*preroll music*
Herald: North Korea; not only famous for chocolate but for being a surveillance state
And as a good surveillance state, it has to have its own operation system.
Because how will you do proper surveillance without your own operation system?
Today, we get a brief introduction how Red Star OS is working.
The introduction will have a specific focus on the custom code
which was inserted for surveillance, and especially how to get around it.
So please welcome Florian and Niklaus with a big round of applause.
*Applause*
Florian Grunow: Hey everybody, thanks for having us.
We are going to give you a deep dive into Red Star OS.
Actually, we were kind of surprised that there is not so much information
on the net about really the core of Red Star and what is it doing.
So we thought we would change this, and give you an insight in how
this Operating System works, and by looking into the technical aspects
of Red Star you can also draw conclusions about how development in North Korea
is evolving and is, maybe, catching up.
So what we're going to talk about is: First of all, a short introduction
into the motivation; why are we doing this? We are going through
the architecture of Red Star; we are going to show you the components in the core
in the operating system itself; and then we will take a deep dive into
the additional components, all of the programs that are coming from North Korea
and are supplied with the ISO of Red Star OS.
After that, we are going to give you a deep dive into the most interesting features
of Red Star OS; and then we will be able to draw our own conclusions;
and afterwards we will have time for questions, we hope.
By the way, this picture on the left you can see here is actually one of the--
I think it's the screensaver right from Red Star OS. *Laughter* So, um, yeah.
So before we begin, we need to do this disclaimer:
For your information we have never visited DPRK, we have never been to North Korea.
All we know about North Korea is from public sources, from the internet,
from media, whatever. So what we are going to say about North Korea
has to be speculation because we don't know exactly what happens in North Korea.
Also, the ISOs that we have been analysing are found publicly available on
the internet, [and] may be fake. We don't think that they are fake because
Will Scott has shown last year on the 31C3 how Red Star looks, and everything that
he has been showing is basically in the ISO, so we think it is legit.
Remember that we are not going to make fun of anybody in this talk. We are not going
to make fun of the developers, and we are certainly not going to make fun of
the people in the DPRK, because we think that our presentation might have some
funny aspects or something that makes you laugh - which is perfectly fine - but
looking at Red Star in detail is kind of a surveillance mess, I would say, and
it's a security or privacy nightmare. So keep these aspects in mind.
Also, this talk is not going to focus about security. We're not going to talk
about security. Many of the publications available on the internet are
about security, and we're not going to focus on this in this presentation.
So, why are we doing this? Red Star ISOs have been leaked some time ago; there is
a version 2 hanging around the internet and there is obviously a version 3.0
which has been leaked at the end of 2014, and we were quite surprised at the middle
of the year that there is no in-depth analysis of this operating system.
So most of the blogs and news articles are quite superficial that you can find out there,
and this is kind of surprising because if there is some kind of state that
doesn't put focus on transparency and free speech, and they are putting out an
operating system, you kind of want to know how do they build their operating system.
So that was one of the major aspects for us to look into it. The other aspect was
to find out how is the state of software development in DPRK;
how are they developing software? Do they have a well-thought architecture;
are they thinking about what they are doing? How is the skill level of software
development in North Korea? So these were the two aspects that
we wanted to find out.
So if you look at previous work, as I said there is mostly superficial stuff.
There is some information that Red Star OS actually looks like Mac OSX, and we will
go into this a little bit further. Then we have this talk from Will Scott
last year at 31C3, who was talking about Computer Science in DPRK which was
very very interesting, and gave a pretty good insight into what's happening in DPRK.
And then we have a bunch of guys who looked into the browser of Red Star,
which is also quite interesting.
So what we are going to do now is-- I'm going to show you the custom basic
components; I'm going to talk a little bit about integrity on the system; then I will
hand over to Niklaus who will be looking into the core and surveillance features;
and then as I said, we will have time for questions afterwards.
So there are different leaked versions out there, as I said. We have a desktop and
a server version of Red Star, so you can also use Red Star as a server, and it
turns out that server version 3 is actually used on the internet right now.
As you can see, there is a server header returned: "Red Star 3.0"
This is an IP address of the server, and it is pointing into North Korea.
So this is one of the few web sites that is publicly facing the internet from
North Korea, and they are obviously using the server version 3.0. So 3.0 might
actually be the latest version. There is another version, it's 2.0,
which has also been leaked to the internet, and then there is supposedly something
that looks like 2.5; we have found some South Korean documents that seem to be
analysing the system quite superficially, and it looks like 2.5 actually resembles
the look and feel of Windows XP. So you kind of see this evolution right now from
2.5 XP going to 3.0 mimicking Mac OSX.
Our talk will focus on the desktop version which is desktop 3.0
If you look at the timeline, which is a guess - there's no documentation available
on how they did it, obviously - if you look at the 3.0 version you see that it is
based on Fedora 11 which came out in 2009. So our guess is they started developing 3.0
in 2009 with this Fedora 11 release. The kernel that they are using is 2.6.38
which came out with Fedora 15 in 2011. So it could be that the OS itself is
a little bit older, the kernel is a little bit newer, and the latest package build
dates that you can see in Red Star OS date to June 2013.
