[00:00.000 --> 00:00.500]  I apologise.
[00:02.020 --> 00:08.700]  Thirdly, I'd like to point out to the person that was talking about this talk in the lift, that there is more to this talk than you can learn on f*cking Google.
[00:11.360 --> 00:14.020]  Don't know who you are, but thank you very much, constructive criticism.
[00:14.700 --> 00:17.440]  Anyway, I've gone the wrong f*cking way.
[00:17.680 --> 00:18.140]  There we go.
[00:20.860 --> 00:21.900]  That was Leek, wasn't it?
[00:22.060 --> 00:22.780]  Well done, Mike.
[00:23.140 --> 00:34.000]  So, I'd like to begin with a standard disclaimer, largely that the views and opinions and the general ramblings in this talk are largely my opinion, not the opinion of anybody that I'm affiliated with.
[00:35.120 --> 00:37.340]  Number 100 here is inferred or granted.
[00:37.840 --> 00:45.060]  And additionally, if after this talk I suddenly disappear off the face of the earth, please contact the North Korean Embassy and ask them where the f*ck I am.
[00:46.520 --> 00:55.880]  They stopped kidnapping people in about 87, where a South Korean MIT student was abducted in Austria, which is where I last gave this talk and got out of Austria.
[00:56.020 --> 00:58.440]  But, you know, if I disappear, please let them know.
[01:00.840 --> 01:02.640]  So, I'd like to begin with a couple of quotes.
[01:02.640 --> 01:05.600]  One from George Orwell, everybody's favourite dystopic author.
[01:05.880 --> 01:08.240]  Namely, if there's any hope, it must lie with the proles.
[01:08.760 --> 01:11.720]  And secondly, from the wonderful, wonderful person that is Kim Jong Il.
[01:11.920 --> 01:13.420]  Namely, that he is an Internet master.
[01:14.640 --> 01:18.820]  That's not that unusual, bearing in mind that Kim Jong Il is a master of everything.
[01:18.820 --> 01:21.720]  He is, in fact, Superman and needs a little cape.
[01:22.840 --> 01:23.840]  Anyway, who am I?
[01:24.000 --> 01:27.860]  Well, as you may have guessed by the very un-American accent, I'm actually from the UK.
[01:29.380 --> 01:32.760]  I have not now, nor have ever been a member of the Communist Party.
[01:32.760 --> 01:34.280]  That's an important thing to say in America.
[01:35.360 --> 01:41.400]  I'm not now, nor have I ever been an intelligence operative, largely because I lack the prerequisite, which is intelligence.
[01:42.600 --> 01:48.000]  I have not been to North Korea, and I don't intend to go, because I don't think I'd ever come home again.
[01:48.860 --> 01:52.480]  And my pronunciation in this talk will probably be all kinds of wrong.
[01:52.600 --> 01:55.460]  So if you speak Korean, I don't, so bear that in mind.
[01:55.920 --> 02:02.380]  And I'm also very, very sick of the whole cyber warfare sideshow, largely because that's what it is.
[02:02.900 --> 02:04.720]  So, what am I actually going to be talking about?
[02:05.380 --> 02:09.060]  Everyone, apparently, according to Fox News, is terrified of North Korea.
[02:10.240 --> 02:15.100]  It's part of the axis of evil, which makes it sound a bit like it shoved along in a Batman comic.
[02:17.180 --> 02:18.520]  Basically, though, what is North Korea?
[02:18.600 --> 02:22.280]  It's a Stalinist dictatorship run by a wiggy idiot in a jumpsuit.
[02:23.340 --> 02:31.380]  It's also an Internet black hole in as much that it doesn't seem to have that many technological systems attached to it, allegedly, anyway.
[02:33.100 --> 02:44.380]  What I'm going to be talking about is an examination of the external security that surrounds North Korea, and also the internal infrastructure, and also the weird international relationships.
[02:45.820 --> 02:55.720]  It might not seem to be about hacking this talk, but it kind of is, in as much that North Korea is a closed system, like the ultimate closed system, and examining closed systems is kind of interesting.
[02:56.600 --> 02:58.940]  What this talk won't go on about is Oday.
[02:59.320 --> 03:00.760]  There is no Oday in this talk.
[03:00.760 --> 03:02.140]  If you want Oday, please leave.
[03:02.960 --> 03:11.680]  I'm amazed to see so many people here, actually, because I thought you'd all be listening to how, you know, how to be a successful rat bastard, which sounds like a much more interesting talk.
[03:12.280 --> 03:17.820]  There's also no technical demo in this talk, and hopefully there's no fear and loathing, so there's no over-inflated FUD.
[03:18.340 --> 03:23.620]  So, when people think about North Korea, typically they think about a couple of things.
[03:25.300 --> 03:33.880]  Monty Python's Ministry of Silly Walk, military-style walking, strange wiggy men from Team America, and global apocalypse.
[03:34.460 --> 03:36.840]  However, there is a bit more to North Korea than that.
[03:38.900 --> 03:49.080]  Since I last gave this talk, well, since the first time I gave this talk, which was in May, North Korea's actually in the news again, because North Korea's just remembered they're at war with South Korea.
[03:50.860 --> 03:55.160]  They tended to forget that, but they've just remembered after 50 years they're still at war.
[03:56.200 --> 04:05.200]  As you may probably be aware, in March 2010, a South Korean warship was destroyed in international waters.
[04:06.500 --> 04:12.880]  Now, lots of conjectures around that, whether or not that was North Koreans, because, you know, there was an antique torpedo, so it could well have been.
[04:14.180 --> 04:16.740]  But, alternatively, they could just have wandered into a U.S. mine.
[04:16.860 --> 04:20.160]  Nobody knows, but, you know, they're back in the news, which is always good, which makes this topical.
[04:21.560 --> 04:23.160]  So, two parts of this talk.
[04:23.440 --> 04:31.780]  The first part wherein I'm going to try and get the infrastructure of a country down to about 30 slides, which is fairly interesting.
[04:32.180 --> 04:33.160]  And a second bit.
[04:33.460 --> 04:44.060]  So, I'd like to begin with a quote from the Socialist Constitution from North Korea, namely that citizens are guaranteed freedom of speech of the press, of assembly, demonstration and association.
[04:44.540 --> 04:47.460]  If that sounds familiar, that's because you've got a constitution.
[04:47.940 --> 04:49.700]  I'm from the UK, where we don't.
[04:51.720 --> 04:52.200]  So...
[04:53.600 --> 04:56.160]  Incidentally, I have notes because I can't remember this shit.
[04:57.580 --> 04:58.060]  So...
[05:00.120 --> 05:02.720]  What's North Korea all about from a technical perspective?
[05:02.920 --> 05:06.240]  Well, they don't have the Internet as you and I typically know it.
[05:06.240 --> 05:12.200]  What they have is something called Qiong Myung, which is basically a state-run intranet.
[05:12.440 --> 05:26.800]  For anything to get on that resource, it has to go through various censorship boards, it has to go through various political boards, and if it's not classed as a threat to the regime, or Kim Jong-il, or indeed, you know, Stalin, it gets on there.
[05:27.640 --> 05:34.060]  Problem is, it's very limited, it's very restrictive, and it's also via the KCC's connections to servers in Germany.
[05:34.520 --> 05:37.160]  Because yes, the Germans like fascists, who knew?
[05:37.980 --> 05:38.340]  So...
[05:41.060 --> 05:43.160]  To talk about Qiong Myung in a bit more detail.
[05:43.380 --> 05:50.520]  Basically, Qiong Myung, which I will now call Breit, as that's what it actually means, is, as I say, the state-approved version of the Internet.
[05:50.980 --> 05:56.760]  You know, there is no lolcat, there is no lemon party, there is just lots of stuff saying how awesome Kim is.
[05:58.120 --> 06:04.160]  According to Wikipedia, and this is a direct quote, all other people use Qiong Myung.
[06:04.280 --> 06:06.100]  This is a free service for public use.
[06:06.420 --> 06:19.240]  Now, in a country where the annual income is about $2,000 a year, I very much doubt whether many people have access to IT, and if they do have access to IT, can actually afford to use this service.
[06:19.240 --> 06:24.100]  So, I would actually tend to dispute Wikipedia's rose-tinted view of the universe.
[06:25.420 --> 06:30.020]  As well as a state-run intranet, the South Koreans...
[06:30.020 --> 06:34.660]  Oh, sorry, the North Koreans used to be able to communicate via email using a service called SillyBank.
[06:35.080 --> 06:37.220]  SillyBank, the clue is in the name, used to be a bank.
[06:38.420 --> 06:45.360]  As of 2007, SillyBank are no longer online, which may suggest that the North Koreans no longer have access to email.
[06:45.360 --> 06:53.480]  But up until 2007, there were gateways from SillyBank, which was situated in a province of China, which allowed North Koreans to use email.
[06:54.720 --> 06:55.240]  So...
[06:56.840 --> 07:00.500]  For internal use, as I said earlier, you've got Qiong Myung.
