hi everyone
my name is nick roy and this is oscent
and the hermit kingdom
learning more about the world's most
secretive nation
so just a quick introduction about
myself i've been in security for a
little over
eight nine years now i've worked for
automation companies i've done some app
development vulnerability management
uh based out of boston my online is
super duptos
and we think all good presentations need
to start off with a picture of
uh cats so this is a picture of my cat
frank
and generally the look he gives me
whenever i'm working on something
so let's get right into it uh what is
ocean i'm sure everyone here is familiar
with this
so just a brief introduction it's really
data collected from any kind of publicly
available sources
uh it's not related to any kind of open
source software or collective
intelligence
and really there's a lot of paid
services out there but today we're going
to be looking at
uh what's free and what can be found
from the comfort of sitting on our home
couch
so what are the benefits of ocean it is
less risky
we're just going out and essentially uh
doing some really creative searches
to find some different piece of
information that we might be looking for
it is cost effective i think uh the
grand total that i've spent on all of
this has been about
20 over the last uh probably two years
two and a half years it took to put all
this
together it is pretty easy to gather
they did all this from the comfort of my
couch while watching uh the stanley cup
playoffs
and certainly i am not a lawyer by any
means uh but
everything's already online that we're
looking for
now some of the challenges of ocean that
we might run into this is something that
i'm sure everyone has faced at one point
or another there is a lot of data out
there
especially if we're not really sure what
we're looking for a lot of the times
when i started this they really
didn't have anything in mind for
something specific i was looking for
i was really just kind of doing some
general searches to get an idea of uh
what was out there and
what i could find and then i could start
to narrow it down from there
but i never really started out with any
kind of
uh plan or any kind of kind of
hypothesis that i wanted to prove
so there is a lot of data out there
sometimes reliability is something we
need to worry about
again this isn't data that we're
actually uh going out and creating
ourselves we're gathering this from
available sources
and then certainly reviewing all this
data can be a challenge
uh i still have tons of data related to
this project
that i just haven't had a chance to get
through yet it's pretty easy to
automatically gather this data
but kind of piecing things together and
making sense of it is where we can start
to
run into some challenges
now live north korea uh this is a a
question that's come up a couple of
times
since i i've done this talk now um i
always like to make the joke it's fun to
tell my mom
uh but really it started probably about
10 years ago
i saw a video on youtube the vice guide
to north korea
and i i thought it was interesting
purely from the perspective of they went
on a tour
and you got to see a little bit of just
day-to-day lives of everyone there
so this is really not anything related
to
any kind of apt activity this isn't
related to anything malware or political
this is really just looking to see what
can we learn about
the internet in north korea sitting on
our own couch
so let's start to gather some
information and see what we can find
now there's a couple of ways that we can
start to gather this data
today we're going to focus on really the
first two items here
passive and semi-passive data passive is
anything that we can find online
semi-passive is where maybe i'm going to
go out and
use this website to go scan a target for
me
but i'm still keeping my uh that site
between myself and whatever i'm
researching
and we really want to avoid active i
don't want to just run an map scan and
do all of my discovery that way i want
to rely on what's publicly available
and today what we want to start to
identify uh we want to see
what's on the north korean ip space uh
we want to start to define
what the north korean ips base is what
kind of services are running there
kind of operating systems can we find
and we'll start to branch out from there
and see what else we can learn
as we do start to find more and more
pieces of data that we can work with
so to start off we need to define our
scope and this one's pretty easy
there is four class c networks that are
assigned to north korea
we can see it here 175 45.176 to 179.