So our educated guess is that Red Star came out in June 2013 or a little bit later,
a few weeks later or months later.
In December 2014 we had the public leak, so the ISOs have been leaked to the internet
and are publicly available right now.
If you look into the operating system, it's basically a fully-featured desktop system
you might imagine. It's based on KDE and Fedora as I already said, and it tries
to mimic the look and feel of Mac OSX. You have an e-mail client, a calendar,
a word processor, you've got Quicktime and all of that stuff. You even have a disk
encryption utility that Will Scott has shown last year.
They implemented additional kernel modules and they touched a lot of kernel modules.
They have this kernel module "rtscan" which Niklaus is going to say a little bit
more about, they have this kernel module called "pilsung" - I was told this
means "victory" in Korean - and that kind of is a kernel module that supplies
AES encryption. So they implemented an own kernel module to supply something like AES.
Then there is a kernel module called "kdm" which is the Korean Display Module,
and "kimm"-- *muffled laughter* --which is not what it's like--
it's not looking-- *laughter* Well, I'll just go on.
It basically just does something with Korean letters and displaying Korean
letters on the screen.
Red Star has been developed by the KCC, the Korean Computer Centre.
It's quite interesting that since a few years ago they had an office in Berlin.
I don't know what they did there, but they obviously had an office in Berlin
maybe for knowledge sharing, whatever. If you look at the system hardening,
it's quite interesting that they took care of system hardening.
So they implemented SELinux rules with custom modules, they have IP tables
rolled out immediately so you don't have to activate it or put your rules into it;
the firewall is working. They even have Snort installed on the system.
It's not running by default but they are kind of delivering it by default, and they
have a lot of custom services that we are going to look into right now.
Quite interesting is-- so why should North Korea mimic Mac OSX?
That might be one reason right there: because this young fella sitting on the left
is actually using an iMac right here. So this is one reason.
So why should they implement their own operating system? There actually are
so-called anthologies put out by the leader, and one anthology by Kim Jong-il says that
- if you translate it correctly, and we try to - "in the process of programming,
it is important to develop one in our own style," and with "one" he means programs
and operating systems. So there is this clear guidance that North Korea should not
rely on third-party Western operating system and programs, they should
develop this stuff on their own. And by looking at the code and everything
that we have by Red Star OS, this is exactly what they did. They touched
nearly everything on the operating system, changed it a little bit, added custom code
and so this is actually what they are doing right there.
The custom applications that you have is a browser, which translates to "my country."
You also have a crypto tool that Will Scott has shown last year which is called Bokem
which if you translate it kind of translates to "sword."
You have Sogwang Office which is an OpenOffice customised for North Korean use.
A software manager; you have MusicScore which is an application you can compose
music with. Then you have a program which is called "rootsetting" and it basically
gives you root. So if you look into the documentation, it says you are not
supposed to have root on the system for integrity reasons, but if you want to get
root you can use this tool, so they're not hiding anything. So there are rumours
on the net that say that you're not supposed to get root on the system
because it's so locked down. This is not true obviously because there is software
intended to give you administrative privileges.
They even touched KDM, so the code base that they touched is really, really big.
Nearly the whole operating system.
We are now going to give you a demo. The first demo that we are doing, we are
doing it right now, because we are actually doing this presentation
in Red Star OS. *Laughter and applause*
So what you see right here is basically Red Star OS. We're going to show
some of the aspects to you. There are many many screenshots on the internet, some of you might already
know how Red Star works, you might have experience yourself.
We're just going over a few interesting issues.
So as you have seen, there is a full-blown set of word processing, Powerpoint
presentation stuff. I'm going to open up the browser-- pfft, whatever. *Laughter*
--and going into the preferences just to give you a quick-- no. *Muted laughter*
Oh. *Laughter* Yeah, to give you an insight on the Certificate Authorities that are
implemented in this Firefox version - it's Firefox 3 - so you see there is not so many
Certificate Authorities right here, and they all are I guess from North Korea.
So the browser is totally created to not be used outside of North Korea,
which you can see in the URL bar. There is an internal IP address
which points into the network of North Korea, and all of the settings,
proxy settings, hard-coded IP addresses, or whatever, all point into this
internal infrastructure of North Korea. So this browser and the e-mail program
was never intended to be used outside of North Korea.