[07:01.260 --> 07:09.120]  Basically, that was launched in 2000, and reportedly consists of a browser, an email client, and really, really heavily filtered search engine.
[07:10.400 --> 07:16.420]  As I said earlier, for a resource to get on there, it's got to get past the regime's sensors, which is no mean feat.
[07:17.520 --> 07:27.440]  That's typically accessed via dial-up servers in China, but as I said, also via dial-up in Germany, or to Germany, I should say, and is very much the ultimate walled garden.
[07:27.560 --> 07:29.760]  Basically, think AOL, but on a mass scale.
[07:31.960 --> 07:37.620]  So, as well as the internal intranet, you also have telephones in North Korea.
[07:38.780 --> 07:53.620]  Basically, according to Marcus Nolan, who's a telecoms researcher who did a lot of work about North Korea, or as much as anybody can, there's about 1.1 million landlines in North Korea, which, to put it another way, is about five landlines to 100 people.
[07:53.720 --> 07:56.240]  So, if you need to make an important call, be prepared to queue.
[07:57.200 --> 08:01.880]  There were plans to expand telecom coverage in 2003.
[08:01.880 --> 08:09.520]  However, in 2007, the North Korean government decided that giving people access to telephones is probably not such a good idea.
[08:10.920 --> 08:12.520]  So, Robert Redford there.
[08:12.720 --> 08:13.320]  Awesome film.
[08:13.440 --> 08:14.700]  Go see Three Days of the Condor.
[08:15.280 --> 08:16.940]  Why is there a picture of Robert Redford?
[08:17.160 --> 08:18.600]  Other than that he's a very attractive man.
[08:21.040 --> 08:25.920]  Basically, the only automated switching you will find for telecoms is around Pyongyang.
[08:26.160 --> 08:29.720]  Basically, anywhere outside of Pyongyang uses manual switching.
[08:31.800 --> 08:35.640]  Indeed, most places in North Korea still use manually wound phones.
[08:35.900 --> 08:43.780]  So, you know, instead of actually picking up a receiver and dialing a number, you pick up a receiver, crank it, and then maybe dial a number, which maybe or maybe not gets through.
[08:46.240 --> 08:53.080]  The automated switches that are in use in Pyongyang, though, interestingly enough, are provided by Alcatel, which is a French company.
[08:53.360 --> 08:56.480]  Now, if you've ever tried to use French technology, they have my sympathy.
[08:58.640 --> 09:01.020]  LAUGHTER Moving on.
[09:01.540 --> 09:08.040]  Anyway, apart from Pyongyang, it is still possible for an elect elite to access the Internet as we know it.
[09:08.820 --> 09:16.500]  In 2005, there's an organisation called RENC, which has basically been set up to help North Koreans that have had the brain to leave North Korea.
[09:17.460 --> 09:28.040]  They went undercover in North Korea, which is extraordinarily brave, to get some pictures of one of the few cyber cafes that were around, called the Information Technology Store, snappily titled.
[09:28.700 --> 09:39.040]  As you may have noticed, it's not your typical Internet cafe, and as much as there's a little man whose sole job is to wander around and look over your shoulder and check what you're doing, which is a bit odd.
[09:41.360 --> 09:45.180]  The IT store was one of the very few state-sanctioned Internet cafes.
[09:45.500 --> 09:47.160]  There are only two that are known about.
[09:47.780 --> 09:54.880]  It was opened in 2005 and charged about, allegedly anyway, 20,000 won per month.
[09:55.200 --> 09:58.100]  Now, the average salary is 3,000 won.
[09:59.060 --> 10:01.580]  So, you know, a little bit of a disparity there.
[10:02.180 --> 10:08.580]  There's also another one, which was called the Internet PC Room, which was set up by Kim Byung Hoon.
[10:09.040 --> 10:16.200]  If you don't know Mr Hoon, basically he set up something called HoonNet, which was the North Koreans attempt at a gaming site.
[10:16.480 --> 10:19.580]  What they did is they saw how well Betfair were doing and thought, we can do that.
[10:19.860 --> 10:22.660]  So they got a Chinese businessman in to help them.
[10:23.720 --> 10:31.060]  The service charges for that were about $10 for an hour, which breaks down to about 1,500 won.
[10:31.460 --> 10:34.340]  Now, as I say, the average income is about 3,000 won.
[10:34.700 --> 10:40.120]  So, you know, I don't know how much people love the Internet, but I very much doubt they're going to spend a fortnight's salary on an hour's use.
[10:43.180 --> 10:48.520]  As I was saying earlier, most of the connections to the outside world from North Korea go through Chinese ISPs.
[10:49.100 --> 10:52.620]  However, you can also access the Internet directly via satellite.
[10:56.180 --> 10:59.760]  Satellite connections are in use in tourist friendly hotels.
[11:00.140 --> 11:03.520]  Tourist friendly is basically North Korean code for heavily booked, by the way.
[11:05.120 --> 11:09.660]  And because of the expense involved with satellite comms, they're not widespread at all.
[11:10.140 --> 11:17.880]  One thing that is known about North Korea is that nobody actually knows for certain how many North Koreans connect to the Internet and how they do so.
[11:18.240 --> 11:27.840]  But I would guess, and the research that I've done backs this up, that very few do, and that those that do are highly regulated, apart from the upper echelons.
[11:28.780 --> 11:31.240]  Kim can look at YouTube, but nobody else can.
[11:31.240 --> 11:34.740]  So, why is there a picture of a big splash?
[11:35.240 --> 11:47.980]  This is because, in 1986, North Korea and the French, again, set up a couple of Intelsat satellites directly above the Indian Ocean.
[11:48.020 --> 11:50.100]  That allowed for satellite TV, effectively.
[11:51.820 --> 11:53.340]  In 2000...
[11:53.340 --> 11:56.280]  In 2001, rather, North Korea joined Intelsat.
[11:56.540 --> 11:59.220]  They were allowed independently to join satellite...
[11:59.220 --> 12:00.820]  Satellite carrier...
[12:00.820 --> 12:02.940]  Satellite carrier organisation.
[12:04.100 --> 12:11.920]  Since the 80s, the North Koreans have been engaged in a satellite orbiting satellite programme called Brightstar.
[12:12.960 --> 12:18.720]  And in March 2009, they allegedly launched a satellite, which is quite a big deal.
[12:18.960 --> 12:20.700]  You know, it only took them about 30 years.
[12:22.940 --> 12:25.720]  However, they launched it, and they claimed that they'd launched it.
[12:26.480 --> 12:37.260]  According to the U.S. and South Korea, who, let's face it, aren't exactly impartial when it comes to North Korea, but also, according to the Russians, what happened is they launched it, but then it fell into the ocean.
[12:37.860 --> 12:41.660]  So, not kind of an orbiting satellite, but, you know, a successful launch.
[12:42.640 --> 12:46.480]  So, with regards to international direct dialing.
[12:47.040 --> 12:50.800]  As of 1990, there were three direct lines to Japan.
[12:51.920 --> 12:58.820]  In 1995, as recently as that, there was one direct line to the USA, which was courtesy of the lovely people at AT&T.
[12:59.260 --> 13:02.120]  You know, AT&T have problems with 4chan, but not with North Korea.
[13:03.100 --> 13:10.180]  LAUGHTER In 2000, there was a total of 56 international direct dialing lines.
[13:10.460 --> 13:26.320]  Most of those went through the country relays, which has all kinds of interesting parameters with regards interception and monitoring thereof, which is possibly why, in 2008, the North Koreans decided to disable all their IDD connections.
[13:27.800 --> 13:35.760]  So, if you want to phone North Korea, should you wish to do so, you can contact their international operator on that number there.
[13:36.440 --> 13:44.840]  And you can contact a couple of their cellular carriers, namely KuroaLink and Sunnet, which no longer works, on those numbers there.
[13:45.900 --> 13:50.480]  Interestingly, if you want to dial North Korea from outside of the country, there are basically two numbers.
[13:51.180 --> 13:54.320]  If you're in-country, it's 02382.
[13:55.500 --> 13:56.260]  That gets you through.
[13:56.920 --> 14:00.520]  If you're outside country, it's 02381.
[14:01.880 --> 14:12.980]  Basically, if you try and dial North Korea or not from North Korea, you always get through to an operator before you get connected, which is quite interesting because it's a bit like going back in time.
[14:13.660 --> 14:19.960]  As part of this talk, I did consider having a little bit of a war dial and seeing what I could find until I realised a couple of things.
[14:20.200 --> 14:22.680]  One, I can't speak Korean, which is a bit of a drawback.
[14:23.620 --> 14:30.660]  And two, the regime is not accepting of phone calls to North Korea.
[14:30.820 --> 14:39.980]  Basically, if you are a North Korean citizen, and you phone a friendly nation for want of a better way, and if you phone Syria, it's not a problem.
[14:40.440 --> 14:42.860]  If you phone South Korea, you get shot.