this is really what we're going to focus
on today there are a couple of other ip
address ranges that
we can see and there's never really been
anything too interesting on them
and quite honestly it's there's always a
little bit of a debate about whether or
not they're actually used
by north korea so we're really just
going to focus on
what we know is actively used and
maintained by north korea
but what do we do if there's not a
wikipedia article
well there's a couple of things we can
do we can pick a domain that we know
about
in this case i'm looking at apple.com as
an example
we can use the dig command that's going
to give me the ip addresses
for this the server that's responding
and then i can do a who is look up here
where i can get the
asn or the autonomous system number uh
this is how we
essentially register ip addresses to our
an organization
i can look up asn 714 i can see that it
is owned by apple and all the ip ranges
that they own
and this is something we can easily do
for our north korean rangers
so even if we think that someone might
have edited the wikipedia article
we can still go in and validate this
information and we can confirm that
those four
class c networks are where we want to
start looking and see what we can find
so how many servers are online uh this
is what we want to start to
answer next what's actually active out
of these 1024 ip addresses
now this was something i found from back
in
2010 this was the earliest example i
could find of anyone actually scanning
north korea's ip space
at the time it looks like they had about
12 servers online
so we have a little bit of a starting
point but we want to start to understand
what's changed over the years
what's online now
and there's a couple of places we can
turn to one of my favorite places to
search
because you can find a lot of
interesting information there
is searching github so this is where i
found actually a number of people who
are
scanning north korea
and they're publishing all their results
online so they're running nmap scans
they have nice repo set up where you can
easily search through these
so there's a lot of different projects
out there that are actually just
scanning the internet
and interesting targets and making it
available on github
and we'll talk about github again
there's a couple of other fun things
that i found on there as well related to
north korea
but you can find all sorts of things on
github that
maybe people uh aren't actually putting
their own purpose
i've found company api keys i've
reported them i've seen
entire dev repose just deleted because
of things that were left there
accidentally there's a lot of good
information that you can find on github
now there's a couple of other places
that you can check
the internet wide scanning project is a
great place to check
if you do have your black friday key or
if you haven't purchased that yet it's
the best five dollars i've ever spent i
think i've bought it a few times now
but this is a way where we can start to
just see what showdan knows about these
various devices
we can find that there's a number of
them reporting here
and again we want to try to just
validate our data as much as possible
we have some nmap scans we have showed
in data census is another internet wide
scanning project that we can look at
so between all these different services
this information that we can find online
we can generally get a good idea of
what's available online anytime
and the north korean id space
so this is my very crude drawing that i
did uh but we can see that there's
really three subnets that are in use the
176 subnet is
where most of the activity is happening
where most of these servers are deployed
uh 77 and 78 there's a couple of things
here and there
sometimes these numbers fluctuate a
little bit 79
really don't see anything uh happening
there too much ever
if you do ever see traffic connecting to
there usually it's not a good thing
uh there's been a couple of reports uh
for various pieces of malware that are
connecting back to
that 179 space now but this at least
starts to narrow down what we're looking
at and now we have a pretty decent idea
of where we're
we're starting
so now that we know what's alive uh
we've narrowed down our 1024 ip
addresses
to just 20 to 30 different hosts
depending on
what's online and what's resolving that
day
so the next thing we want to do is we
want to start to get a better
understanding of what's actually running
on these devices
and this is one of the only times we'll
actually go ahead and do any kind of
active probing uh we're just going to
put that ip address into our browser
and we can see some interesting
information here
we see that it's running apache 480 but
we can see that the operating system is
redstar 4.0
now if you're not familiar with the red
star operating system uh this is a
state sponsored operating system
developed in north korea
uh there's two different versions of it
there's a desktop and a server version
uh there's a couple guys in germany that
did some great work
uh really digging into the desktop
version they found all sorts of nasty
things in there
one that deletes files if there are
certain
strings of text in there those get
deleted automatically
another one that actually watermarks
files in the background and the
watermarks actually stack so you can see
who made changes and who had ownership
of a file at any time as it's being
changed and shared
so they have a great github repo if you
do want to take a look at some of their