*Pfft* Okay. *Laughter* What else do we have?
Okay, we have a Quicktime player. So speaking of Mac OSX,
you all have seen this. Woo! Swoosh. Right? Okay, so that perfectly mimics Mac OSX.
So let me try to find-- I'll try with aplay right here.
So this is the shell. Quite interesting is that when we were looking through
all of this stuff, there is a bunch of files that have a certain protection,
and they seem to be pretty important for the system, and there is a
wave file - an audio wave file - that actually is protected.
It's usr/lib/Warnning.wav; I don't know if we can hear this.
I hope that your ears are not going to explode right now. I'll just try it.
*Pig squealing* I'll try it again.
*Pig squealing* You hear that? *Laughter*
*Pig squealing* Does anybody know what this is?
*Shouts of "pig" from audience* Pardon me? Pig, exactly.
And where is it coming from? Does anybody know?
That's stolen from Kaspersky antivirus, because in the older version of
Kaspersky antivirus if you find a virus it actually will play this sound, and it's
exactly the wav file from Kaspersky; we verified this by doing checksums, okay.
*Laughter* So we have a copyright violation right here. *Laughter and applause*
So what else do we have? I've been talking about this, you can create your own music.
I'm not going to do this now because I'm not good at making music.
What else do we have? We have the browser. Did we want to show-- ah yeah.
I'm going to show you one more thing. I'm not going to show you the encryption
tool because Will Scott has done this last year, but to give you an insight into
the crypto tool, it's pretty interesting. If you look at the description of the bokem3,
bokem is the tool that is used for disk encryption so it provides the user a tool
to encrypt files or even the complete hard drive, and if you look into
the description it says "this allows the user to store his/her privacy data with encrypted,"
which is quite nice. I mean, we didn't expect to have something like this
in Red Star. So the user can at least try to encrypt files.
Bokem is using out-of-the-box crypto that comes with the kernel.
It also uses pilsung, which we don't know if there are any backdoors in it or not,
so we have no idea if this is possible to decrypt with a master key or something.
If you want to look into this, we would be happy if someone with big crypto
experience would look into it. So let me get back to the presentation.
Ah! One thing I need to show you is this red flag on the right corner, right here.
If you look into this, and you translate - I didn't click the right one - if you are
going to translate all of this, you will find that all of the strings and all of
the text that you see right here, they seem to be an antivirus scanner.
So they even implemented from scratch an antivirus scanner in Red Star OS.
You can now select the folder or a file and say run a check on the file,
and if the file is actually a malicious file - we will come to that part later,
what "malicious" is - it will instantly be deleted from the hard drive.
So this is an interesting feature, having a virus scanner in a Linux OS.
Okay so let's look at the custom components. We have been
looking into the user space a little bit, and all of the programs that come with it.
There is far more stuff. Download the ISO, play around with it a little bit.
First, change the language to English. You will obviously not get far
if your Korean is bad. So change the language and
play around with it a little bit.
So Red Star Comes with interesting packages.
They touched KDE as I said. They are getting out an integrity
checker and a security daemon. There are signature packages right here
which Niklaus is going to talk about a little bit, there are policies for selinux,
and I'm going to talk about two of the integrity checking mechanisms that
Red Star has.
So by looking at Red Star, we saw that one thing was pretty important to them:
They wanted to preserve the integrity of the system, and one way to do this
is using this process right here, it's called "intcheck."
It comes with an SQLite database with hashes of files on the system,
like signatures for the system, and you can configure it from user space so
it's not pretty hidden, it's pretty transparent to the user.
I think there even comes a UI with it where you can configure everything,
and it's run at boot. It checks the files and if it sees that the files have been
manipulated or tampered with - if the checksum changes - then it will issue
a warning to the user. So you get a small popup that says,
"this file has been tampered with," the security or the integrity of the system
is not where it should be. So that's pretty much what this thing does.
securityd is kind of interesting, because securityd is also a process that is known
to run under Mac OSX. I'm not a Mac user, and I think that Mac OSX with securityd
is keeping track of certificates and stuff like that.
So what they did is they reimplemented securityd for Linux, and they included
various plugins. One interesting issue with securityd is it comes with a library
that provides a function called validate_os(), and what this function does
is it has a hard-coded list of files. You can see like our wav file right here,
you can see configuration files, and autostart files for scnprc which is
the antivirus scanner. So it checks if these files are untouched, and if
these files have been tampered with it initiates a reboot instantly.
So if you touch one of these files, your machine will reboot instantly.