[14:43.440 --> 14:49.060]  And, you know, although I'm interested in research, I don't like the concept of getting people shot, weirdly enough.
[14:50.080 --> 14:50.940]  So, moving on.
[14:51.260 --> 14:52.060]  Satellite carriers.
[14:52.320 --> 14:52.760]  Done then.
[14:53.040 --> 14:57.360]  But there's also a GSM network, which was established by a company called Orozcom.
[14:57.880 --> 15:01.520]  Orozcom, if you don't know them, are an Egyptian hotelier, effectively.
[15:02.280 --> 15:03.480]  They built hotels.
[15:03.600 --> 15:04.220]  That's what they do.
[15:04.380 --> 15:06.300]  But they also do GSM networks.
[15:06.440 --> 15:11.380]  They provided Pakistan with a GSM network, so they thought, okay, we've worked with one repressive regime.
[15:11.380 --> 15:12.220]  Let's do another one.
[15:14.160 --> 15:24.760]  As of 2009, they are claiming to have 90,000 subscribers, which is fairly impressive, considering that their GSM network only covers Pyongyang.
[15:25.600 --> 15:33.920]  So, you know, and it's also fairly impressive when you consider the cost of mobile telephones in North Korea, which, by and large, are ripped off from China.
[15:35.260 --> 15:43.240]  There's an interesting video about Orozcom online, and that apparently is from North Korea.
[15:43.420 --> 15:46.980]  However, I very much doubt it in as much that it's got a local host IP.
[15:47.300 --> 15:52.040]  But if anybody's got any imaging enhancement software, I'd love to see what that says.
[15:53.720 --> 15:55.500]  So, coming on to the KCC.
[15:55.700 --> 15:57.140]  KCC is actually really important.
[15:57.560 --> 16:00.060]  KCC is basically the Korean Computer Centre.
[16:00.060 --> 16:04.840]  It's their show-stopping, world-beating technical institute.
[16:05.900 --> 16:07.920]  It was founded in 1990.
[16:08.380 --> 16:18.160]  However, since 1990, it's been supplemented by branch offices in Syria, and China, United Arab Emirates, and Germany.
[16:18.920 --> 16:21.160]  So, you know, axis of evil, Germany.
[16:23.440 --> 16:24.480]  I'm saying nothing.
[16:25.140 --> 16:31.480]  The German branch was founded by a guy called Jan Holtzman, who's that rather charming-looking gentleman at the bottom.
[16:31.980 --> 16:36.480]  Basically, what happened was the North Koreans gave him a million pounds, and he gave them nine servers.
[16:36.680 --> 16:37.540]  So, good deal.
[16:39.680 --> 16:45.460]  The KCC has apparently published a range of software, which is known about publicly.
[16:46.000 --> 16:47.140]  And it's got a number...
[16:47.140 --> 16:50.940]  More interestingly, it's got a number of companies that actively trade from its premises.
[16:52.700 --> 17:00.260]  There's also something called the Pyongyang Informatics Centre, which was established in 1986, which is when I believe that photo may have been taken.
[17:00.420 --> 17:04.340]  Because if they're still using 486s, they're probably not that late.
[17:05.220 --> 17:08.100]  So, with regard to software, they've got all sorts.
[17:08.260 --> 17:10.280]  They've got a search engine component for Pyongyang.
[17:10.700 --> 17:12.580]  They've got a Korean writing programme.
[17:13.360 --> 17:15.480]  And they've got a couple of gameplay programmes.
[17:15.980 --> 17:21.360]  They've got a national programme, which I presume is the sayings of Kim in easily digestible formats.
[17:22.320 --> 17:24.120]  They also have their own...
[17:24.120 --> 17:27.760]  their very own Linux distribution, known as RedStar.
[17:29.600 --> 17:39.380]  RedStar's kind of interesting in as much that February this year, a Russian blogger who was actually studying at Kim Il-sung University, basically published details of it.
[17:39.380 --> 17:53.620]  One of the most interesting things about it, apart from it being Debian-based, is that in the readme file, there is a direct quote from Kim Jong Il that says, you must create a system based on the Linux kernel in our Korean style.
[17:54.040 --> 17:56.300]  So, basically, Kim is a big Linux user.
[17:56.440 --> 18:00.180]  So, if you have a Linux users group and he shows up, don't be at all surprised.
[18:02.160 --> 18:16.460]  Now, apparently, RedStar costs about five dollars, which kind of makes it outside of the expenditure of most North Koreans, especially since most North Koreans can't even afford computers.
[18:16.640 --> 18:19.980]  So, it's directly targeted at foreign students.
[18:20.800 --> 18:24.640]  There may be all kinds of interesting monitoring software in there as a result.
[18:25.420 --> 18:30.820]  That said, one of the things that is known about it is that it's a bit flaky.
[18:31.300 --> 18:32.680]  It kind of falls over quite a lot.
[18:32.920 --> 18:37.260]  Which kind of makes it similar to most community-driven Linux distros out there.
[18:39.160 --> 18:40.580]  I knew that, Debus.
[18:40.820 --> 18:41.360]  I knew it.
[18:42.460 --> 18:43.300]  It's true.
[18:43.640 --> 18:44.580]  It is.
[18:46.060 --> 18:46.060]  Exactly.
[18:46.380 --> 18:47.080]  Take the pain.
[18:50.300 --> 18:58.460]  So, as well as the KCC producing Korean software, they also have a number of foreign companies that actually operate from the KCC.
[18:59.220 --> 19:06.600]  There's a company called Nosatec, which was set up in 2008 to basically provide outsourced software development.
[19:06.900 --> 19:09.520]  So, if you want software development on the cheap, go to North Korea.
[19:09.760 --> 19:11.000]  I'm sure it will be trustworthy.
[19:12.400 --> 19:16.780]  Nosatec, interestingly, was founded by an ex-VeriSign guy called Volga Elisa.
[19:17.220 --> 19:20.900]  So, after inventing padlocks, he then thought, how else can I screw the world?
[19:21.060 --> 19:21.720]  I've got an idea.
[19:21.720 --> 19:31.480]  And as you can see, the North Koreans are really leaked because they're still using Windows XP in 2009, which makes them kind of like most corporate entities out there in the real world.
[19:32.040 --> 19:40.860]  So, as well as Nosatec, there's a number of other organisations that have offices in North Korea or directly in the KCC.
[19:42.420 --> 19:46.360]  Most interesting, which isn't on there, is a company called Data Activity.
[19:46.920 --> 19:51.420]  Data Activity are Swiss-based and, as the name suggests, do data processing.
[19:52.240 --> 19:56.120]  What that means is they take bank data and then turn it into useful data.
[19:56.400 --> 20:00.460]  So, you know, if you use your credit card, be aware where your credit card data is going.
[20:02.020 --> 20:08.600]  One thing to point out is that in the UK, we have a North Korean ambassador, who I'll go on to a bit later on.
[20:09.280 --> 20:11.860]  His Internet service is provided by British Telecom.
[20:12.180 --> 20:16.180]  As you can see, you know, he's got a really leaked address of btinternet.com.
[20:16.560 --> 20:20.860]  If you wish to ring him and express your distaste in his regime, you can do.
[20:21.700 --> 20:27.780]  You can get through to his secretary, who's a very lovely woman who I've had many conversations with, all of which have ended with her telling me to go away.
[20:29.480 --> 20:31.520]  If you want to visit his house...
[20:33.240 --> 20:36.280]  He lives in Ealing, which is a nice suburb in London.
[20:36.500 --> 20:42.340]  Next door is a dentist, and he lives on the end house, and you can tell it's his house because it has a North Korean flag above it.
[20:42.800 --> 20:54.980]  He also drives a Mercedes, which is fairly interesting in as much that he comes from a country where private car ownership is basically punishable by quite severe restrictions.
[20:54.980 --> 21:00.840]  But it's nice to see that the famine in 2004 didn't hit him too hard, and he can now drive around in a top-of-the-range Merc.
[21:03.480 --> 21:04.460]  True, exactly.
[21:04.740 --> 21:05.920]  It all comes back to Germany.
[21:05.980 --> 21:06.920]  I'm saying nothing, I'm British.
[21:09.020 --> 21:13.120]  There's a rough timeline here, which I've tried to get in as much as I possibly can.
[21:13.260 --> 21:16.780]  However, there's only so many arrows I can use without it looking completely demented.
[21:17.860 --> 21:20.460]  I'm going to expand that out a bit online later on.
[21:20.680 --> 21:22.820]  But at the moment, that's kind of the important bit.
[21:22.960 --> 21:27.440]  Most important bit being, you know, in 1980, the Bright Star program was set up.
[21:27.580 --> 21:30.700]  In 2009, they launched a satellite which fell into the sea.
[21:33.080 --> 21:36.440]  So, that's kind of their infrastructure as far as I know it.
[21:36.880 --> 21:38.480]  And now the talk gets a bit more interesting.
[21:39.140 --> 21:47.840]  What I'm going to do in this second part is basically present my very, very questionable research and hopefully debunk a few myths.
