tomitaku.net

Red Star OS

붉은별 / Bulgeunbyeol
add · 981 words

A Linux distribution developed and distributed by North Korea for domestic use. Its Korean name is "붉은별" (red star); in English it is called Red Star OS and in Chinese 红星操作系统※1. The Korea Computer Center (KCC) is said to have begun development in 1998, and it is built on the premise of connecting to Kwangmyong, the state's information network. What draws technical attention is not the advancement of its features but that modifications aimed at surveillance of users are built into it. A mechanism has been reported that embeds into files, even ones never opened, a watermark derived from the hard disk's serial number, making it possible to trace after the fact the route by which media brought in from abroad have circulated.

Origins and lineage

Sources disagree on the distribution it was based on, some giving Fedora and others Red Hat Linux※2. Versions were updated in order from 1.0, and when the contents of 3.0 leaked abroad in 2015 it became widely subject to analysis. The latest stable version is given as 4.0, and there is an account that a South Korean outlet obtained a copy and reported on it in 2020.

Assessments of the early versions are severe. An analysis carried out in 2010 by South Korea's Science and Technology Policy Institute (STEPI) judged it about ten years behind in technical level, with almost no applications that ran on it. Rather than independent development, it is a configuration adding domestic modifications to publicly available Linux, and its distinctiveness lies on the side of the content of those modifications.

Appearance and contents

In 3.0 the look of the desktop was changed into a form resembling macOS. Earlier versions are said to have looked closer to Windows, so the object of reference was switched. What is bundled is software for ordinary purposes such as document creation and music production, together with a web browser named Naenara (meaning "my country"). Naenara is a modification of Mozilla Firefox and is used to view the portal on Kwangmyong, the state's information network.

Modifications extend to the handling of networks. According to researchers' analysis, it is made so that the destinations it connects to are limited to the domestic network, and ordinary users going out onto networks abroad is not anticipated. In 2016 an observation was also raised that a route for attacking Naenara remotely remains※3.

The mechanism of surveillance

At the 32nd Chaos Communication Congress in December 2015, Florian Grunow and Niklaus Schiess presented the results of their analysis of 3.0. At the center of the report is the mechanism that puts watermarks into files. The mechanism as reported encrypts the serial number of the hard disk at that moment and writes that value into the file. Its targets are documents and media files on the computer and files on attached removable storage devices, and it is said to be applied irrespective of whether the user has opened them.

What this means is that when video or documents from abroad circulate on a USB memory stick, it becomes possible to identify after the fact which machines that medium passed through. The researchers also touched on the existence of a more complex extended version, which may be used to identify individual users, but said they could not fully account for the mechanism.

Resistance to modification is built in as well. When a user tries to disable or alter the antivirus software or the firewall, the system reboots. According to the report, a resident process holding a list of MD5 hashes triggers a reboot at the point it detects that one of the files in question has been changed. The freedom to change settings is technically closed off.

The place of a "domestic OS"

The frame of a domestic OS exists in many countries, and it is usually spoken of with aims such as reducing dependence on foreign software or preparing for a break in supply. In the case of Red Star OS, alongside those motives, the aim of grasping the routes by which information circulates appears clearly on the side of the implementation. That design resources are spent in the direction of lowering rather than raising the freedom of the computer is what separates its character from other cases of domestic operating systems.

Another thing to hold onto is that the sources for analysis are limited. Published analyses rest almost entirely on the leaked 3.0, and the realities of operation — which version is used domestically and to what extent, the state of deployment in schools and workplaces, what changed in 4.0 — are hard to see from outside. A wide area remains in which assertions should be avoided.

To verify

  • The rendering and reading in Japanese. "紅星" is a kanji rendering corresponding to the Chinese 红星操作系统, and Japanese reporting and commentary most often write "Red Star OS" in Latin letters. The reading "こうせい" is placed from the characters' on readings, and whether an established Japanese reading exists could not be confirmed
  • Details of 4.0. There is an account that a South Korean outlet obtained a copy and reported on it in 2020, but the original reporting itself could not be consulted. The changes from 3.0 could not be confirmed either
  • Whether the observation of a remote attack route in Naenara applies to current versions. It is an analysis as of 2016, and whether it was subsequently fixed is unknown
  • The concrete mechanism of the "extended version" of the watermarking. This is the part the researchers themselves said they could not fully account for, and later developments could not be confirmed
  • Whether it uses existing mandatory access control mechanisms on the Linux side, such as SELinux
  • The actual state of deployment and the scale of use domestically. Published analyses rest on the leaked version, and material showing the realities of operation was not found

References

Mentioned in
none
Similar