The same library is also used from KDM, so during the startup process when KDM is
starting it is also doing an integrity check, and if it finds that one of these files has
been tampered with it actually immediately issues a reboot, and the problem is
that if you start tampering with the system you will end up in reboot loops
all of the time if you're doing research, because once KDM is saying reboot
the system, it's going to check it again if it's rebooted and sees that it's
still tampered with and it reboots again, and again, and again, and then your
system is basically dead. So what they tried to do with intcheck
and securityd is try and protect certain files, conserve the integrity of these files,
and if these files get tampered with they assume that it is better to have an
operating system that you cannot work with any more than to still let it run or
issue any warning. So integrity is one of the main aspects
they were looking for in implementing Red Star.
Okay, I will hand over to Niklaus and he will go into the guts and the
surveillance features a little bit more.
Niklaus Schiess: The most interesting feature-- package we found was this
esig-cb package, which actually says in the description that it's an
"electronic signature system," but we found that it is doing a lot of weird stuff.
This is actually one of the pictures which is included in the package,
which is also protected. We don't know really why, but it says something like
"this is our copyright;" and "don't break it;"
and "don't copy it;" and stuff like that.
But it's actually doing something really different.
It includes several pretty interesting files. We have some configuration files,
we have a kernel module, and we also have this redflag.bmp which is the
picture you just saw, and we have the warning file, and we have some
shared libraries, and we'll go now into details what these are actually doing.
So the first thing we looked at was because there is a kernel module
loaded by default, and we thought if you want to put some backdoors in it
where would you want to put it? Right in the kernel module, probably.
And what it does, it's actually just hooking several system calls which
provides a device which is actually interfaced to the kernel so you have
different services running on a system who are actually talking to this
kernel module via this device, and it has some functionality like
it can protect PIDs. So when you're protecting a specific process then
even root cannot kill this process, which will be quite interesting
in the next slides. It also provides functionality to on one side protect
files, and on the other side to hide files. So protect means you cannot edit
the file, and hide means you cannot even read the file.
So even if you had root user, you can't even read those files.
And on the right side is actually how the services are interacting with this
kernel module, and this is one function which mostly protects and hides the files
which we just saw, which are included in this esignature package.
Then like Florian said, we have this virus scanner which at first glance
at least looks like a virus scanner, and this is this "scnprc" process.
It provides a GUI to the user so it's quite transparent so the user can see
"okay, I have something that looks like a virus scanner, and I can also
trigger some scans of different directories,"
and it's started by kdeinit. So there's this scnprc desktop file which is
quite interesting because what you want to do is disable it, but you
cannot actually edit these file. So as soon as you edit this file
and save it, then the system will immediately reboot.
So disabling it is not so easy.
Like I already said, you have different ways of scanning. You can just click
on a folder and say "scan this," but also if you for example plug in
a USB stick into the system then it will automatically scan the files on the USB stick.
And this scnprc service is actually loading the kernel module, and
it starts another service which is called "opprc" which we are going to
look in detail in a minute, and this is also quite interesting this next service.
But the pattern matching, we looked into this a little bit and there's another
package. So we have this esig-cb package and you have esic-cb-db package which
actually just provides this one single "AnGae" file. As far as we know,
it means "fog" in Korean. And this is basically a signature file, or how the
code references it a pattern file. It's a file with a well-defined file format
and it includes patterns which are loaded into memory, and as soon as
you are scanning a file it just checks if these patterns are matching and as soon
as the patterns are matched then it immediately deletes the file and it
plays the warning, and this is one of the hidden files so even if you get root
privilege on the system you are not able to actually read this file.
So a user of the operating system won't be able to check "okay, what does it
check and can I produce documents which won't be detected by this"
because you cannot actually read this file.
We took a look into this. Most likely our best guess is that these contain--
A lot of the files are little-endian so you always have to switch the bytes
and we saw that it looks at least like they are UTF-16 strings with Korean,
Chinese, and some other weird characters, and if we put these in Google Translate
then there are actually some pretty weird and disturbing terms in those files.
But we actually cannot confirm this. It looks like they are actually not
scanning for malware in the system, so most likely they are checking documents
and if those documents match those patterns then they are most likely--
for example, governments don't want these files to be distributed within the intranet
of North Korea then it just deletes those files.
But actually we cannot confirm this because we are not quite sure if you
put those strings in Google Translate that they are actually real translations.
But you can always update these pattern files, so on the one side is scnprc has a
built-in update process where it just updates the file itself, or you can just
when you are doing operating system update via your package manager
and you update this esig-cb-db package and you also get a brand new file.
The interesting part of this is that the developers decide what is malicious.
So it's not necessarily that "malicious" means that it's malware, that it's
bad for you, but somewhere the developers and officials will actually say,
"okay, we don't want those files distributed, just delete them
"because we think they are malicious."
There is this other service which I was also talking about, this "opprc."
This is more interesting than the virus scanning itself.
