There’s a couple of VPN’s out there that list having servers in North Korea. I’ve emailed a few of them to get some more information but this post investigates everything nicely and explains why it isn’t true: https://blog.benjojo.co.uk/post/north-korea-dprk-bgp-geoip-fruad

If you aren’t familiar with the Shadow Brokers group there’s a decent article here: https://www.theatlantic.com/technology/archive/2017/05/shadow-brokers/527778/

Looking through the leak there’s one interesting thing that I found. Based on the code it looks like the CIA was using these tools in North Korea. There’s lines specifically looking for Silivaccine running on an endpoint.

If you track North Korea on Shodan one of the most unusual things is the amount of services running on port 8080 that don’t seem to respond to anything. Found this the other day.

MA-App, FinalJust cleaning out some files and uploading some random North Korean documents that I found on different non-North Korean sites.vdocuments.mx_sam-hung-30-help

There’s an interesting error that’s still currently on naenara.com.kp on the home page. Looks like one of the links wasn’t updated and is still pointing to an internal server. The link on the homepage is currently pointing to: http://172.200.200.101/ko/memoirs/index.php?id=205&level=0&order=8&tak=0&action=expand&page=0

Well this turned out to be sort of a bummer. Last night I noticed on Shodan that 175.45.176.21 has a domain futurere.com.kp associated with it. I started doing some digging into it and really the only thing that I could find at first was the associated hostname mail1.futurere.com.kp. That’s not really anything too noteworthy, neither is the fact that future.com.kp redirected to naenara.com.kp.

What was interesting though is that the site pyongyangtimes.com.kp has a separate sites directory that had a number of websites which included Future Re. I put my notes below, they’re broken out into site title, potential URL for the site, and then the actual URL on pyongyangtimes.com.kp

• Polestar – future.com.kp – https://www.pyongyangtimes.com.kp/sites/polestar
• Future Re – future.com.kp – https://www.pyongyangtimes.com.kp/sites/refuture
• Pyongyang Ryugyong Foodstuff Co. Ltd – ??? – https://www.pyongyangtimes.com.kp/sites/ryugyong
• The Central Committee of the Korea Federation for Protection of the Disabled – ??? – https://www.pyongyangtimes.com.kp/sites/kfpd
• Unjong Hi-tech Development Park – ??? – https://www.pyongyangtimes.com.kp/sites/unjong
• Kim Il Sung – Kim Jong Il Foundation – ??? – https://www.pyongyangtimes.com.kp/sites/kkf

This was all very interesting at 2 in the morning but I took some notes and went to sleep. I woke up the next morning and all of the sites were taken down. All of the sites that I had found the night before were no longer online.

Even pyongyangtimes.com.kp was displaying an error.

Now, most of the sites are available at http://www.naenara.com.kp/main/index/en/first but it’s still interesting to see that they were hosted elsewhere for a short time.

On an Amtrak and crawling the internet for interesting North Korea items. I haven’t been able to verify anything on the page but the author seems to claim that there are 7 ip’s that are associated with the North Korean army: https://translate.google.com/translate?sl=auto&tl=en&u=http%3A%2F%2Fkelvinsecteam.blogspot.com%2F2015%2F01%2Fkorea-del-norte-y-su-red-actual.html

Started a YouTube channel posting videos from North Korea: https://www.youtube.com/channel/UCuWrXLF2tEj4xgxvcRvp5mQ/

I’ve been working on tracking down North Korean software. Will post some over the next few days. Working on getting copies of the dictionaries and get rid of the error message. Originally found that information was posted online here: https://processchecker.com/file/Nnr60.exe.html

If you want to take a look at the help manual you can download it here: vdocuments.mx_sam-hung-30-help

Looks like there are two new sites that came online recently. Will be digging into these further.

Korean Art –  http://www.korart.sca.kp/

Ryomyong – http://www.ryomyong.edu.kp/kp/