North Korea accidentally leaks DNS

[Ilija.m]

North Korea accidentally leaked all of its propaganda websites, providing global internet users with unprecedented insight into the secretive nation's internet infrastructure. The websites were leaked on Tuesday (19 September) and it was found that North Korea had just 28 sites registered on its .kp domain.

The leak was a result of an accidental misconfiguration of North Korea's nameserver, which stores information of all the domains existing under .kp. The misconfiguration allowed users to request information on the nation's DNS data, which in turn revealed the country's existing domains. The accidental misconfiguration was uncovered by researchers at the TL;DR project, who then proceeded to perform an AXFR (zone transfer) request, which allowed them access to North Korea's top-level DNS data.

The researchers then posted aggregated data on GitHub with a message that reads, "On Sept 19, 2016 at approximately 10:00PM (PDT), one of North Korea's top level nameservers was accidentally configured to allow global DNS zone transfers. This allows anyone who performs an AXFR (zone transfer) request to the country'sns2.kptc.kp nameserver to get a copy of the nation's top level DNS data. This was detected by the TL;DR Project- an effort to attempt zone transfers against all top level domain (TLD) nameservers every two hours and keep a running Github repo with the resulting data. This data gives us a better picture of North Korea's domains and top level DNS."

According to reports, majority of the leaked sites are dedicated to describing everyday activities of the nation's supreme leader Kim Jong-un. Two websites had the top news story about Kim Jong-un visiting a fruit farm. One site, Rodong.rep.kp also came with a dedicated section titled "Supreme Leader's Activities", which detailed the various contributions made by the dictator, including heralding the supposed transformation of the country's youngsters into "Kimilsungist-Kimjongilist's," the nation's only youth organisation.

Many sites also discussed rival South Korea, anti-US propaganda and the nation's nuclear tests. One article titled, Peruvian Party Urges US To Stop Nuclear Threat And Sanctions Against DPRK, allegedly made false claims about the government in Peru speaking out against US President Barack Obama's denouncement of North Korea's nuclear tests.

Among the sites discovered were a few that appeared clones of popular western social media sites, such as friend.com.kp, which appears to be a clone of Facebook. This appeared to be a different site from the one hacked in June. Website clones for Yahoo, and movie4k, a piracy site were also discovered, Motherboard reported.

"We didn't think there was much in the way of internet resources in North Korea, and according to these leaked zone files, we were right," said Doug Madory, a researcher at internet monitoring and performance firm Dyn.

Here's a list of all the websites and what they are in case you can't visit the link at the top:

http://airkoryo.com.kp - Air Koryo. A flight ticket website.

http://cooks.org.kp - Korean Dishes. Culinary website with recipes.

http://friend.com.kp - Friend. Appears to be something similar to Yahoo and MSN.

http://gnu.rep.kp - National Unity. A sort of religious group or well-being group.

http://kass.org.kp - Korean Association of Social Scientists. Not sure, but I think it's an education website for both school and adult education courses maybe.

http://kcna.kp - Korean Central News Agency. Yet another news website.

http://kiyctc.com.kp - Korean International Youth and Children's Travel Company. I guess a travel company of both youth and children.

http://knic.com.kp - Korean People Total Insurance Company. Insurance company.

http://koredufund.org.kp - Korea Education Fund. Appears to be a charity to increase the quality of education.

http://korelcfund.org.kp - Korea Elderly Care Fund. A charity for the elderly.

http://korfilm.com.kp - KorFilms - Pyongang International Film Festival. The film website.

http://ma.gov.kp - Maritime Administration of Korea. Laws of the water can be found here.

http://masikryong.com.kp - currently can't access

http://naenara.com.kp - Naenara. - This is actually the "official" government site in the sense of a description of the country. It has plenty of news articles but it contains a decent amount of (tourist oriented?) information about the country (thanks /u/tinoh124 for the correction).

http://nta.gov.kp - Korea Tourism. The Korean Tourism board, looks like you can get tours from here.

http://portal.net.kp - currently can't access

http://rcc.net.kp - currently can't access

http://rep.kp - currently can't access

http://rodong.rep.kp - Rodong. Official news website. Click here to view the Rodong website in the user-friendly Western version, thanks again to /u/tinoh124 for this.

http://ryongnamsan.edu.kp - Kim Il Sung University. - The university's website.

http://sdprk.org.kp - Sports Chosun. - The sports website.

http://silibank.net.kp - currently can't access

http://star-co.net.kp - currently can't access

http://star-di.net.kp - currently can't access

http://star.co.kp - currently can't access

http://star.edu.kp - currently can't access

http://star.net.kp - currently can't access

http://vok.rep.kp - Voice Of Korea. A news website.

Redit thread

[sswbm]

Saw this too. I hope no server administrators are going to die.

[HSHARK]

It is interesting that some of the website names used english words despite the fact North Korea despises the US

[sswbm]

(09-25-2016 02:17 AM)HSHARK Wrote:  It is interesting that some of the website names used english words despite the fact North Korea despises the US

English isn't only the US. But yeah, well noticed. You'd think it'd be in Korean.