It's running in the background, so actually a user will not see that there
is actually another service running, you don't have any GUI or something like that,
you cannot trick or something with this, and this is one of the protected PIDs.
So scnprc for example you can just kill with root privileges, but this is a process
no one can kill on the system, and this is quite interesting because
you cannot unload the kernel module unless this service is killed, so they
are actually protecting each other so that no one can stop the services at all.
And this service shares a lot of code with the scnprc.
We just did some entropy checking and saw okay-- I will talk in a minute
when we are comparing more of these files why we think that this looks
pretty much the same, why they are sharing so much code, because
we found something interesting with older versions of those services.
But the most interesting thing this service is doing is it watermarks files.
And now we are going to look deeper into what this watermarking means.
So actually as soon as this system is started, it reads your hard disk serial
and then scrambles it a little bit, and as soon as you are for example
plugging a USB stick into your system then it will trigger a watermarking
process where it takes the serial, takes a hard-coded DES key from
the binary itself, and then encrypts it and then puts it into your file.
And when you are converting this hex key into a decimal representation then you
see that it is actually two dates. We actually cannot confirm what
those two dates mean, but one of those matches Madonna's birth date, and
there are rumours that some people in North Korea might really like Madonna.
This is just speculation, but if you have a better conspiracy theory then just let us know.
Because we found some pretty interesting stuff, but we cannot confirm this.
So technically the watermarks have an ASCII EOF appended, which is most likely
used by the code itself to parse the files and see if there's already
a watermark in there, and for JPEG and AVI files, for example, it just
appends this watermark to the end of the file, and when you have a DOCX for example
it just appends it near the header where there are a bunch of null bytes, and then
it just puts it in there.
So the watermarking itself is as soon as you open a document file with Office then
it will be watermarked, and actually they have code which watermarks files even if
you don't open those files, but as soon as we saw this-- it's pretty buggy.
It doesn't work every time, but they have code for this implemented, and mostly
it works but sometimes it just fails. The supported types that we can confirm
are DOCX files, image files like JPEG and PNG and AVI video files. But the code
indicates there are several more file types available for watermarking, but
we most likely didn't look into this. But the most interesting thing here
is that only media files are affected. So they don't watermark any binaries
or something like that, they are reducing their surface to files which could be used
to carry information, which could be used to put out information for free speech
purposes, and actually what we think is that this is not a security feature.
So they are actually trying to watermark free speech in general, so that every time
you have a document file, an image, or a video file, then they want to know who
had this file and they watermark it so they can track the origin of the file.
We have a short demo where you can see for example I have a USB stick.
Let me put it in my system.
There is a file on the USB stick which is a love letter from Kim, and it has
a checksum which starts with "529", and as soon as I plug this into the system--
I hope that it will notice this.
You can see okay, it recognised something like a USB stick on the system, but I won't
open it, and I won't open any file on the USB stick. I just will eject it.
I hope that it works. Will it actually open?
This is what I meant, that it's kind of buggy, so it doesn't always work with
the watermarking, but most likely if you open the file itself then it will work.
I guess we didn't have the case that it doesn't work when you open it. [sic]
--which then opens Office, and I close it again and-- just close this.
Go back, and then hopefully if we mount this again then you can see it has
been changed. So we didn't change anything in the file, it was just the operating system
who's changing files, and this was initially the part where we started to
look into this more deeply because we thought an operating system who is
just changing files when you are plugging into the system is kind of annoying.
Just to make this easier for you-- So what it actually does in the file,
we have here the header of the file which is a document, a DOCX file,
and it just added this string which is marked right here. This is actually
the watermark it's putting in there. Opposite there you can see the plaintext
which is actually encrypted and then put into the file, and the serial starts
with "B48" so every time it puts the serial into the file, it prefixes it with
"WM"
we think stands for "watermark" probably, and you can see the EOF at the end of
the file. This allows basically everyone who can access this file, who can
decrypt this watermark which is actually encoded with the hard-coded key,
so pretty much everyone who has access to this ISO can get this key and can
decrypt this. And this allows you to really track back the origin of the file,
where it came from.
But there is a pretty funny example. So imagine you have this picture, and
you are inside North Korea and you think "okay, this is pretty cool, and I want to
distribute this to all of my friends." So you think "okay, they might be
intercepting all of my e-mail and my browser communication," so you put it
on a USB stick and give it to your friends so that you think, "okay, no-one actually
on the internet can access this file" and you give it to someone else.
Then at the beginning we have this situation, where this is the original file.
This is the end of the JPEG file - which by definition always ends with an "FF D9"
hexadecimal - and as soon as you give this to your friend and he plugs the USB stick
into his computer which is running Red Star OS, then the file will actually
change and it will look like this. So for JPEG files, as I said it just
appends the watermark to the end of the file. So you can see the "FF D9," this
is the actual end of the image file, and they're appending the watermark there,
like you can see with the EOF. But where it gets interesting
is when your friend is actually distributing the file to another friend.
