34C3 - DPRK Consumer Technology

34c3 preroll

Herald: The Democratic People's Republic
of Korea—or, as most of you know it,

North Korea, is a topic which is
already following us at congress

for four years. It all started
in 31c3 with Will Scott,

one of our speakers today, giving a
talk about teaching computer science in

North Korea. The topic was then gone on by
Florian Grunow and Niklaus Schiess, who

talked about the Red Star OS and also the
tablet PC called Woolim. Today, we will

hear the next episode—we will hear about
consumer electronics in North Korea. We

will take a peek behind the curtain, learn
about the Internet, and the current market

situation there. Our speakers today
are Will Scott, a security postdoc, as

well as his friend Gabe Edwards, security
consultant, and they will give us a peek

behind the curtain. So, please, welcome
Will and Gabe with a big round of applause,

thank you for being here already.
[Applause]

Will: Thank you, great. So just just to
put this in perspective, right, one of the

disclaimers is that the words that get
used, especially on this topic often have

a lot of meaning. There there is a reason
of that we'll be calling this DPRK or

Korea throughout. That's often the words
you'll hear of people who are dealing with

engagement with the country. North Korea
is a term that the country does not call

itself, but rather is what typically more
adversarial countries use to talk about it

as an occupying presence. So that that
language is is this weird quirk that

exists here. So yeah, we're going to talk
some about what consumer technology looks

like and how it's evolving and what's
going on there. I think we're pretty

excited about this. I want to start by by
setting a little bit of context. This is

the science of technology complex that
opened in 2015. It's in an island in a

river to the south side of Pyongyang, it's
still in the main city. There was a pretty

major construction project; it went on for
about a year before they opened this. In

the lobby they've got this nice
diorama of what the building looks like.

It actually … this is the rest of the
lobby—it looks pretty modern.

They have this sort of plain pastel
scheme that you actually see a lot in in

modern architectural construction there.
So so if you go into the new water park or

the boat restaurant that they've opened in
the last couple of years you see the same

design styling. This building is part
Science Museum—it has a bunch of sort of

interactive exploratory exhibits that you
might have a class of children come

through to learn. It also has lecture
halls, and it also has a library. And and

when you look at parts of it are that are
the library you see a ton of computers.

Right, this this is a … technically … there,
there is technology here. And and the

thing that is really, I think, fascinating
and revealing about where we are in terms

of our understanding of this country is
you look at these computers and yet again

we see this thing that doesn't look
familiar. This isn't Red Star, it's not

quite anything that looks like the tablets
we've seen. That's that's a desktop

monitor. And it's not Windows or Mac. It's
yet again something new. And in fact,

playing with this, you find that it's
Android that's that's been put in this

custom bezel. It has a keyboard and mouse,
but it's got an Android taskbar at the top

to let you know what apps are there and
it's yet another … they have special cased

and customized a distribution that works
for this purpose. And I think we … for

each one of these that maybe we have seen,
there's there's many more that we haven't.

So, I want to just get us up to speed on
what we do know, to start with. We've seen

Red Star—this is version 3, it came out
three years ago that we learned about Red

Star version 3; this this thing that sort
of Mac-like. There's actually been a

couple other versions that have ended up
on the Internet that we know stuff about.

And we we have at some level a better
picture of what the desktop technology

looks like. We've seen version 2.5 which
looks somewhat Windows like. There's been

a release of the server version that runs
some of the web servers from the country.

And then two years ago, Florian and
Niklaus' talk—they actually went in and

did a bunch of analysis of it, along
with on the Internet there's been

blog posts of other people who've posted
CVEs of various bugs that they found in

this, figured out how to make it run on
the external Internet by changing firewall

rules, and really just like learning a lot
about both the environment that this thing

was working in and the properties of it.
We have a bit less on the mobile side - so

this is what a store in in Korea in
Pyongyang sort of looks like: those are

laptops on the left, tablets and phones on
the right for sale. We got a talk last

year, again from Niklaus and Florian, about
the Woolim tablet. I think that's actually

maybe on the second row in this picture.
And and we got a sense of some of the

information controls there in particular,
right. So what they talked about was how

this thing prevents some types of file
copies and transferring, and some of the

sort of surveillance things that are built
into it. But again, we didn't get too much

in terms of hardware to bite our teeth
into. Finally, there's this like next

layer up—the software ecosystem. This is
an app store, again in Korea. You go to a

place and they have nice … this is this is
a nice one where they've got pictures so I

