Skip to content

DEF CON 34 talks are here: 354 talks, summarized and searchable.

Browse DEF CON 34

Cracking North Korea's Info Control - Breaking Open the World's Most Locked-Down Information System

JDT

Where

Main Stage
DEF CON 34

Duration

51 min

Maps North Korea's state surveillance stack, from signature-enforced Android phones to Windows concealment, and the engineering gaps for information-access tools.

Summary

The talk opens with a technologist from Liberty in North Korea describing how the state controls information. Domestic phones are rebranded Chinese handsets running a custom Android build with no app store. Apps and files must carry state-issued cryptographic signatures. A background service called TraceViewer takes screenshots every five minutes and on file events, and its companion RedFlag deletes any file or APK that lacks a valid signature. The national network is tiny, reachable through two egress points, and desktops often run an old input method that disables UAC.

The middle section walks through the signature format and an emulator demo in which an unsigned image is removed on transfer while a camera photo gets signed on the device. Older handsets still allowed boot ROM and fastboot access, but newer models locked these down. Chip-off attempts on two devices failed. A leaked signing tool is shown applying a self-signed block bound to a chosen IMEI. The speaker also covers smuggling through USB drives, micro SD cards, DVD-style players and smart TVs, and how ordinary cleaning utilities are used to hide activity from inspectors.

The closing part is a call for help. Funding for NGOs has dropped, and the group relies on defector testing for every product. It lists open needs including encrypted messaging, Android exploitation, embedded work, censorship bypass and distribution networks, and invites practitioners to get in touch.

Materials

Related talks