So what Red Star OS is actually doing, it appends also the watermark of your
third friend. *Slight laughter* So what you then can do--
If you technically combine this together, then you can see not only where the file
has its origins, but you can also track each and everyone who had this file
and who distributed this file, and with this knowledge you might be able to
construct something like this, where you can track the distribution of all of the
media files which are distributed over the intranet in North Korea.
You can see then in the centre we have this one really weird guy who is always
distributing images that we don't like, and you can see also who gets these files
and trace it back to all of the persons who ever had this file, and then you
can just go home to him and then shut him down and take his computer.
And we have actually not seen any functionality, but probably there is
functionality in the system implemented where it always sends your hard disk
serial to their servers, so the OS can probably be able to match your IP
address to your hard disk serial, and then they don't even have to go to your
home and get to your computer and check your hard disk serial, they just can do
this remotely and can check all of the distribution of all malicious media files
within the intranet of North Korea.
What we thought is pretty hard for someone who doesn't have access to a system other
than Red Star OS, who just has this one system, and tries to disable all of this
malicious functionality like the virus scanning that can delete all of your files
that someone else doesn't like, or the watermarking/the tracking of those files.
And this is actually quite hard, because some of those services are depending
on each other and can only be killed when the other service is not running.
So what you actually have to do is you have to get root privileges, and then you
have to kill those two integrity checking daemons which Florian was talking about
so that it doesn't always reboot the system when you're changing anything.
Then you can via ioctl calls to the kernel module, and say just "disable" because
it has this nice feature where you can enable and disable it, and then you
can kill scnprc, opprc, and the best thing you can do is--
Weirdly, the libos file is not protected by anyone, so you can just exchange
this with a validate_os() function which always returns 1 which says everything
is fine, and then at the end you can delete the desktop file which is used
by KDE in it to start all of these processes, and then you are fine.
And we don't think that actually anyone in North Korea who only has access
to this one system-- It will be extremely hard to figure all of this out and
to completely disable it. So they did a pretty good job in building an
architecture which is quite self-protecting, and they put a lot of effort into it
to just prevent you from disabling all of the malicious functionality.
We also took a quick look on the second version of Red Star OS, just to compare
some of those services, and there we can see there is quite an evolution from the
older version to the current version. The thing which I was talking about,
that the binaries are quite similar, is that in the older version they used
a lot of shared libraries, and in the current version they statically linked
a lot of code into the binaries themselves even if they don't use it, so the codebase
looks quite the same. And the chain of starting the processes is a little bit
different, so they put a lot in the init process which will be started at first
and not like this depending-on-each-other infrastructure which they have in the
current version. In the current version they also have a lot of problems with
file privileges, so privilege escalations would be pretty easy, even if you don't
have this root setting file. But also they have a lot of binaries that are just
setting that everyone can read and write this interface to the kernel module,
which basically allows you even as a non-root user to disable the kernel
module, and then you can kill all of the binaries but you cannot actually delete
something because it will then end up in the reboot loop.
And when you are doing something malicious then the OS reboots, in the older version
it just shuts down the system, so we thought this is a pretty interesting thing.
And we think, and we saw, that there's a more advanced watermarking
technique in there which is not just appending watermarks into the files
but it looks like they are doing, for video and audio files at least,
something like they are putting the watermarks as filters on the files.
So this will be a little bit harder to actually see those watermarks
and read those watermarks, because it is not so obvious like when you have
this "EOF" string at the end which is always quite weird.
But it uses this "/usr/lib/organ" file which is actually not present on the
ISO we had. We're going to talk about this in the conclusion why we think
this might not be there, but it's actually not available. It's referenced
a lot in the code, but we actually haven't had this file and unfortunately
we couldn't look into this more deeply.
So what we didn't find were quite obvious backdoors which we thought would be
in place, and that they would be pretty easy to spot. But we didn't see any of those.
It doesn't mean that there are no backdoors, but we have some
speculations for this, and one of these is that like we saw at the beginning of
the talk that there are actually systems on the internet running this version
of Red Star OS, so it would be pretty weird if they would backdoor a system
and then put it on the internet. As far as someone gets the ISO file,
and can look for backdoors and can find some of them, they would be actually
able to exploit the system from the internet.
Actually the system has a package manager and as we saw with the pattern file
it has built-in update functionality and different services, so backdoors could
just be loaded via updates because probably they thought
"okay, these ISOs might be leaked into the outside world" and you just get
an ISO, install it, update your system - which is only possible from within the
intranet of North Korea, with hard coded internal IP addresses - so probably they
thought "we only want our backdoors on the systems which are actually located
within North Korea."