research some of the tools that they've
published for
disabling a lot of these malicious
components
you can find that online they have a
great talk about it as well
but if you haven't seen what red star
looks like version one had the nice
windows xp theme to it
version two changed it up a little bit a
little more the the traditional
linux linux flavor to the desktop
version three was an interesting change
because around this time
we started seeing pictures come out from
north korea where they actually had
apple computers in the country so
naturally the operating system
needed to change to reflect that
uh now we know that version 4 is
available inside of north korea
if you do want to try versions two or
three you can find them online you can
find them on
archive.org it's it's pretty easy to
download them and get them going
we know version 4 is available one
because well we saw it reported when we
browse to that ip address but again even
if we don't want to trust that
uh maybe we don't trust the banner that
we're looking at
this is from a magazine called foreign
trade of the dprk
they published this magazine online on
one of their
commerce websites and if you're looking
for some really
interesting things that you might be
interested in buying a lot of
interesting things in here
but there was an article in there a
couple of months ago about how red star
4.0 was
uh developed and released in the country
how great it is how many people love it
in the country
so we do know that it is it is generally
in use
and it's being put to use inside the
country uh it hasn't made its way
outside yet
but we do know that it exists and
typically development
uh it does seem to be like something
that's in
in development and work done pretty
frequently
i did mention that there's two different
versions of redstar there's the desktop
version
then there's the server version i
haven't seen a lot of people really look
at the server version too closely
so i started digging into it a little
bit i haven't had a lot of time yet
as far as i can tell there really isn't
the same kind of monitoring or
surveillance tools available on here but
there are some
some interesting things that you can
find on here beam
in rss mod which we'll talk about in a
minute
se tools which is a nice graphical
interface for
managing se linux and then
probably the most curious thing is you
run as the root user
but you're still lacking certain
privileges
and this was something that really
caused me some some headaches for a
while
i knew that i was the root user but when
i started trying to dig
through the file system i was still
getting permission denied errors
uh still getting these messages popping
up asking for a password
uh what i learned was it's actually
using the belt libau model for enforcing
access control
if you're not familiar with this
essentially the concept is you have
various classification for different
files and directories on your system so
you can have secret top secret
and that's similar styles enforcing who
has access to things
and essentially this is applied here so
even though i was the root user
i still don't have enough permissions to
access certain things on the
operating system
so this is where we need to find a way
that we can essentially escalate our
privileges from here
uh how do we elevate this i wasn't too
familiar with bell lapajola
but what i found here was i started
googling this is actually red star in
russian
sometimes if you google in other
languages you get some
some cool things that you can find so
this was from
a russian forum i found people were
sharing pictures and dvds that they were
buying on vacation in north korea
and putting them online i actually found
all of the
os manuals for red star on there
now everything is in korean i do not
speak korean
google translate is very great though
but what i found was the actual steps
for
how to modify my permissions for my root
user
everything was nicely documented in
there it's about three manuals long
actually
and it does have some guides in there
similar to the cis benchmarks if you
want to harden your redstar server
still working my way through these to
see what else i can find in here
but at this point i did have full access
to everything
so we started digging through a lot of
the files on here
start to talk about the differences
between random and
devious random for generating random
numbers
on the system
they wrote their own method for
blocking users so instead of using
something like fail to ban
uh there's actually some code in there
that'll actually just
block you if you fail the password a
certain amount of times
and really all of this this code as i
started digging through it
and i was able to start getting some of
these applications running as well
this is from the program called beam
once i was able to get this set up now
essentially it's just a graphical
interface for managing your red star
deployment
so this is where you can start to
configure all your services
you can create and modify your users on
here
it's actually really nice kind of set up
an interface to use
it's pretty easy to configure your
server from here
and it really made it nice and easy to
get things going once i had access to
this
but the other thing i found i did find a
vulnerability in here
uh where you can actually steal session
information from other users
uh so this was just my uh my site where
i was trying to post my request to
webhook.site i had my session id from