[21:49.640 --> 21:52.900]  So, I'd like to begin with something called the mystery of Unit 121.
[21:52.900 --> 21:55.200]  So, why is there a picture of a cat dressed as a chicken?
[21:55.380 --> 21:56.220]  Because it's...
[21:56.220 --> 22:03.240]  No, because it's always good presentation practice to have a picture of a cat because people will go, ah, and forget the shit that you are speaking.
[22:05.040 --> 22:11.180]  So, in May 2009, there was a guy called Major Steve Sin of the U.S. Army.
[22:11.480 --> 22:16.040]  In case you're missing the irony there, there is a guy called Major Sin in the Army.
[22:18.040 --> 22:18.700]  Not good.
[22:19.560 --> 22:22.300]  He sounds like a porn character, that's all I'm saying.
[22:24.360 --> 22:26.360]  He published a paper called...
[22:26.360 --> 22:34.420]  Snappily titled this, because, you know, it's a military paper, called The Cyber Threat Posed by North Korea and China to South Korea and U.S. Forces Korea.
[22:34.840 --> 22:35.880]  Snappy title, Steve.
[22:36.780 --> 22:40.000]  Basically, in that, he discusses something called Unit 121.
[22:40.540 --> 22:49.160]  Now, Unit 121 is fairly interesting in as much that they're a supposedly elite unit of the North Korean military that are solely dedicated to information warfare.
[22:49.380 --> 22:50.120]  That's all they do.
[22:50.980 --> 23:00.040]  Sources of that data are the Yonhap News Agency, which, for those of you who don't know them, are the South Korean state-sponsored news agency.
[23:00.040 --> 23:02.120]  It's a bit like the BBC, except a bit more vitriolic.
[23:03.580 --> 23:07.440]  They apparently interviewed an anonymous source, which is always useful.
[23:08.340 --> 23:19.620]  And also, there's an article cited in there called Inside DPR Cage Unit 121, which was written by a guy called Kevin Coleman and published by Defence Tech in 2007.
[23:20.080 --> 23:25.740]  For those of you who don't know Defence Tech, basically, it's kind of like Monster.
[23:25.840 --> 23:32.600]  In fact, it's the same parent company, but it's like jobs in the military and news about the military and, you know, we've invented new baby-killing machines, aren't they, Olson?
[23:33.120 --> 23:33.820]  Fascinating read.
[23:34.260 --> 23:36.820]  Anyway, what is Unit 121?
[23:36.820 --> 23:45.320]  Well, apparently, it consists of 17,000 personnel, which is an awful lot of uber-hack-sorts.
[23:45.700 --> 23:51.000]  And they are apparently all situated in... there.
[23:51.660 --> 23:58.080]  In the KCC, you can apparently fit 17,000 people, and pizza, and coke, and, you know, various other bits.
[23:58.380 --> 23:59.300]  They're tiny, dude.
[23:59.420 --> 24:01.080]  Not that tiny, dude.
[24:02.480 --> 24:05.740]  Yeah, but really, 17,000 in there?
[24:05.740 --> 24:07.560]  Maybe shift workers.
[24:07.660 --> 24:09.420]  Maybe shift workers, but, you know.
[24:09.700 --> 24:10.240]  Who knows?
[24:10.400 --> 24:12.240]  But apparently, there's 17,000 of them in there.
[24:13.380 --> 24:16.400]  Which, even with Asians, I guess is a bit tight.
[24:17.020 --> 24:26.900]  Now, apparently, according to Kevin, they possess moderately advanced distributed denial-of-service capabilities with moderate virus and malicious code capabilities.
[24:27.280 --> 24:30.820]  So there's 17,000 people in one facility who are only moderate.
[24:30.820 --> 24:32.620]  That's pretty crap.
[24:33.360 --> 24:34.800]  You know, there are 17,000 of you.
[24:34.880 --> 24:35.420]  Work harder.
[24:37.760 --> 24:45.420]  They're also apparently responsible for attacking the West multiple times, and generally being willing technical ninjas on behalf of Kim.
[24:47.220 --> 24:50.700]  Sadly, apart from not particularly independent sources, e.g.
[24:50.780 --> 25:02.860]  a South Korean news agency, which is sponsored by the government, and a Yank journalist, I couldn't find any creditable and attributable source for the information about Unit 121.
[25:03.160 --> 25:05.640]  So, I contacted Kevin.
[25:06.460 --> 25:13.100]  Basically, I said, I was giving a talk about North Korea, I've heard about Unit 121, it sounds awesome, what's going on?
[25:13.760 --> 25:16.400]  And, you know, you're a journalist, where is your attribution?
[25:16.780 --> 25:18.960]  Could, you know, give me a source of some description?
[25:20.040 --> 25:21.080]  Kevin got back to me.
[25:21.400 --> 25:23.260]  Apparently, the tone of my email put him off.
[25:23.520 --> 25:30.440]  And, you know, he had to be contacted because, you know, I was apparently being very, very horrible by asking questions about journalistic attribution.
[25:31.140 --> 25:35.200]  He also told me to Google North Korea Unit 121, which is kind of how I found him.
[25:36.140 --> 25:44.300]  He also told me to look at the attribution of the July 4th cyber attacks on the U.S., South Korea and the U.S., both of which apparently point back to North Korea, but I'll touch on that later on.
[25:44.840 --> 25:52.400]  Other than that, he wasn't going to tell me anything because it's all classified and, you know, I don't need to know, which is a useful get-out clause if you're a lazy journalist.
[25:54.220 --> 25:56.080]  I got back in touch and said, seriously?
[25:56.400 --> 25:56.680]  Come on.
[25:58.660 --> 26:06.980]  Attributable source, evidential materials, you presented this in the public light, could, you know, could you actually, you know, tell people where you got this data from?
[26:07.000 --> 26:09.840]  At least say it was an anonymous source, I can't talk about it, they'll get a shot in the head.
[26:10.540 --> 26:13.580]  He then told me to contact MI5 and Steve Singh.
[26:14.140 --> 26:17.620]  Now, this guy, remember, is an expert on information warfare.
[26:18.140 --> 26:25.260]  For those of you who don't know how the UK intelligence community work, MI5 are the people that are responsible for internal monitoring.
[26:25.620 --> 26:28.000]  I think what he means is MI6.
[26:29.360 --> 26:34.980]  But maybe MI5 are looking at, you know, UK militants and North Koreans.
[26:35.140 --> 26:35.460]  I don't know.
[26:36.480 --> 26:37.640]  Maybe they're that busy.
[26:38.460 --> 26:40.540]  He also told me to get in touch with Major Sin.
[26:40.720 --> 26:41.460]  I love that name.
[26:43.340 --> 26:46.440]  But, you know, the problem with that is that Major Sin was using him as a source.
[26:46.580 --> 26:48.140]  So basically, it's a source clusterf*ck.
[26:50.360 --> 26:52.680]  So I basically said, OK, very interesting.
[26:52.720 --> 26:54.240]  I'll try and get in touch with MI5.
[26:54.460 --> 26:55.880]  I think they might tell me to f*ck off.
[26:58.380 --> 27:03.980]  And then he decided that Unit 121 actually may be Unit 110.
[27:04.220 --> 27:06.420]  Or possibly Unit 101.
[27:07.080 --> 27:11.240]  At which point I suggested that Unit 121 might exist in Room 101.
[27:11.680 --> 27:13.660]  At which point he told me to f*ck off.
[27:15.560 --> 27:19.400]  Because I clearly had an agenda and, you know, I was wasting his time.
[27:19.400 --> 27:22.100]  So, I do have an agenda as it happens.
[27:22.360 --> 27:33.480]  I tend to think that if you're a journalist whose reporting can shape national policy and how people understand threat, then, you know, it's always best to kind of tell the truth and not make shit up.
[27:34.180 --> 27:35.300]  But, you know, never mind.
[27:35.300 --> 27:41.500]  The point is, I don't wish to have a go at Kevin, however tempting it may be.
[27:43.960 --> 27:50.020]  But the only sources that are available for this super elite military unit are classified or otherwise obfuscated.
[27:50.200 --> 27:51.680]  And they've been presented as facts.
[27:52.580 --> 27:54.440]  Interestingly, Kevin is a lovely man.
[27:54.800 --> 28:00.480]  According to Wikipedia, this source of all knowledge in the universe, he came up with the definition of cyber terrorism.
[28:00.480 --> 28:06.360]  He also works for a company or is the MD of a company that provides cyber war training.
[28:06.700 --> 28:14.320]  So, clearly has no agenda in terms of driving up people's exposure to, you know, information warfare capabilities of some other country.
[28:15.000 --> 28:19.560]  Also, fairly interestingly, he's presented to U.S. Congress about five times.
[28:19.760 --> 28:21.960]  So, you know, people are listening to this guy.
[28:23.000 --> 28:28.100]  More interesting though, he can't source any of his allegations, which is fairly interesting.