This is what we thought, that they thought the ISO might be leaked, which is what
actually happened. Another problem is that, like Florian already said, they
will touch a lot of code within the operating system and we didn't manage
to check all of the code. We mostly focused on the watermarking and the
virus scanning stuff, and there might be a lot of code that should be checked further.
The conclusion also is that the system's quite self-protecting. They not only
implemented several services for integrity checking themselves but also
they configured and implemented selinux and something like that, to just protect
the system and make it more secure.
What we think is really bad is this virus scanning and watermarking,
because it actually allows you to track not only the origin but the
complete distribution within the network of those files, and combined with the
virus scanner where the developers are able to actually say what files are really
malicious and what shouldn't be distributed within the network,
it just deletes those files. So these two combined are a really strong
framework which can help you to track malicious people within your network.
But some words about security: Like I said, they have a lot of problems with
file permissions. There are actually some documents on the ISO of the server
version of Red Star OS 3.0, and there are some user guides and administration
guides which are quite interesting, and they talk a lot about how to make the
system secure, how to run it secure, and why they are doing different kinds of
stuff to save the integrity of the system. They have a huge chapter talking about
file permissions, but they actually didn't manage to fix them themselves which
is quite weird. And even their custom code uses basic memory corruption protection
like stack cookies, and non-executable stacks which we saw that a lot of security
vendors don't bother to use, so we thought this is quite funny.
Some of their code is more secure than a lot of security appliances.
*Slight laughter*
Florian: So to wrap this up-- Am I going, can you hear me? Yes.
Okay so to wrap this up, again we think - this is a guess - that primarily they try
to protect and to save the integrity of the system, which totally makes
sense if you're putting out an operating system from North Korea.
The system was, in our opinion, definitely built for home computers,
so it's not like industrial control or something else, it's definitely built
for a home user because it mimics Mac OSX and gives you all of the tools.
Maybe the reason why we didn't find backdoors is they actually know that
backdoors are bullshit. Could be a reason, we don't know.
If you want to look into Red Star OS and help us out, especially with the crypto,
the pilsung kernel module which provides custom crypto, with a look into the kernel
to see if there is something hidden there, if maybe there are backdoors there,
take a look at our github. Please contribute if you find
something, because we think that this message and all of this stuff has to
be put out to the public, so it is a well-known fact that this operating
system is actually abusing free software to actually make free speech harder
in a country that is quite oppressed.
So with this, we are at our end and we are going to take your questions now.
*Applause*
Herald: Thank you very much. We have about 15 minutes time for questions.
If you want to ask a question, please come to the microphones.
There are some on the right and some on the left aisle.
If you for any reason can't come to the microphones, please raise your
hand and I'll come to you with my microphone.
Okay, please line up there. If you wanna leave now, please do this
quietly through the front door.
Florian: Could you raise your hand if you have questions and standing at
the microphone? There are like three questions over there.
Herald: Yeah, on the left one please.
Audience 1: Hello? Yeah. So thank you very much, it was very interesting.
I have two questions: Have you tried isolating the system in a chroot jail?
And the second one is: Were there any outbound connections, like automatic
outbound connections it made?
Florian: Okay so for the first question, we did not try to run it in an isolated
environment. We actually didn't-- Did we install it on a live system?
I don't think so. Did we? Niklaus: Yeah.
Florian: Yeah, okay. But we didn't do any observations that this changed the
behaviour of the system. Concerning the second question, there actually is not
really outbound traffic. What it is doing is on the local network it is talking a
lot of NetBIOS stuff. So there is an SNMP and an nmbdaemon running
on the system and it's talking a lot of NetBIOS. But this is basically
everything we could find. We have even left it running for like two days, to see
if there is an outbound connection for one day or something like that. We couldn't
see anything like that. So the only stuff that Red Star's talking to the network
is like this Windows NetBIOS stuff, and if you push the button on the update
feature of the virus scanner, it's actually trying to initiate an update
process that goes to five hard-coded IP addresses that are all local.
So like 192.168.9 something, and 172 whatever. These are the only
network connections that we could trigger, or that we have observed so far.
A1: Thank you. Herald: The next question is also
from this microphone. Audience 2: Two questions:
Might it be possible that when you install the system it gets code from North Korea
so you cannot find out if it's calling home because you don't get the call?
Florian: Could be. Our guess is actually that there is far more stuff that you get
when you pull up the operating system in North Korea. One reason is the organ file
that Niklaus mentioned that is missing on the system with the additional crypto
information that is used for the extended watermarking that they are applying.