can see which games it is that are for
sale that they'll then plug this in my

device into a computer and transfer apps
onto the device. And so we get all of this

and we have mostly anecdotes that are that
are helping us sort of get small pictures,

and I think the real problem right is
there's all these devices—this is an

example of a few, and and we really I
think are quite far behind and having that

bar lowered for people to play and
understand what these things are. So, what

what I want to do to like try and explain
that situation that we're in is is talk

about why we're there and the different
sort of general groups of where these

devices end up. I realize that
that's talking about motives and that

is often like the way that you get
people mad at you, if you try and

ascribe some motivation to them that
they disagree with. So realize that these

are bread's … broad strokes and not really
indicative of everyone. But this gives you

some sense of why we've still ended up in
this world of not knowing much publicly.

Maybe … there's a quote from … this is
from Kim Jong-il that's that's relevant, and

and says, you know, Koreans are quite an
intelligent people and even in computer

technology we excel. I think this is
something that we maybe don't appreciate

when we're thinking about this. It is
rational for Korea to not want this stuff

to come out, right? They are worried about
adversarial government's trying to

leverage whatever they can. It seems
rational that it's in their best interest

to make it difficult for this stuff to get
out and for people to be able to attack

them with it. That's what we've seen in,
you know, against the threat model well

implemented copy control and and other
sort of limitations on the on the devices.

In terms of foreigners who have access to
these devices, I think there's sort of two

classes. What we saw in the talk last year
was a device that came out through a

defector group. So you've got someone who
left with this device and now he's trying

to figure out what what's on it. And that
is this adversarial relationship where the

goal there is to do damage to the country.
And so there's much more value in having

0-days than there is in releasing this
because then the security gets fixed. And

so you'll see that you know for any device
that comes out there there's really the

sensitivity both in terms of not wanting
to identify people but also in; well if we

find anything that's buggy, we want to be
able to do something with it. I think in

fact there's many more devices that don't
come out that way but that are held by

foreigners who are working constructively
with the country. And for them, the the

reason is somewhat different. And I think
the reason for them is in many cases that

they're worried about sort of the unknown
unknowns of “could someone get in trouble?

Will this result in my connection to the
country getting disrupted? The people

I like and work with getting in trouble
for having given me the device that I've

been done something reckless with.”
Right, so we can see from like

a bunch of individual perspectives why
we don't have more of this technology

out there. We can also understand
that, you know, as the public, this

creates this weird thing where
we're all fascinated but don't

have access. And and that I think
also in the spirit of, you know,

for Korea, this isn't great. Because the
bugs go unpatched and they don't get a

better security. So, this is the
electronic goods store at the airport

which somewhat counter-intuitively doesn't
actually sell the tablets to foreigners

but they do have some. What we're … what
we're going to talk about for the rest of

this talk is an effort that I guess we're
sort of putting out on the web called

computer … KoreaComputerCenter.org. Where
we're going to try and release a bit more

of this technology. And I'm going to talk
through the three initial things that

we're going to put up there that we hope
people play with. And this is in the

spirit that this we think … this makes life
better both for Korea and for the outside

world. For Korea, the same thing I was
just saying—I think you get better

security in the long run. We we I think as
a community understand the value of open-

source software, and in having many eyes
audit and find the bugs. We've already

seen that on the artifacts that have
gotten out. For us, I think it's a great

chance to … to do two things—one one,
it spreads our understanding more

consistently so we actually understand
what is going on in the country and can

make rational policy decisions at some
high level. It's also fascinating and we

get to preserve this anthropological
artifact of this really amazing parallel

development that has created … that
that exists of of what technology is

like in Korea. So, in that spirit,
let's talk about what's coming out.

Some of this I think is showing up on
BitTorrent links that are on this site

koreacomputercenter.org as we speak. The
first is a phone image—there's a system

partition and data partition recovery for
this phon, a Pyongyang 2407. This phone

was chosen because it's made by a Chinese
OEM, Jin Lee, which also creates the same

hardware in an Indian model. So if you've
got a friend in India at least, you can

get the G&E v5—it's exactly the same
hardware and so these images can load onto

one of these phones and then you will also
be able to run this operating system. And

so rather than just doing static analysis
of what's there you can actually see how

that fits together and what actually
happens. How it works, that it does shut

down when a SIM card from a different
operator gets plugged in, these sorts of

things. So this is this is just I guess
I'll say the the basic phone system - it

doesn't include most apps but it's got a
bunch of the sort of operating system-

level copy controls. You can get your
hands on the the Red Star protection

things that we're talked about last year.
The second thing for apps we're going to