[28:28.100 --> 28:31.280]  And from my perspective, kind of smells a bit like bullshit.
[28:32.400 --> 28:38.200]  If you work for a company that sells cyber war training, and I've read some of his training material, it's ace.
[28:38.460 --> 28:40.680]  It's like, don't tell foreign nationals about your computers.
[28:40.880 --> 28:41.620]  Really, Kevin, thanks.
[28:43.700 --> 28:50.820]  But if you do that, and then you're then inflating claims which nobody else can prove, meh, I don't know.
[28:50.820 --> 29:01.640]  Anyway, just to clarify, I'm publicly willing to stand on record and provide any of the email communications that anybody wants, just because, you know, I believe in attribution.
[29:01.780 --> 29:02.640]  I'm odd like that.
[29:02.860 --> 29:06.660]  I will also publicly apologise to Kevin if he is right.
[29:06.920 --> 29:09.500]  I will wear a T-shirt saying, Kevin is awesome.
[29:09.500 --> 29:10.420]  I am wrong.
[29:10.600 --> 29:11.360]  Please whip me.
[29:17.420 --> 29:21.320]  However, until that point, I call bullshit.
[29:23.520 --> 29:24.960]  Which brings me on to this.
[29:25.600 --> 29:28.900]  You have Gregory Evans, who is the world's number one hacker, as we all know.
[29:29.380 --> 29:30.320]  Greg rocks.
[29:30.800 --> 29:31.620]  Do not diss the Greg.
[29:31.900 --> 29:35.280]  You also have Kevin, who is the number one cyber war expert in the world.
[29:35.880 --> 29:38.480]  And don't dispute it, because Kevin knows intelligent people.
[29:39.260 --> 29:41.100]  So, that brings me on to The Economist.
[29:41.160 --> 29:45.760]  I don't know if any of you have actually bothered to read The Economist's cyber war issue, but I did.
[29:47.680 --> 29:50.720]  Because, you know, I'm talking about information warfare, so I thought it might be useful.
[29:51.400 --> 29:56.560]  It's got a lovely front cover, which is completely non-contentious, as I'm sure you agree.
[29:57.560 --> 29:59.580]  And in it, there's a couple of articles.
[29:59.840 --> 30:03.900]  There's a leader comment on cyber war, which is hilarious.
[30:04.480 --> 30:06.540]  And there's also something called cyber war.
[30:06.660 --> 30:07.760]  War in the fifth dimension.
[30:08.420 --> 30:11.020]  Now, in that one, it claims that cyberspace...
[30:11.020 --> 30:12.820]  What the f*ck is cyberspace, by the way?
[30:13.080 --> 30:14.060]  Does anybody know?
[30:14.600 --> 30:15.660]  Yeah, tubes, exactly.
[30:16.420 --> 30:17.000]  They might as well...
[30:17.000 --> 30:17.640]  The tubes.
[30:17.640 --> 30:22.880]  The tubes, apparently, have become the fifth domain of warfare, after land, sea, air and space.
[30:23.740 --> 30:24.780]  My question...
[30:24.780 --> 30:25.520]  Have they?
[30:26.440 --> 30:29.740]  Georgia and Estonia did a couple of DDoS attacks at each other.
[30:30.060 --> 30:34.160]  There's a couple of various propaganda sites out there.
[30:34.160 --> 30:37.800]  But, you know, warfare kind of means that somebody dies.
[30:38.680 --> 30:41.440]  Maybe that's just me having a demented notion of what war is.
[30:41.580 --> 30:43.280]  But, you know, somebody gets shot, somebody dies.
[30:43.500 --> 30:43.880]  There you go.
[30:44.820 --> 30:49.200]  So, I don't know when, you know, cyberspace became the fifth domain, but apparently it's happened.
[30:50.760 --> 30:56.220]  They also said that a lot could be achieved by greater cooperation between governments and the private sector.
[30:56.820 --> 30:57.300]  Yeah.
[30:57.660 --> 30:58.880]  Which is interesting.
[30:59.560 --> 31:12.300]  Because the entire point of this, I reckon, is to create enough f***ing panic that yet another stupid war can actually introduce real credible change, you know, and help the military-industrial complex along.
[31:12.640 --> 31:14.700]  Let's face it, we've had a war on drugs.
[31:14.700 --> 31:15.320]  That helped.
[31:16.040 --> 31:17.820]  That was quite beneficial to industry.
[31:17.980 --> 31:20.500]  We've had a war on terror, which is hilarious when you think about it.
[31:20.720 --> 31:23.120]  Because, you know, you're trying to attack an abstract.
[31:23.120 --> 31:23.920]  Yay!
[31:24.500 --> 31:27.260]  And now we have cyber war, which is even more f***ing abstract.
[31:27.620 --> 31:34.500]  But, you know, if you work for Blackwater, you can, you know, say, we can harden your boxes and it will only cost you 12 billion of taxpayers' money.
[31:34.820 --> 31:37.240]  So, I think that might be on about.
[31:38.460 --> 31:43.800]  And they also said that one response to the growing threat of cyber war has been military.
[31:44.080 --> 31:46.740]  Iran claims to have the world's second largest cyber army.
[31:46.960 --> 31:47.380]  Does it?
[31:47.540 --> 31:48.900]  Not seeing that, but okay.
[31:49.820 --> 31:52.760]  Russia, Israel, and North Korea boast efforts of their own.
[31:53.140 --> 31:54.640]  Russia and Israel probably do.
[31:55.060 --> 31:56.840]  North Korea has nothing.
[31:57.260 --> 32:03.820]  This is a country that in 2004 had such limited food and fuel supplies.
[32:04.280 --> 32:04.760]  Okay.
[32:04.920 --> 32:06.740]  Largely because they were being hoarded by the state.
[32:06.960 --> 32:12.740]  But they had limited food supplies to the extent that 9 million people starved to death.
[32:13.320 --> 32:16.560]  I don't think they've got a really advanced cyber warfare army.
[32:17.200 --> 32:21.500]  But, you know, regardless, there are still questions of attribution about that.
[32:21.500 --> 32:28.620]  If you want to read the Economist articles, I have links so you don't have to actually, you know, finance Pearson International who kind of suck.
[32:29.520 --> 32:32.820]  But, you know, interesting points of attribution there.
[32:33.880 --> 32:37.720]  So, what I did, because I like sending emails because, you know, I have no life.
[32:39.260 --> 32:40.980]  I got in touch with the Economist.
[32:40.980 --> 32:43.920]  I had to get in touch with their public relations department.
[32:44.220 --> 32:47.340]  Largely because Pearson International are fairly interesting.
[32:47.720 --> 32:51.040]  And as much that there is no editorial point of contact.
[32:51.360 --> 32:53.000]  You're not allowed to know who their editors are.
[32:53.440 --> 32:57.680]  And more interestingly, all the pieces that appear in the Economist are unnamed.
[32:59.380 --> 33:00.680]  I have an issue with that.
[33:00.860 --> 33:04.160]  If you don't know who's written a piece, you don't know what their agenda is.
[33:04.300 --> 33:07.680]  But, according to Pearson, it makes them impartial.
[33:08.340 --> 33:08.740]  Okay?
[33:08.880 --> 33:09.540]  Don't know how that works.
[33:10.240 --> 33:12.780]  So, yeah, I got in touch saying, okay, what's the attribution?
[33:12.980 --> 33:15.240]  Is it the same as Kevin Coleman inventing bullshit?
[33:16.180 --> 33:22.640]  Funnily enough, because they're Pearson International and they write the Financial Times, so, you know, they're important journalists, they didn't actually get back to me.
[33:23.420 --> 33:28.520]  Which brings me back to my point about what the f*ck is going on.
[33:29.540 --> 33:37.660]  Now, I think what's going on here, particularly in relation to North Korea, is you state something that nobody can prove or disprove.
[33:38.040 --> 33:40.240]  You know, if you ask questions, it's classified.
[33:40.520 --> 33:42.200]  If you ask more questions, it's anonymous.
[33:42.520 --> 33:44.320]  If you ask more questions, please f*ck off now.
[33:44.960 --> 33:47.440]  You then watch that claim make press.
[33:47.960 --> 33:48.480]  Yeah?
[33:48.640 --> 33:50.200]  You then reinforce those claims.
[33:50.200 --> 33:52.840]  You then watch those claims make more press.
[33:52.940 --> 33:58.100]  I mean, look, this is fairly interesting in as much that it started off in defence tech, which isn't a widely read publication.
[33:58.820 --> 34:04.640]  It then spiralled out after reinforcement of that source to appear in The Economist.
[34:04.800 --> 34:10.480]  There's also been hilarious Fox News articles about North Korea, which are genuinely hilarious.
[34:11.480 --> 34:14.020]  Once it's made more press, panic spreads.
[34:14.020 --> 34:20.720]  And if you can spread panic, you can spread spending, which means that, you know, Blackwater get a shitload of federal money.
[34:21.180 --> 34:24.040]  You know, which means if you're involved in Blackwater, you profit.