another user that i created there that i
was able to
uh to post off to the site
and i do have a website where i keep
track of a lot of this uh
try to update it a number of times a
year i get one comment maybe every five
years on here i posted that screenshot
and i
got a comment about 30 minutes later
that they were interested in the issue
they wanted more details
uh they even sent me an email with one
of the most suspicious email addresses
i've ever seen
and uh i still haven't actually replied
to this one
but i i thought it was a little a little
curious to see this come in
when i posted that that image
that's a little bit of a sidetrack about
what the red star operating system is
but now what we want to do is we want to
start to
see how many domains we can find that
are in use by north korea
so now that we know there's uh however
many uh
servers online at any given time again
roughly
20 to 30 depending on what's accessible
at the time
but now we want to start to enumerate
some of these north korean domains
maybe we can find something outside of
that ip space
and really we just want to see what we
can find
now a couple of years ago we learned
that there were just 28 websites
registered to
north korea their top level domain is kp
there was a misconfiguration on one of
their dns servers that allowed
global zone transfers and so this is
where someone found this
and published the entire list of all the
north korean websites
so since that day
i've tried to keep a list up to date
we now know that there are 32 websites
that are publicly accessible
there's 34 different domains two of them
are
essentially duplicates
but again we want to start to enumerate
all of these domains
because we want to see what else can we
learn uh what else can we find about
this infrastructure can we find anything
outside of this ip space
and this is uh another great way where
we can use some of these various sources
of
open source intelligence this screenshot
here is from air coryo which is the
national airline of north korea and if
you look on there the flight status on
any given day
everything is always on time or ahead of
schedule
but if you look at something like flight
radar for example
a lot of times it's a little bit
different some of these flights aren't
exactly always on time
or even running that day
but what do we do if we don't have
something a nice article where we know
all of the domains well there's a couple
of sources of data we can turn to
we can take the whois data and start to
search off of that
we can do reverse dns lookups based off
of ip addresses
again if i look at something like
apple.com where i can use domains at
apple.com
using that to look up my whois data and
doing some reverse dns lookups
we can find all sorts of interesting
domains that are owned by apple
my favorite in there is animoji.etf a
lot of these last i checked didn't
really seem to be in use
but again it gives us a good way now
where we can start to
maybe find some different sites maybe
some dev instances that
maybe shouldn't be accessible anymore or
things that have been long forgotten
so we can really use this data to start
to further map out our target we're
looking at
uh we can also look at things like
passive dns data there's a number of
services out there that provide this for
free for
uh limited searching and again this is
where
now we can start to search different ap
addresses
and just see what kind of domains that
are known to resolve to them as well
based off of all these dns requests that
are being made by
by users around the globe
and then we can also start to look at
things like the certificates for our
websites
census is a great tool that we can use
you can take the
fingerprint of a certificate and you can
search it there to see if it was reused
anywhere
you can also just actually read the
certificates in the case of
north korea we can see down the bottom
here they actually list out where the
certificate is being used under the alt
names
so i found some of the domains listed in
there i
haven't found anything new this way in a
long time but it still is a nice way to
make sure that we are
aware of what's there and maybe what's
not being used anymore
and then one of my favorite things that
was published uh this was published
about maybe two and a half three years
ago
uh this is the website dprkportal.kp
i'm always convinced that this was
published uh in response to
uh just trying to stay on top of all the
active domains
this was published by north korea where
they actually publish a list of all of
their websites
and anytime there is something new
published the last new
site published with the top level north
korean domain was
in december 2020 so this was the first
time i've ever actually seen it updated
with a new site so it seems like they
are keeping it up to date here
for the most part for anything that they
want to be publicly
accessible and known about
so we have a list of these domains now
we know what's actually active inside of
this ip space
we know what kind of operating systems
are running on these uh these various
devices
now the last thing we want to understand
is what's actually running on these
devices
so in our case again there's a number of
different ways that we can gather this
data
this is from some of the internet wide
scanning sites
this was one that's actually uh it scans
from china
but we can see there the banner from
their dns servers reporting that it is
running on red hat
now we can find some other fun things on