turn to something a little bit older this
is the Samjiyon tablet which is one of the

first tablets that came out 2011-2012 era.
This was sort of at the beginning of

Korea's sort of introduction of widespread
consumer electronics, so it got circulated

quite a bit. It was a larger run of
devices than many of them. In fact so

widespread that there's there's one of
these devices in the Stanford library. And

so I guess the other thing I'll stress is
these devices are out there and it's a

matter of making sure that we're releasing
these in a way where it's just like this

is software but we're not necessarily
getting anyone in particular in trouble

because these devices we know are in a
bunch of places and the attribution

becomes hard at that point for
anyone to like, lose

contact or get in trouble. So there's

there's a basic set of apps that come
there. These are some of the icons there -

there's a nice one that has a bunch of
recipes. The the thing I'll say about

these - these were made for this specific
device and this is a thing that you'll see

I think throughout all the software if you
actually take a look at it. And so there's

a lot of hard-coded paths. So as well as
the APKs themselves you'll find that they

reference things that they expect to be in
specific parts of the SD card. Those files

are included, but it's unlikely that if
you just copy the APK onto a Android phone

it will be able to show you much content.
So it would be awesome if someone who

enjoys small.i wants to twiddle some paths
so that those can look for internal

resources instead, and lower that bar
further so that more people can play. I

think the other thing that's interesting
here is pretty much all of these apps use

their own specific binary format that's
like yet again this totally new thing

where it's like someone just coded some
totally one-off thing. And that's weird.

And the final thing is we're gonna release
a bunch of educational materials that seem

to sort of end up on these devices.
Education is one of the big purposes,

right? You're you're giving these to the
the children and teenagers who are

especially excited about technology and
one of the useful things that they can do

is use that for for their course material.
In getting a set of PDFs that are sort of

like usable, we ended up having to do some
work. I'm gonna turn over to Gabe to

explain sort of the process we went
through and getting this this last set of

the the textbooks that are
going to come out.

Gabe: Thanks, Will. So basically when I
got involved with this, the situation as

far as these textbooks was that we had
quite a few of these files. And there are

two things you could tell on the surface -
one is that they claim to be PDF files

based on the filename, and some of them
have titles in English or Korean -

that sort of suggests

what's inside. But what you see on the
screen is not what we saw because none of

these files were plain PDFs. So there's a
bit of sort of custom DRM that's been

applied to these files and it's pretty
rudimentary, but it's actually been kind

of remarkably decent job of what we think
it was designed for. Which is that the the

textbooks that come with or that come with
or that are added to one device are not

supposed to be able to be accessed on a
different device. And as well so if you

pulled the these PDF files out of the
device that you send off outside the

country, they're not readable. Now one
thing I will say is that we know from some

of the previous talks on Red Star that
developers in and for the DPRK have

implemented actual AES-like encryption.
This is not that - it's fairly basic and

we did find some some holes in it. So talk
a little bit about what we did. So when we

look at these files, the first thing we
notice is that they don't have a PDF

header. The first eight bytes have this
reference or this potential reference

anyway to what will might be a date in
little-endian format. So this might be

either December 1st or January 12th in
1978. If you have any idea what that

means, please let us know because we're
kind of curious. The next thing is that

when we started to look at the devices,
because we also had the the applications

that read these files, one of them has a
hard coded reference to those first four

bytes. And so when you look at what that
application was, we find that it's this

app called UDK.Android.Reader, which if
you go to the Google Play Store it's just

a commercially available PDF Reader app
for Android. But it's not really, because

it's been modified to implement the the
DRM that we're looking at here. So

basically, we took the the copy of the
reader that's available online, and one of

the copies on one of the devices, and
we'll compare them we find that the

application calls out to a shared library
when it wants to parse a PDF file. That

library looks kind of like this
- these are the ELF sections in the file

and it's pretty normal. When we look at
the copy that's on the DPRK version of the

app, there's this one section added that
kind of jumps out - like it's literally

called dot-modified. So when you look into
what's in that section, we see something

like this - and this is really not going
to be legible both because of the size of

text and because it's decompiled from ARM.
But we have the original decompiled code

on the left, and the DPRK version on the
right. And the two things I just want to

highlight are - at the top the original
function that would be filling a buffer to

read the file has been replaced by a stub
that calls this sort of custom method in

the modified section. And this the version
that's over in the modified section does

basically the exact same thing, except
that in one case it will call another

function that does some decryption. And
there's some other things as well in the

modified section this is just sort of one
example. Now the reason that this is kind

of interesting to us is that it really
shows us that these modifications were not

made by someone who had source code.
Like this is kind of crazy low-level, not

crazy, but like it's it's really low-level
modification of the binary itself. So when

we look into those functions and what they
do, what we start finding is that the

shared library, the modified version of
the shared library, has this 512 bytes pad

which basically gets used over and over
again as part of the decryption process.

