could the mothership be acting as a proxy? Is that how people are actually visiting the Internet – through a big proxy server?

very likely, but not because of the way the URL for the startpage is formatted. That's just a convenience thing I guess where they ran wget or any other crawler against the original site and then they could just prepend their internal server to to URL and keep the patch to Firefox minimal.

>it’s still very odd that they haven’t bothered using HTTPS internally

They just don't care if "normal" people could potentially sniff each other calendars. If the government wants access to the calendar, they just look the data up I guess and because this is all a big intranet, the traffic doesn't cross any non-goverment-owned routers anyways.

>This one blew my mind. Either it’s a mistake or a bizarre quirk of the way DPRK’s network works but the wifi URL for GEO still points to https://www.google.com/loc/json*

Likely none of the sites the browser is actually able to visit actually use the geolocation API, so they just forgot to change the URL. It's an interesting bug, but far removed from mind-blowing IMHO.

>That’s actually a good security measure, but given how old this browser is, I doubt they use it often, and therefore it’s probably not designed to protect the user, but rather allow the government to quickly install malware should they feel the need. Wonderful.*

I'm sure they have other methods of installing malware that then would run as a privileged account, not the unprivileged user account running Firefox itself (their OS doesn't officially allow root access as we've seen in yesterdays article).

>It is odd that they can do all of this off of one IP address. Perhaps they have some load balancing but ultimately running anything off of one IP address for a whole country is bad for many reasons.

when you have fewer than 10000 total users, that doesn't seem like such a bad idea - it's certainly convenient.

Mark Lottor

[Original words and music by Jimmy Page and Robert Plant]

There's a hacker who's sure all that's coax is fast and he's buying a gateway to net ten. When he gets it he'll know if the ports are all closed with a SYN he can get what he sent for.

Ooh ooh ooh ooh, ooh ooh ooh ooh and he's buying a gateway to net ten.

There's an RFC on the wall but he wants to be sure cause you know sometimes words have two meanings. In a note on the page there's a warning that says sometimes all of our code is broken.

Don't ya know, it makes me wonder.

There's an error I get when I send to the net and my packets are lost and retransmitting. In my logs I have seen loops of mail thru the machine, and the screams of those who are hacking.

Oooh, it makes me wonder.

And it's whispered that soon if we all fix and tune then the packets will reach their destinations. And a new day will dawn for hosts that stay long and the telnets will echo quite faster.

Ohhhhh, it makes me wonder.

If there's a bustle in your cisco, don't be alarmed now it's just a quick ping for the NIC machine. Yes there are two paths you can route by, but in the long haul there's still time to change the protocol.

Yowwww, it makes me wonder.

Your host is loaded and it will slow in case you don't know, the unix's are asking you to join them. Dear hacker, do you see the overflow, and did you know your gateway is still under development.

And as we wind out more coax, and gateways slower than our hosts, There goes a message we all know, it updates routes and wants to show how everything still turns quite slow. And if you listen very hard, the bits will come to you at last. When all are ones and ones are all, to be a rubout and not a null.

And he's buying a gateway to net ten...

  This one blew my mind. Either it’s a mistake or a bizarre quirk of the way DPRK’s network works but the wifi URL for GEO still points to https://www.google.com/loc/json*