[34:24.340 --> 34:26.020]  And that's what I suspect this is about.
[34:26.180 --> 34:27.500]  It's about driving panic.
[34:27.660 --> 34:34.340]  It's about uninformed FUD generally making people fat and rich, which is awesome.
[34:35.040 --> 34:40.480]  Which is why my response to The Economist, and indeed to Pearson International, is very considered.
[34:40.940 --> 34:43.660]  If they're not going to talk to me, they can go and f*ck themselves.
[34:44.000 --> 34:49.080]  Especially if they're going to claim things that are clearly based upon unattributable sources.
[34:50.000 --> 34:53.960]  Incidentally, if there are any lawyers from Disney in the room, don't sue me, because I have nothing.
[34:56.840 --> 34:57.200]  So...
[34:59.200 --> 35:03.700]  Kevin told me to do some research on the July 4th cyber attacks.
[35:03.860 --> 35:06.020]  So I did, because, you know, I do what I'm told.
[35:07.260 --> 35:09.200]  Unfortunately, it didn't start on July 4th.
[35:09.340 --> 35:10.760]  So it's like the MI5 thing.
[35:10.820 --> 35:12.420]  They actually started on July 1st.
[35:12.760 --> 35:13.440]  But, you know, close!
[35:15.380 --> 35:28.160]  Basically, what happened is there was a widespread DDoS attack against 25 South Korean financial institutions and high value or high PR targets in the U.S.
[35:28.360 --> 35:30.240]  So, you know, the White House, the Treasury Department.
[35:30.520 --> 35:31.580]  Shit that people have heard of.
[35:33.560 --> 35:42.760]  They were quickly heralded by the press and various other people as being conclusive proof of the evil, leaked North Korean hackers.
[35:44.280 --> 35:48.740]  Korean CONCERT actually decided to investigate before making any claims.
[35:49.040 --> 35:54.700]  And they referred this out to a Vietnamese security company who did some amazing work on this called BAT COA.
[35:56.860 --> 36:00.400]  Meanwhile, in America, basically...
[36:00.400 --> 36:02.880]  Has anybody here heard of Peter Hoekstra?
[36:03.520 --> 36:06.400]  Who's spelled H-O-E-K-S-T-R-A?
[36:06.700 --> 36:07.760]  Republican Michigan.
[36:08.040 --> 36:08.440]  Yep.
[36:08.700 --> 36:11.700]  Republican Michigan House Intelligence Committee.
[36:12.220 --> 36:13.780]  Yeah, he's dumb as a stump too.
[36:13.940 --> 36:16.020]  Yeah, he really is dumb as a motherf*cker.
[36:17.160 --> 36:26.560]  For those of you who don't know about our lovely, lovely Pete, basically, this is the guy that said in 2006 that, you know, they'd found WMDs in Iraq.
[36:28.520 --> 36:41.360]  Now, I kind of think that would have made news, especially in the UK where we were kind of pissed off about being dragged into yet another piece of f*cking weird, let's all march to glory shit on the back of, like, they had major credible threats.
[36:41.360 --> 36:42.480]  We'd have heard, I think.
[36:43.180 --> 36:44.800]  But apparently about this attack...
[36:45.500 --> 36:47.380]  This is awesome, this is the best quote ever.
[36:47.800 --> 36:58.000]  Next time they'll go in and shut down a banking system, or they'll manipulate the electrical grid, either here or in South Korea, or they'll try and miscalculate and people will be killed.
[36:58.860 --> 37:00.260]  Okay, Pete, couple of points.
[37:02.120 --> 37:05.700]  You say that they're going to shut down a banking system.
[37:06.140 --> 37:07.080]  Okay, big news.
[37:07.400 --> 37:09.960]  If they shut down a banking system, people do not die.
[37:10.440 --> 37:14.780]  I have been to an ATM when I have been heavily overdrawn, and it hasn't given me any money.
[37:15.040 --> 37:15.880]  I am not dead.
[37:18.360 --> 37:26.540]  I think, and this is just me thinking here, maybe what happens if that happens to a rich person, they die.
[37:28.860 --> 37:30.620]  And how awesome would that be?
[37:31.740 --> 37:35.320]  If you deny rich people access to their funds, they die.
[37:36.200 --> 37:38.920]  They don't just go, oh, f*ck, and go back to the next day.
[37:38.920 --> 37:39.720]  No, they keel over.
[37:40.000 --> 37:41.620]  I think that's what Peter believes.
[37:42.480 --> 37:43.860]  Which is interesting, really.
[37:44.700 --> 37:45.580]  Shame it's not true.
[37:46.800 --> 37:51.160]  Anyway, the wonderful, wonderful people of Batcoa, as I said, did some amazing work.
[37:51.720 --> 37:59.300]  They got access to two of the eight command and control servers, which were just responsible for the botnet that was in use.
[38:00.260 --> 38:16.080]  It's a f*cking good thing that the U.S. didn't retaliate to this one, because the two servers they found, one of which was located in the UK, so go us, and one was located in Miami, so go you.
[38:17.060 --> 38:25.680]  LAUGHTER The one on 195.90.118.1102 is no longer there, but it was.
[38:26.080 --> 38:37.160]  And basically, it was a VPN pipe, served along to a company called Global Digital Broadcast, who makes set-top boxes, and basically tied back via VPN to a server in Miami.
[38:37.160 --> 38:40.840]  Anyway, now, the UK server was in Brighton.
[38:41.260 --> 38:42.800]  The U.S. server was in Miami.
[38:43.180 --> 38:50.140]  Now, my sense of geography isn't great, but neither Brighton nor Miami is in North Korea.
[38:50.300 --> 38:51.940]  LAUGHTER I think.
[38:52.960 --> 38:56.620]  But anyway, good thing, you know, people checked before.
[38:56.900 --> 38:59.480]  Making wild and unjustified claims, Peter.
[39:02.020 --> 39:03.140]  So, what was it?
[39:03.360 --> 39:05.020]  Well, the botnet was huge.
[39:05.020 --> 39:07.620]  It was lots of massive botnet.
[39:07.720 --> 39:10.160]  I think there was, like, 78,000 at least.
[39:11.640 --> 39:13.240]  So, very big, very clever.
[39:13.460 --> 39:15.080]  Malware, not so big, not so clever.
[39:15.620 --> 39:30.920]  Basically, it was ripped off my Doom code from 2004, and it seemed to have been cobbled together from a number of sources, made absolutely no attempt at all to bypass AV, and was probably written using a Korean language template.
[39:33.500 --> 39:37.040]  It's interesting when you compare that to Chinese malware, you know, that grey pigeon.
[39:37.720 --> 39:43.400]  When that started, it was very much cobbled together and, you know, steal a bit of this, steal a bit of that, bolt it together.
[39:43.560 --> 39:44.500]  Woo, I've written some code.
[39:45.340 --> 39:46.680]  So, kind of similar to that.
[39:48.120 --> 39:50.300]  That potentially could be a clue to origin.
[39:51.060 --> 39:57.740]  If you are a super leaked military hacker from North Korea, are you going to use ripped off code that makes no attempt to obfuscate itself?
[39:58.020 --> 40:03.180]  Or are you going to write your own that does and actually has an impact and isn't picked up by Norton?
[40:05.080 --> 40:06.200]  I don't know, just a thought.
[40:08.040 --> 40:08.860]  Maybe it's Chinese.
[40:09.140 --> 40:09.820]  Maybe it's American.
[40:10.040 --> 40:13.340]  Maybe it's somebody who's South Korean and is living in Brighton.
[40:13.480 --> 40:13.840]  I don't know.
[40:13.840 --> 40:25.920]  The problem is, it's more interesting than it first appears because it was directed against financial institutions in South Korea and a couple of high visibility targets in the U.S.
[40:26.320 --> 40:30.520]  If you're the North Koreans, are you going to attack the White House?
[40:31.040 --> 40:34.700]  Probably not because you know that the Americans have got bigger toys than you.
[40:35.020 --> 40:38.620]  You know, they have nuclear weapons that work and satellites which actually orbit and shit.
[40:42.580 --> 40:47.180]  So, maybe it was just somebody in South Korea that was trying to obfuscate the shit that was going on with South Korean banks.
[40:47.320 --> 40:47.740]  I don't know.
[40:48.940 --> 40:50.800]  So, brings me to my next point.
[40:51.220 --> 40:57.280]  In 2004, there was a South Korean general that compared the skills base of the North Koreans to that of the CIA.
[40:58.620 --> 41:03.860]  So, if you follow the logic here, the CIA only have moderate virus writing and DDoS skills.
[41:04.600 --> 41:05.260]  Worth knowing.
[41:06.200 --> 41:12.640]  That obviously has been disputed by a number of experts in inverted commas, most notably John Pike.
[41:13.720 --> 41:22.180]  And also, funnily enough, the National Intelligence Service of South Korea has turned around and said, sorry about the general, he gets a bit baffled sometimes.