And one of the things about it is that for
different files you will start using it at

a different point. And there's also a four
byte key that's different for every file,

which comes from a combination of a few
bytes in the file header itself, and a

per-device key. So that per-device key is
kind of interesting. So they're taking,

well at the end of the day you want a four
byte key, and they're generating it out of

a six byte MAC address and the code that
they use kind of looks like this.

This is us reimplementing it
in Go. One of

the weird things about it is that some of
these devices may not actually have useful

MAC addresses so in some cases the MAC
address that's using is actually just some

hard-coded value in a file. All the time
when it reads these MAC addresses it's

really just reading some code or some some
text out of that system etc MAC address

file. So if you have that key, the process
to decrypt is really simple. You take that

key, you subtract some of the bytes - the
ones marked with Y, and you get your four

bytes to do a decryption. And the point in
the pad that I mentioned for this (tilaka)

starting offset is just that same value
interpreted as an integer mod 512 because

that's the length of the pad. In all the
examples we looked at, or as far as we

could tell, these headers only had keys
for like one device. But looking at the

the compiled code it looks like it might
be possible to have like one file that can

be decrypted by multiple different
devices. We just haven't actually seen a

file that is like. So the way that
actually does decryption is byte by byte

and this is a simplified view of what's
going on. We're releasing a tool that will

do this correctly and has all the details
in it but in a nutshell what you're doing

is you're doing a little bit of math to
figure out where you are starting from for

all these operations. And then for each
byte that you want to decrypt, you take

your encrypted byte, you subtract one of
the per-file bytes, and then you XOR the

whole thing with one of the bytes from
that 512 byte pad. So, the cool thing

about this from my point of view is that
this process is totally reversible. So if

you don't know your per-file key but you
do know what the plaintext should look

like, you can run this backwards. And it
looks ound like that. So what if you just

get a bunch of these encrypted PDF files
and you have no idea what device they came

from and you just want to look at them?
You can also do it like. It's really

quick to do you basically
brute-force all of the potentialial

positions to be starting from, which
is really not that many many because the

pad is not very big. And it's kind of a
plain text at a known plaintext attack.

The header a PDF file always looks like %
PDF and then there's a version number. So

you take 4 bytes you calculate the per-
file key that you would need to to make

that decrypt to % PDF and then you take
the same per-file key and you see if it

would be able to decrypt the next section
to a version number, and wind up with a

valid header. And so we've done this for
all of the the files that we found, and

basically wound up with plain text for all
these. One of the things that we noticed

after decrypting these files is that many
of them have watermarks at the end - so if

we look back to the talks on Red Star OS
from the past years, Florian and Niklaus

did some work on understanding what the
watermark is. And if you want full details

look at those talks. But to summarize it -
every time that a file passes through a

desktop system or sometimes a file gets
modified the OS adds basically an

encrypted form of the hard drive serial
number. Now when releasing these files we

want to sort of obscure their origins and
not get any particular people into

trouble, so we remove all those watermarks
before releasing these. And that's pretty

simple because the way that this works
with PDF files is just that there's a

known line of text at the end of the file
that represents the end of the PDF, and

the Red Star always puts these watermarks
at the end so we just chop off the end. So

once we have this we have like over 300
files of really different kinds of things,

and we've kind of looked at some of them
but we're going to be releasing a torrent

with all of them and we'd really like to
see what people come up with - just you

know that that's in these files that we
have noticed.

Will: Have we looked at all of them?
Gabe: I mean yeah, we've had like a quick

look at some of them. We don't, I don't
speak Korean, you know some. There's

probably more to be found in that archive.
So quick a look at just a couple of

examples of things we found. There's many
different kinds of books on these devices

many of them are like computer science
books, there's general-purpose knowledge

kids textbooks. But because we want to
understand the state of technology in in

the DPRK, the part that's most interesting
to us right now is computer science

textbooks. So like two of the examples we
have are this Java programming book and

this computer science book. They've got
some awesome covers and really neat art in

some of them. But yeah, I'll hand that
back to to Will to actually talk about the

analysis of what we we found in these
books and sort of where they came from.