there as well i've seen things like
vmware pop up
from time to time i've seen media
streaming servers pop up on there
there is a cisco device that always
seems to be present
in the north korean ip space
and again if there is something that
maybe just doesn't make sense to us
or maybe it's something we think this is
maybe wrong
we want to try to validate this data as
much as possible so
yes they can reference this through a
couple of different sites and people who
are scanning the internet
i can verify that everyone is reporting
this as a
cisco ios device so i feel pretty
confident that
this is uh this is correct and we can
mark this off as
something that maybe isn't as suspicious
as we we thought it was
originally
so to recap a little bit of what we
found uh
what's actually running on all these
hosts we're not going to go through
everything
but there's a couple of different web
servers out there your standard dns
ntp smtp servers
vmware server there's an ftp server
and then a mix of red hat and red
a couple of windows servers we have our
one cisco device
and then i left it at the very bottom on
the left hand side there's 20 services
running on port 8080
they actually have no idea what this is
within the last couple of weeks most of
these actually seem to have gone away
they were always open for a couple of
years but
for whatever reason they're not in use
anymore
i will talk about those in a minute
about trying to see if we can find some
more information
but really why do we want to identify
this information again just looking at
some of this banner information
maybe it's it's not the most reliable
information but it still gives us really
good starting point
for understanding what's on these
targets and what's inside this
environment
so like i mentioned most of what we're
going to do is is all passive gathering
a couple of things we do want to gather
semi-passive this is where we're going
to use some different websites
uh to actually go out and maybe gather a
bit of information for us
uh this is something that someone sent
last year
one of these websites used for actually
testing your mail server to find any
misconfigurations
they found this against a north korean
mail server and they found out that it
was actually
operating as an open smtp relay
apparently you could only send emails to
any of the other top level.kp domains
but this was something that was publicly
accessible
for a while
another website we can use proxy checker
seems like a good way to see uh maybe
poor 8080 on some of these systems was
uh
functioning as a proxy in some way in
this case
didn't seem like that was the case i
still don't have any idea what it is
looking through the manuals they do talk
about tomcat a lot and
using board 8080 for management so my
new guess is it's something to do with
that
but unfortunately those services don't
seem to be online anymore
so it's kind of hard to tell exactly
what they were
and then uh we can start to turn some
other unusual tools as well
we can use things like seo tools to go
out and gather information about our
site
this will tell us what the site was
built with it'll follow links
tell us what's broken what's uh what's
valid
and one of the things that it found that
i thought was pretty interesting on one
of the north korean websites
we can see it here down in the developer
view there was a broken link
that was pointing to a 172.200 address
a couple of slides we'll talk about why
that's kind of exciting to see
but there's a lot of different tools we
can use we don't have to think about our
traditional security tools
we can get a little creative and use
some other things to find out some of
this information that we might be
looking for
so we spent some time talking about uh
what's running on this
north korean public ip space uh i kind
of wanted to flip this around though as
i was working on this and i wanted to
know
uh can we find any activity of north
korea online anywhere
and if you're not familiar with the
internet in north korea it started in
2001 it was really just an email
relay between north korea and china but
inside of north korea there are
essentially two different networks
there's the intranet which is what most
people have access to
and then there's the official kind of
internet for
high-ranking party members college
students do have access to it inside of
north korea
and this is access to the full internet
uh this picture here on the right is
taken from an internet cafe in north
korea
where we can see screenshots of some of
the internal only
north korean websites uh looking through
flickr
for tour groups to north korea is a
hobby of mine
this is actually where i found this on a
flickr page where someone had taken this
picture
and i cropped it a little bit to make it
a little bit easier to see
but there's again a lot of different
places we can turn to
to find some of this information that
maybe we don't always have access to
now some of the domains they do actually
come up from time to time if you are
researching north korea domains a couple
of them here are on the left-hand side
none of them are publicly accessible uh
but i've talked to a few people
where they seem to think that they are
used internally for
uh email one of them is a portal used
inside the
hotel for accessing the internet
and then the other third one seems to be
a social network of some kind
inside of north korea as well
and really uh one of the other things
that kind of prompted this idea of can
we find