[41:24.620 --> 41:41.700]  So, earlier this year, in June in fact, there was another South Korean general, there's something about South Korean generals earlier, that basically said that the G20 meeting in Seoul in November would probably be heavily targeted by North Korean hackers.
[41:42.520 --> 41:46.220]  Now, I don't know whether anybody remembers Ian Tomlinson in this country.
[41:46.780 --> 41:48.700]  In the UK, there's a guy called Ian Tomlinson.
[41:48.860 --> 41:58.480]  He was walking home from work, had nothing to do with the G20 process, and a lovely, lovely, friendly police force, who you can see they're being friendly, basically pushed him over and he had a heart attack.
[41:58.860 --> 42:04.120]  So, technically, I don't think it's just the North Koreans that have a problem with the G20.
[42:04.440 --> 42:07.000]  But doing shit like that, I kind of have a bit of an issue.
[42:09.120 --> 42:10.160]  So, moving on.
[42:11.180 --> 42:14.180]  A slide called from the bat-shit-crazy department.
[42:15.020 --> 42:16.620]  Which it kind of is.
[42:18.540 --> 42:27.560]  Lovely, lovely neocons, God bless their little cotton socks, are now pointing the finger at North Korea for the Gulf oil spill.
[42:28.240 --> 42:38.160]  Their proof, and this is proof, remember, was that the Deepwater Horizon oil platform was built by Hyundai Heavy Industries, who won South Korea.
[42:38.420 --> 42:56.280]  So, their assertion, and this is a wonderful assertion, which brings in no logic at all, but it's a good assertion, is that a suicide squad, I have to do that again, suicide squad, their words, not mine, boarded a submarine in North Korea, drove the submarine from North Korea through U.S.
[42:56.360 --> 43:04.620]  waters, without anybody noticing, because, you know, they have advanced stealth capacities, clearly, and then dive-bombed the oil rig.
[43:06.400 --> 43:11.540]  LAUGHTER It doesn't seem particularly credible, but it may have happened, I don't know.
[43:12.400 --> 43:18.560]  Anyway, regardless of whether or not North Korea were involved, Tony Hayward is an arse, and I apologise wholeheartedly for him.
[43:18.800 --> 43:19.780]  We hate him too.
[43:21.760 --> 43:29.020]  So, one of the things I wanted to do as part of this talk was actually look at some of the other batshit stuff that's around North Korea.
[43:29.300 --> 43:38.060]  And one of the things that North Korea is really good at is getting foreign nationals to buy into the douche, self-reliance idea, and, you know, Kim Jong-il's not a lunatic.
[43:38.200 --> 43:39.880]  In a bad week, he's actually a very nice man.
[43:40.420 --> 43:44.020]  And to do that, they have a number of propaganda sites scattered around the planet.
[43:45.760 --> 43:48.380]  According to the research, there's allegedly about 30 of them.
[43:48.380 --> 43:51.620]  I've tracked down 19 of which 18 are on there.
[43:51.940 --> 43:59.580]  They've all got wonderful titles like, you know, the Anti-Imperialistic National Democratic Front, which sounds like it should be from the life of f*cking Brian.
[44:01.300 --> 44:01.780]  Anyway.
[44:02.860 --> 44:10.960]  Their servers, and this is fairly interesting, most people would think, North Korea, North Korean, pro-North Korea servers, they're going to be in China.
[44:11.160 --> 44:11.380]  No.
[44:11.560 --> 44:13.220]  Most of them, again, in Germany.
[44:13.720 --> 44:13.920]  Woo!
[44:14.220 --> 44:19.180]  Six in Germany, five in Japan, four in China, two in the U.S., and one in Spain.
[44:20.140 --> 44:22.160]  So, you know, Europe's still winning.
[44:23.640 --> 44:31.640]  How they break down is deprecated versions of IAS and very deprecated versions of Apache, but mostly Apache.
[44:31.900 --> 44:33.960]  So, you know, Kim loves open source as well as Linux.
[44:36.340 --> 44:37.580]  Pish, pish, pish.
[44:37.820 --> 44:40.640]  Most of the software is hugely bug-laden.
[44:43.440 --> 44:47.680]  A couple look, I say look, to have trivially built false DB access.
[44:48.880 --> 44:59.180]  And most interesting, there was a custom Java component, which was kind of obfuscated from public view, which I wasn't actually brave enough to attempt to recompile, or decompile, I should say.
[44:59.920 --> 45:02.580]  Also, on one of the sites, there's something called Peg2.
[45:02.720 --> 45:08.980]  For those who don't know what Peg2 is, this exists on the same site as a WordPress blog.
[45:08.980 --> 45:12.240]  So, you know, good enough career support in WordPress.
[45:13.220 --> 45:19.800]  But yeah, Peg2 is the little mountain that Kim Il Sung went up before he decided to be Kim Il Sung.
[45:20.620 --> 45:22.480]  There's no mention of Peg2 anywhere.
[45:22.760 --> 45:26.920]  Basically, it looks to be a bog-standard CMS control system.
[45:27.960 --> 45:33.020]  And, as I say, no reference to it anywhere, but it could be kind of interesting, and I reckon it's fairly trivial to pop.
[45:34.000 --> 45:40.940]  So, the point of this is not to attack the lunatics that build pro-North Korea servers.
[45:42.800 --> 45:46.760]  My point is, all of them appear to be running deprecated software.
[45:47.200 --> 45:49.600]  All of them have got extraneous services enabled.
[45:50.520 --> 45:53.620]  And most of them are susceptible to a number of common attack factors.
[45:54.140 --> 46:00.060]  Now, although they're not servers or applications that are hosted in North Korea, they are affiliated with North Korea.
[46:00.060 --> 46:07.020]  If North Korea is so leet and so utterly ninja, why are they still running IS-4?
[46:07.620 --> 46:08.500]  Just a thought.
[46:09.920 --> 46:12.580]  Their public face, you would have thought, would be a bit more secure.
[46:12.980 --> 46:14.960]  Now, it could be double-bluff.
[46:15.180 --> 46:20.200]  It could be because these servers are managed and controlled by effectively lunatics.
[46:20.840 --> 46:32.900]  Or, it could be the fact that, you know, there isn't the technical aptitude because there isn't the access to current technology, because they live in a repressive, f*cked-up Stalinist state.
[46:35.240 --> 46:43.680]  Also, interestingly, if there is a guy called Dokdal in here, please get in touch, because apparently Nenera, which is a major site for North Korea, has got SQL injection on it.
[46:43.920 --> 46:45.300]  I can't f*cking find it.
[46:45.380 --> 46:47.240]  So, you know, if you're here, let me know where it is.
[46:47.240 --> 46:49.980]  So, my conclusions, and I have conclusions.
[46:50.520 --> 46:52.840]  Are we all doomed when it comes to North Korea?
[46:53.260 --> 46:54.060]  Er, no.
[46:55.000 --> 46:58.680]  It's got a very, very tightly regulated use of ICT.
[46:58.960 --> 47:01.800]  Finding shit out about North Korea is f*cking hard.
[47:02.760 --> 47:04.940]  It's also incredibly poor.
[47:05.300 --> 47:11.240]  You know, the financial ability of North Korea to invest in technology doesn't exist.
[47:11.240 --> 47:16.120]  You know, they've got far more important things to spend their money on, like Kim's Fortress of Solitude.
[47:16.940 --> 47:19.400]  Er, they've also got an evil little shit in charge.
[47:19.620 --> 47:26.300]  And the problem with having an evil little shit in charge is the evil little shit doesn't want the people that he's in charge of to realise he's an evil little shit.
[47:26.600 --> 47:29.420]  So, the evil little shit restricts access to technology.
[47:29.960 --> 47:32.040]  If you may have noticed, I have an issue with Kim.
[47:32.040 --> 47:39.000]  Now, it seems kind of credible that the North Korean military may be thinking about information welfare.
[47:39.300 --> 47:40.400]  It's cheap, you know.
[47:40.560 --> 47:43.460]  You need one guy and a room and a fat pipe and wahee.
[47:44.880 --> 47:52.600]  That said, my suggestion is there is a skills gap because you don't have open access to information.
[47:52.640 --> 47:57.960]  And if you don't have open access to information, it's very difficult to launch attacks because you can't find out about them.
[47:58.140 --> 48:00.380]  You know, it's standard, you know.
[48:00.380 --> 48:03.580]  So, they may be thinking about outsourcing to China or somewhere else.
[48:03.760 --> 48:07.820]  The problem with outsourcing to China, China owns more U.S. bonds than the U.S.
[48:08.080 --> 48:10.820]  So, China are not going to f*ck with their biggest customer.
[48:11.840 --> 48:22.140]  So, maybe my point here, and the important point about this, is instead of worrying about digital Armageddon, which by and large seems to be hopelessly inflated, you know.
[48:22.320 --> 48:25.240]  There is no electronic Pearl Harbor, please calm down.
[48:25.820 --> 48:32.220]  Maybe people should be concerned about the human rights record of North Korea and the fact that there's an evil little shit in charge.