Will: Cool. Yeah, so maybe another quote

from from Kim Jong-il is appropriate,
saying that we need to be aware of the

information technology industry and we
need to meet the needs of the information

technology industry. And so I think one of
the things that that comes out of these

text books that that I think is sort of
interesting and this is the first benefit

is that this can help us understand sort
of where Korea is in terms of how much

emphasis its placing on this aspect. For a
lot of the educational materials, they

seem to be organically created, they seem
to be about the specific environment

there's a lot of training kids how to use
Red Star of various versions that you see.

The textbooks, many of them are translated
or follow a curriculum and a layout of

foreign external materials that have been
translated. So for some of the ones where

we could identify what the original source
was, we tried to calculate how long that

had taken, because we were actually
surprised sometimes this was a pretty

quick. So I'll show this waterfall graph -
each of these bars represents one book.

Some of the titles at the bottom they're
quite small and the the y-axis is the

year. The bottom is when the original
English version that was used seemed to

come out and and the top is when the
translation was released. And so what's

interesting here is you
see order of even the

same year sometimes a couple years
throughout this whole period of 2000 to

2010 where they're putting a bunch of
effort into taking four-hundred, five-

hundred page books. The the torrent of
these text books is four-some gigs, and

doing good translations fairly quickly.
These are like solid translations the code

examples have been often changed, there's
comments in Korean in there. Like, this is

this is a solid effort that we should be
understanding and I think maybe partially

sort of fills this gap of like, what is
this disconnect between this very isolated

country and the fact that it has a really
strong computer capability. Cool, to end,

I just want to sort of give an anecdote
that maybe goes to the other side of this

anthropological value that we get out of
this sort of work. So you've heard about

Kwangmyong - this is the internal network
or Internet. And so from these educational

textbooks you start to get I think more
insight into sort of how this thing has

progressed over over time. Here's pictures
from 2001, I apologize for quality, this

was what was there of an early version of
Kwangmyong. This is Kwangmyong 5.1 which

looks sort of like AOL. It was a dial-up
application that would get you documents

and information. You also see at that same
time that there was an email sort of

corresponding app called "hey son" - I
think I got that pronunciation not too bad

that was used for messaging. We've heard
that there was a messaging system, we

didn't really have that connected to sort
of where that fit in to the puzzle. A

picture that seems to be that same sort of
Internal network ended up on the South

Korean internet around 2005. It got reused
by anonymous in 2013 when they claimed to

attack the Korean government servers, but
but then sort of that that turned out to

be false in that it was this original 2005
post that someone made. That seems to be a

similar system. And even in that 2005 post
they they had sort of also their web

component - that's the same logo
in the upper left as they moved

to sort of a web site
that we've now seen

evolved. It's worth noting here right
Kwangmyong is a single site - it's a

service for generally technical document
retrieval. Here's that same site now up to

the 2010-era looking a little bit nicer at
least at higher quality in the picture.

And so I think what we're starting to do
is we're getting these insights through

through seeing some of these more
documents coming out about what this

internal ecosystem actually looks like.
There are these these services that we can

start to link over time, understand what
sorts of files are available and the

specialties of these different groups, and
and preserve some of this internal network

that, you know, in this fairly unstable
environment, we're at in danger of losing.

To bring us up to current time, this is
from 2015 - a sort of blurry picture from

a Koryolink office. Koryolink's the the
mobile telephony provider and to call out

that they now have a same set of services
on a poster advertising mobile service

with internal IPs to them. And so we're
seeing now that this is being introduced

at a wider availability and advertised to
people on their mobile devices. So we're

moving beyond just wire desktop
connections but this is now a thing that

more people are going to have access to on
personal devices. And so I think you know,

internally, we're in this really exciting
transitionary phase. I'm happy that that

more of this ends up in the public. So,
there's this site, koreacomputecenter - it

should already have some links, more will
show up very soon. If you are interested

we encourage you to go grab that stuff try
and make it the bar lower. If you have

DPRK artifacts, info@
koreacomputercenter.org - we'd love to

talk to you, help make stuff safe, and get
more stuff out for public consumption. I

think we are about that time - are you
coming kicking us off; so we will take

questions across the hall in
the tea room. Thank you.

Applause

34c3 postroll

subtitles created by c3subtitles.de
in the year 2018. Join, and help us!