We don't know where this file is coming from, and from our perspective it totally
makes sense to not distribute this file on the ISO but to kind of give it as an--
I don't know, somebody has to come to your house to install the software and
then he puts like this dedicated organ file on your desktop that is specific
to you, for example. That would totally make sense because, as you know,
stuff works a little bit different. It's not like downloading an ISO
and installing it, it's probably more complex to get this onto your system
if you want to use this. So there might be more stuff that is pushed either
via updates - only internal - and this organ file and other stuff that can get
to your computer-- We don't know if this is possible or if something is happening
with this feature. A2: And the second question is if you look
at it from the North Korean view, that's like they had the problem. They are quite
happy, have a nice state, everything's working fine from what they see, and
now people come from South Korea, from Western countries, bring their USB
sticks with Western propaganda that to have stuff like this watermarking even
if it is like evil. Like a natural reaction from a closed system.
Florian: So actually it totally makes sense to develop the system in the
way they developed it. It totally makes sense, because it kind of reflects a
little bit how the government is working. Because integrity is not only a critical
part not only for the operating system, it's also a part for the state itself.
Like shutting down everything, closing off everything - that's, by the way,
the screensaver - and closing down everything also totally makes sense.
And tracking stuff that is distributed in the country or deleting unwanted stuff
also makes sense. So what we think that Red Star resembles this and matches
how culture is in North Korea, actually.
Herald: Okay, we also have two questions of the IRC which I would like to shift in.
Signal angel: Thank you. Okay, the first question is if you have any theory on how and why
the ISO got leaked.
Florian: We don't know this, actually. 'Why?' is-- We don't think that it was somebody
from North Korea, we think that it might be a foreigner that got it.
Like Will Scott told us last year that he was able to get a copy of it and get it
out of the country. There might be others that are able.
There is actually tourism in North Korea. You can go there for your holidays.
So I guess that if you put a little bit of effort into it, it's possible to get
nearly anything out of the country if you want to try to take the risk.
But we don't know who leaked the version and we don't know why it actually was leaked.
Niklaus: There are actually rumours that it was a Russian student who was studying
in North Korea, and he bought this on the street and just brought it out of the country
and put it on his blog, but we cannot confirm that this is actually true.
Signal angel: Okay, thanks. And the second question is if there has been any attempt at the
custom kernel modules yet, like reverse engineering or something.
Florian: Well we reverse engineered rtscan which is pretty simple because it just
hooks a few function calls, that's it. We have taken a look at the
Korean Display Module on a first glance. It seems to do what it is supposed to do,
having something to do with display management, but we didn't take a look
at all of the kernel modules, all the rest of the remaining kernel modules,
because the code base is so massive that we actually need you guys to
help us out a little bit.
Herald: Next question from the mic please. Audience 3: Yes, I have another question.
You said that most of the software is based of other open source software
for which you don't have the source code, and it didn't come with the ISO, so it's
pretty much a massive violation of open source licenses.
Florian: Yep, absolutely. A3: So my question would be:
Could you get an inside on what other packages are available, or from the
package manager, and what other packages are there?
Florian: Actually, there is a DVD which also was leaked. I think that it was for
Red Star 2. I'm not sure if it is also for the latest version, but there is
a CD with additional software and you have stuff like Apache, MYSQL-- *pfff*
I don't know. All of the stuff you basically need to run a full-blown
operating system on Linux. So there is additional software out there, you can
download the DVD and install this software on the machine.
If you go through the RPM descriptions you will see that for some of the
software they even wrote-- They kind of used a description for the license which
says "KCC" which is the Korean Computer Centre. And sometimes they use GPL,
and sometimes they use GNU, and yeah. So massive violations.
A3: Did you ask them for the source code? *Laughter*
Florian: Actually, we think that there is an internal git in North Korea where you
can just check out everything, so... We suppose it is this way because it's
open source, right? By the way, open source. *Laughter*
Herald: Very nice. One more question from here? Are you having a question?
No, okay then we have one more question from the internet.
IRC: Yes, the question is if there is a possibility to fake the watermarks
to get some innocent North Korean into trouble. *Quiet laughter*
Florian: Yeah, no problem because the key's hard coded. You could, like--
You know how to scramble the hardware ID or the disk serial, and you could perfectly
forge documents. That would be not a problem. Not a problem at all.
You just need the serial number, basically. A3: Okay, and I've just got another question
that is: Does the warning.wav have a watermark?
Florian: Umm... Niklaus: No, actually it has the exact
same checksum as the original file. Florian: Actually we didn't check if it--
No, so it does not have a watermark because as Niklaus said, it's the same
checksum as the Kaspersky one. A3: Okay, thanks.
Herald: Okay, thank you very much. Please give Florian and Niklaus another
big round of applause for an amazing talk. Florian: Thank you.
*Applause*
*postroll music*