uh north korea online or any kind of
activity uh this is a map steam
published a number of years ago
showing where all of their their users
were connecting from
um if you look really closely there in
the circle
you'll see one dot inside of north korea
so i was really curious to see can we
find any north korean activity online
so one of the first things they did was
just using
some of these different google doors to
search for
different things this one's actually
pretty simple we're just searching for
a any of the log files that google might
have indexed
just searching for different ip
addresses
so this was on a russian oil website i
found
some north korean ip addresses that were
browsing this site
uh i'm sure everyone knows about public
pastes uh pasteban any of these sites
where we can search information uh this
was it
looked like it's from a minecraft server
uh but there was a
user that was connecting from an ip
address inside of north korea
you can also search wikipedia especially
since i've talked about it a lot
now if you don't have an account it'll
record your ip address
so we can see where there were some
changes made to
different books some of them were for
content management system
uh there's actually a lot of changes
coming out of north korea they seem to
have stopped about four years ago maybe
five years ago at this point but
we can see some activity there from
north korean ip addresses
making some changes to these different
wikipedia articles
and again we want to get creative with
our searching uh this is a website
called i know what you download.com
where they're essentially just
monitoring all these uh
torrent trackers and all the ip
addresses that are connecting
they have a nice interface that you can
use to kind of search this data
so these were some of the top movies in
north korea my modern family is actually
really popular there
but one of the things they did was i
wrote a script to just
query i know what you download to find
any north korean ip addresses that were
active and torrenting
and then i went in and started searching
based off of these
again what's interesting is we see a lot
of it coming out of the 76 177 and
178 networks but what i thought was even
more interesting was
looking into not just the the movies and
tv shows being downloaded
but things like device drivers we can
see different uh graphics cards in there
devices for cameras and different types
of laptops
so it's a good way where we can maybe
get an idea of some of the other devices
inside the country
that maybe we we don't have first-hand
access to see from
different pictures or things like that
being published
and then since i had a list of all of
the north korean domains
i got the idea what happens if uh since
most of them are dot com.kp or dot org
ap uh what happens if i bought just the
dot com version
uh so i had i found two north korean
domains that were available
i bought those i found one that was in
the os manual
that was listed in there that was
available and then
one of them kept popping up in different
thread intel feeds
from a couple of years ago and it
actually just became available
so i bought that as well i don't want to
say
what i bought but just threw some google
analytics on it just to see if i would
get anyone connecting to it
and they did get some traffic over the
last uh year year and a half
no traffic from north korea and these
domains aren't something that you can
accidentally just type in
i'm assuming you would have to really go
here on purpose
so it was interesting to see some of the
connections that were coming in
to these domains that i bought
and then lastly as we are trying to
understand can we find
north korea online this is an article i
saw last year about
linkedin becoming a social media of
choice for north korea's elite
i haven't gotten any friend requests on
there as far as i know
but we can find a lot of things on
social media that maybe we shouldn't
be posting i've found things like
people's badge and their schedule and
information that they've post
hashtag new job is a great way to find
information about different companies
uh hashtag visitor badge is another fun
one
i guess people are really excited about
that they post their video badges from
different companies
when they go to visit
so what can we find about north korea
well there is a brewery inside of north
korea
apparently they're working on mini kegs
this is a manual inside of the north
korean hotel
that i always just giggle when i read
the title
i've found things like visas long-term
stay cards
for people going to visit on tours
and then one of my favorite ones the
palace of the sun if you go on a tour of
north korea
this is somewhere that they'll take you
and they they stress that you're not
allowed to take pictures
uh for that you have to take your shoes
off you go through the
uh the machines that kind of blow all
the dust particles off of you
but it's actually geotagged on instagram
uh someone's taking some sneaky pictures
in there
so again even in a country like north
korea where
cameras aren't allowed in certain places
uh we can still
find some information and get an idea of
what's there
but we can also look at things like
what's running on their computers
if you look in the background you see
that windows xp is still very popular
inside of north korea
and again we want to verify our
information as much as possible
this comes from the official north
korean media website
and other pictures look just a little