[48:33.560 --> 48:36.100]  Alternatively, if you are brave, go play.
[48:40.830 --> 48:44.190]  So, questions, comments, random abuse, Korean deaf squads.
[48:49.230 --> 48:55.930]  I have one brief question.
[48:56.170 --> 48:57.510]  So, I've noticed that...
[48:57.510 --> 48:59.570]  So, North Korea does have a...
[48:59.570 --> 49:02.170]  They do have a TLD for themselves.
[49:02.390 --> 49:04.090]  It's like dot K something.
[49:04.350 --> 49:04.770]  Dot KR.
[49:05.110 --> 49:05.290]  Yeah.
[49:05.810 --> 49:06.930]  No, no, no, no.
[49:06.990 --> 49:07.150]  KP.
[49:07.570 --> 49:08.530]  South Korea.
[49:08.530 --> 49:08.650]  Yeah.
[49:08.730 --> 49:09.090]  Yeah.
[49:09.270 --> 49:13.090]  So, I thought that was very strange how none of their domains are using dot KP.
[49:13.830 --> 49:14.670]  I mean, shouldn't...
[49:14.670 --> 49:18.050]  I mean, shouldn't that be like the first step in setting up your cyber infrastructure?
[49:18.410 --> 49:19.010]  One would have thought.
[49:19.190 --> 49:28.470]  And I mean, you know, and furthermore, instead of having like, you know, korea-dpr.com, you should be like, you know, supportthetroops.kde.
[49:28.710 --> 49:28.930]  Yeah.
[49:29.310 --> 49:29.690]  Oh, yeah.
[49:29.690 --> 49:33.090]  So, I mean, I guess I'm just curious why you think there's...
[49:33.090 --> 49:35.870]  why they haven't set that up yet.
[49:35.870 --> 49:35.930]  Yeah.
[49:36.130 --> 49:36.750]  Who knows?
[49:37.450 --> 49:43.250]  My guess, and it is a guess, and it's a supposition on my part, would be to do with the fact that it's to do with hosting.
[49:44.330 --> 49:46.850]  Korea is down with the idea of self-reliance.
[49:46.990 --> 49:49.430]  You know, you look at the whole douche philosophy it's all about.
[49:49.530 --> 49:50.450]  We can grow our own vegetables.
[49:50.630 --> 49:52.630]  We can run our own telephone networks apart from the Egyptians.
[49:53.450 --> 49:55.370]  But they're down with the self-reliance thing.
[49:55.490 --> 50:02.590]  And I would presume, because that shit has to be exfiltrated out, that it goes against the whole mindset of the...
[50:02.590 --> 50:05.590]  It goes against the whole mindset of the country as a whole, you know?
[50:05.870 --> 50:07.870]  I would suspect is what it's to do with.
[50:08.070 --> 50:13.030]  You know, because it involves opening shit up a bit, which they really don't want to do on any level.
[50:13.950 --> 50:14.430]  I see.
[50:16.430 --> 50:16.970]  Hi there.
[50:17.250 --> 50:20.670]  I'm also from the UK, maybe a bit further north than yourself.
[50:20.890 --> 50:22.570]  You are not from the UK, you're Scottish.
[50:23.290 --> 50:23.950]  Yeah, sorry.
[50:24.370 --> 50:24.910]  Close enough.
[50:25.430 --> 50:27.470]  You have your own parliaments and everything.
[50:27.590 --> 50:28.210]  Yeah, f*ck them.
[50:30.850 --> 50:37.050]  I have a friend in the UK who's in the Merchant Navy who knew plenty of people on Deepwater Horizon when it blew up.
[50:37.150 --> 50:37.290]  Yeah.
[50:37.430 --> 50:40.770]  And they confirm it was in fact a North Korean submarine that bombed it.
[50:40.870 --> 50:41.850]  So I'm just throwing that out there.
[50:42.050 --> 50:42.570]  Oh, okay.
[50:42.750 --> 50:44.730]  Yeah, it had nothing to do with sloppy maintenance.
[50:45.030 --> 50:45.350]  No, no, no.
[50:45.570 --> 50:46.990]  He has photos and everything, yeah?
[50:46.990 --> 50:47.490]  Yeah, yeah.
[50:47.630 --> 50:47.830]  Awesome.
[50:47.830 --> 50:47.970]  Awesome.
[50:48.530 --> 50:48.670]  Yeah.
[50:49.730 --> 51:02.870]  And you mentioned the embassy in London earlier, which seems like a very amateur operation because I'm a sad enough bastard to have looked it up on Street View and found that they have a basketball ring in the back garden and you can even find a Daily Mail quote,
[51:03.010 --> 51:07.090]  hurrah, to say it from their next-door neighbour saying, we cooperate on things like bin collection.
[51:07.290 --> 51:08.130]  You know, isn't that fascinating?
[51:08.430 --> 51:09.350]  Healing council, you know.
[51:09.490 --> 51:09.890]  So, yeah.
[51:10.090 --> 51:16.490]  So, have you been there to check if they have any unsecured wireless networks since they're probably that incompetent in their embassy?
[51:17.250 --> 51:17.650]  Maybe.
[51:21.750 --> 51:23.290]  And that's all I'm f*cking saying.
[51:25.150 --> 51:26.830]  But I may have been to Ealing.
[51:26.930 --> 51:27.730]  It may have been dark.
[51:27.750 --> 51:28.890]  I may have had backtrack.
[51:29.430 --> 51:31.770]  And you may have been renting the house opposite Street View.
[51:31.770 --> 51:32.650]  No, no, no, no, no.
[51:32.650 --> 51:33.450]  I may have had a car.
[51:33.770 --> 51:33.930]  Oh.
[51:34.790 --> 51:36.370]  But that's all I'm willing to say.
[51:39.290 --> 51:39.950]  Anybody else?
[51:40.070 --> 51:40.370]  There we go.
[51:40.850 --> 51:47.730]  So, you posed that the reason for cyber warfare is to create money for the military industrial complex.
[51:47.890 --> 51:48.070]  Yep.
[51:48.290 --> 51:54.190]  Do you think it could be also for creating a reason to control the net and to control away from the citizens and to the government?
[51:55.030 --> 51:59.010]  Why do you think that, you know, they're creating this bullshit?
[51:59.210 --> 52:00.510]  This bullshit is all about control.
[52:00.510 --> 52:04.690]  One of the things that's in the Economist article is we must control digital armaments.
[52:05.010 --> 52:05.970]  Which is hilarious.
[52:06.270 --> 52:08.350]  Because, you know, nobody can write scripts anymore.
[52:09.210 --> 52:10.950]  All here, forget assembly.
[52:11.190 --> 52:13.630]  Because according to the Economist, you will die if you know assembly.
[52:14.230 --> 52:16.010]  But that's what it's about.
[52:16.130 --> 52:20.810]  It's about enforcing regulation through fear as well as driving profit.
[52:20.810 --> 52:22.550]  And that's how this shit works.
[52:26.490 --> 52:27.050]  Run.
[52:27.170 --> 52:27.610]  Run quicker.
[52:27.770 --> 52:28.210]  Run quicker.
[52:28.870 --> 52:30.150]  Unless you are bringing beer.
[52:31.010 --> 52:40.490]  So, one thing that was not on your batshit crazy list was the common thing about North Korea and counterfeiting.
[52:40.710 --> 52:41.230]  Mm-hmm.
[52:41.470 --> 52:46.130]  And I'm curious if you think that belongs in the batshit crazy department or if there's something there.
[52:47.250 --> 52:47.830]  I don't know.
[52:47.970 --> 52:48.470]  It's a tricky one.
[52:49.950 --> 52:59.130]  Because of the, shall we say, the political viewpoints over in North Korea, they may well be engaged in stuff like counterfeiting.
[52:59.890 --> 53:04.170]  They're perfectly situated within easy reach of the golden triangle.
[53:04.690 --> 53:06.810]  And, you know, people smuggling may or may not happen.
[53:06.970 --> 53:12.210]  So, when it comes to traditional crime, they may or may not be involved in it because, you know, they are effectively a rogue state.
[53:13.290 --> 53:19.950]  But I think that that's far more credible than, you know, the North Koreans are coming to destroy us with their Uber League cyber skills.
[53:20.390 --> 53:21.270]  To be fair.
[53:24.130 --> 53:25.290]  Anybody else or are we done?
[53:25.950 --> 53:26.990]  We appear to be done.
[53:27.170 --> 53:27.550]  Fantastic.
[53:28.510 --> 53:30.390]  So, there's some references here.
[53:30.610 --> 53:35.590]  The most important ones on the list are Human Rights Watch and Amnesty International.
[53:36.210 --> 53:38.570]  More important than the technical shit that's on there.
[53:39.530 --> 53:41.530]  If you want to get in touch with me, you can.
[53:41.530 --> 53:42.190]  I'm there.
[53:43.050 --> 53:44.690]  And thank you very much for having me.