GitHub Commits From Pyongyang University of Science and Technology (PUST)
PUST maintains a GitHub account for committing changes to open source projects on GitHub: https://github.com/arirang-pust A sample commit can be found here: https://github.com/mlpack/mlpack/pull/842...
View ArticleClik here to view.
Internet Outages Solved
Looks like Wired got to the bottom of the recent outages in North Korea: https://www.wired.com/story/north-korea-hacker-internet-outage/ Now that it doesn’t make much of a difference this was a graph...
View ArticleClik here to view.
North Korean Investment Opportunities
About a year ago I received an email from 주전골님 <sealhae@hanmail.net> about investing in North Korea. Below is the full context of the email as well as the JPG’s that were attached. There’s...
View ArticleClik here to view.
North Korea DDoS Wrap Up
This has all been very fun to monitor but looks like it’s coming to an end with the Wired article from yesterday. One last interesting thing that I wanted to point out is that I own a domain that is...
View ArticleIt’s Been a While and New Content Coming
I admit it’s been a while since all the excitement at the start of the year. I’m still not convinced that the person interviewed in the Wired article was responsible for the attacks, or at the very...
View ArticleNew IP Addresses Being Used
Looks like a bunch of domains have switched in the last few days and are now resolving to 175.45.177.10 and 175.45.177.11
View ArticleRe-Signing North Korean Android Apps
In case you run into a similar problem that I ran into on getting apks off DPRK phones and not being able to run them on other devices. Here’s the steps for re-signing apktool d -r -s application.apk...
View ArticleNew Website – Kim Il Sung- Kim Jong Il Foundation
Found this posted on twitter a few days ago, not yet listed on dprkportal.kp North Korea has launched a new #website!The website, https://t.co/jd2KzfOmgL appeared in early July and serves as the...
View ArticleBGP Change – 175.45.177.0/24
Looks like as of 5:26 AM ET this morning 175.45.177.0/24 was withdrawn and no longer visible. As of yesterday this is what I was showing was in that range kcna.kp – 175.45.177.1 3 nginx servers at...
View ArticleResumes from Pyongyang Gwangmyeon Information Technology Corporation
Found a couple of resumes online from the Pyongyang Gwangmyeon Information Technology Corporation. Interesting thing is that it doesn’t have names or past employment. Seems to be mostly focused on...
View ArticleClik here to view.
Red Star 4.0 Management Interface
Forgot to post these a while back but some screenshots of the Red Star 4.0 management interface.
View ArticleClik here to view.
Exposed Nextcloud Instance
Putting some of these back now that the story has been published. This was some info on the exposed server config/config.php is exposed but the files can’t be accessed. Working backwards it appears...
View ArticleClik here to view.
Unauthenticated Telnet Login for Cisco Devices
Someone shared some notes with me about a Cisco router in 175.45.178.0/24 that was allowing unauthenticated telnet connections: Multiple Subnets and Network Segmentation: The switch manages traffic...
View ArticleClik here to view.
Old pust.kr Screenshot
Cleaning up years of old screenshots and files and came across this screenshot for pust.kr (Pyongyang University of Science and Technology). The domain currently doesn’t resolve but back in 2016 when...
View ArticleClik here to view.
Error Messages
Someone shared with me a couple of files that are from the Amnokgang Technology Development Company. You can read more about Amnokgang here:...
View ArticlePEFIS Developer and Admin Manuals
Found some manuals from PEFIS. Two of them include documentation for software that provides an interface to the FK6xx series fingerprint time attendance terminals. The other provides instructions for...
View ArticleSilibank Exchange Server
https://mail.silibank.net is resolving to an Exchange server. It’s not silibank.net.kp but interesting to see something so close resolving.
View ArticleRim Jong Hyok and Maui Ransomware
Been looking through the Rim Jong Hyok indictment and maui ransomware affidavit. A couple of interesting things that I’ve found. Rim Jong Hyok indictment:...
View Article