too perfect in the background
so we can use a website like photo
forensics which we'll try to highlight
anything that's essentially any kind of
errors in the picture
so it seems like a lot of times pictures
are just posted onto that generic
background
to make it look a little a little more
bright and blue skies and sunshine
for a lot of these outdoor pictures
and we can also start to turn to some
different places as well
uh strava is a fitness tracker similar
to fitbit
they actually publish all their data
online
so if you want to find new places to run
or hike is the idea
when i found out about this i
immediately started browsing through
north korea
we can actually see some of the actual
lines on here where
assuming people are going on tours in
the country
um and if you really zoom in you can
start to see individual buildings that
they're going into
the next thing i want to do is start to
overlay this with something like google
maps to see if we can get an idea of
what these buildings actually are
but one of the things i also noticed was
in the north there's two very faint
lines in these mountains
and i was really curious to know what
these were so i
switched over to google using these
coordinates looks like
it's some kind of ski lodge here
but the interesting thing is it's not
the one that's shown in most of the
official
uh north korean media which is this uh
looks like it's a different one so you
haven't found too much information about
that
but again just different ways where we
can find some of these
new things that we can investigate
further
and then as we start to wrap this up
silly vaccine
is another one that's interesting this
is a north korean anti-virus program
checkpoint did a great paper on this
but one of the things that i found was
if we look back to github
the shadow brokers leak the the cia
tools
a lot of people mirrored these tools to
github and the source for them
but as i started searching some of the
silly vaccine strings
i found that they are actually in use in
the shadow brokers leak as well
so some of these tools are actually
scanning the endpoint to see
what kind of protections running on
there so it appears that
whoever is building these tools is aware
of silly vaccine inside of north korea
and actually checking for that to see if
it's present before
executing the next step of their their
programs
we've also found some other fun things
this is on a north korean website
looking at the source
we can start to find uh just different
fonts being used
and when i googled those i found out
they are north korean fonts
developed inside the country but i've
also found
on different sandboxes where those
fonts are available and i really just
always love this comment no idea what it
is i found it on my laptop
haven't looked into it more personally
have no idea if it is anything related
to north korea or if they're just using
that font
but again different ways where we can
start to maybe find some new things to
investigate
and as we are looking at this different
pieces of software
a lot of times sandboxes different
things like that
a lot of people aren't aware that this
information is publicly searchable
so this is how i've found a lot of north
korean software online just
searching the name then i have a hash
and more information about it
gives me all sorts of new rabbit holes
to go down to try to find a lot of this
software
but just starting with some basic
information we can really start to
get a lot more information about what
this software is
uh so i want to start to wrap this up
here a little bit
a lot of people ask what i use for tools
osintframework.com is a nice tree that
we can use to really search all this
data
i have a website
nkinternet.wordpress.com
i try to keep it sort of up to date as i
find new things
uh and one last thing i want to end on
here this is a
website that i found a couple of years
ago i found it
early on a sunday morning i was looking
at this it seems
pretty uh pretty interesting signature
of this detection system in the top
command and control server and as i was
looking this i got a phone call
the number was zero zero zero zero zero
zero zero i picked up said hello and
nobody was there granted it was six in
the morning at the time when i was
looking at this
so i put my phone down phone rings again
a few minutes later same number
no one's on the end of the line i start
thinking that i need to
pack up my house i need to wake up my
wife we need to move
outside the country as i'm pacing the
room a little bit trying to figure out
if these phone calls and if this website
is related
i get a third phone call from the same
number
zero zero zero zero zero zero uh they
pick up they say hello hello
uh someone says mr roy
yes i said uh mr roy uh this is steve
from enterprise sorry our phone system
isn't working
they've been trying to tell you that
your rental car is ready
thanks steve for the heart attack again
always interesting things that you can
find he did actually reach out because
there was a certificate to see if they
had any information
they told me that they're not a software
company
could be a whole conspiracy theory still
not too sure on that
uh but again always keeps me up at night
wondering what this was
uh it's not online anymore uh but thank
you everyone for listening
i had a great time presenting uh
certainly any questions feel free to
reach out or always happy to talk more
about this and share
any other kind of data or information
that i have so
thank you very much