Posts tagged Uriminzokkiri

Live from Pyongyang, it’s KCTV on Facebook … or maybe not

1

On Thursday, South Korea’s Yonhap reported on a new Facebook page in the name of the Korean Central Television, North Korea’s national TV station. (Updated. See below.)

Yonhap said, “North Korea’s state broadcaster started real-time Facebook broadcasting as the communist country moves to expand its propaganda efforts into the social networking realm, official sources said Thursday.”

In never divulged who the “official sources” were beyond describing them as people “who keep tabs on the North.”

Later in the day, Agence France Presse reported the same Facebook page, reporting on the news of Kim Jong Un’s visit to a mushroom farm in the first news bulletin of the day. Like Yonhap, AFP noted, “The move marks a further step by the reclusive state to develop its Internet presence and use of social networks to disseminate state-approved propaganda.”

But there’s a few things about the new Facebook page that don’t quite add up.

The page claims to be based in Pyongyang, but links to Uriminzokkiri.com.

Uriminzokkiri isn’t in Pyongyang. It’s in China. It runs YouTube, Flickr and Twitter accounts and has an iTunes podcast so is well versed in social media, but makes no secret of its Chinese base.

Uriminzokkiri’s social media efforts to date have been in Korean, not English (bar a short-lived attempt at an English-language Twitter feed), and are aimed at ethnic Koreans in North Korea’s East Asian neighbors. It established a Facebook page in 2010, but the page was deleted, twice, because it was set up as a personal account and not a “page.” Uriminzokkiri has not been back to Facebook since.

A quick check on the Uriminzokkiri site shows it doesn’t list the channel, despite it apparently starting at least a month ago.

130607-uriminzokkiri-kctv

Uriminzokkiri’s advertised social media channels on June 7, 2013.

So livestreaming on Facebook doesn’t quite fit the Uriminzokkiri profile. If it was to livestream — and it’s probably the most likely part of the North Korean Internet family of sites to do so — it would probably make more sense to serve the video stream from its own site or a third party video service like Ustream, Livestation or Livestream. That’s what it does with recorded video clips: its own site and YouTube.

Assuming the Pyongyang base is correct and the page links to Uriminzokkiri because there’s no KCTV website, it would be even more unusual. Non of North Korea’s Pyongyang-based sites engage in social media at all, and especially don’t adopt the chatty tone of the Facebook page.

The page includes lots of photos and text articles from KCNA. Among the most interesting items are some “behind the scenes” looks at the KCTV studios. They are presumably there to lend credibility to the Facebook account.

Pictures of inside KCTV have only been seen a couple of times in the last few years: once during the 2012 Lunar New Year when China Central Television reported on the TV station and interviewed Ri Chun Hui, probably the most famous KCTV anchor. And then later in 2012 when CCTV donated studio equipment to the broadcaster.

In this May 19 Facebook posting, a site claiming to be Korean Central Television provides a "behind the scenes" look at the control room.

In this May 19 Facebook posting, a site claiming to be Korean Central Television provides a “behind the scenes” look at the control room.

The photo above claims to have been taken on Sunday, May 19, and if real it would be a very unusual look behind the scenes of one of North Korea’s key propaganda machines.

Here’s the photo in full:

Facebook, May 19, 2013.

Facebook, May 19, 2013.

And here’s a photo carried on this website on October 1, 2012, as part of a report into the modernization of the KCTV control room by CCTV. Notice anything similar between the two photos?

131871990_31n

The photo of the control room “on Sunday” is actually a six-month old Xinhua photo that’s been cropped to remove the “news.cn” name from the corner. One of the other “behind the scenes” photos on the Facebook page is a different shot from the same article on NorthKoreaTech, also cropped to remove the news.cn name.

Then there’s the livestreams themselves.

A Facebook posting claiming to be from Korean Central Television in Pyongyang advertises two livestreams of its daily program.

A Facebook posting claiming to be from Korean Central Television in Pyongyang advertises two livestreams of its daily program.

The two streams don’t come from Pyongyang or China at all. One is a Ustream feed that’s been set up in the name of “elufa.tv.” Elufa is a website run by the General Association of Korean Residents in Japan (aka Chrongryon or Chosen Soren) and the other is a Windows Media feed provided by the Seoul-based SPTV website.

Is Korean Central Television really relying on a Japanese and South Korean website to stream its programming?

While it’s impossible to determine who is actually behind the site, everything points to it being the work of one of several North Korean fans outside of the country who already post the country’s propaganda to their own sites and YouTube channels. There’s nothing on the page that appears genuinely original from KCTV in Pyongyang.

[UPDATE: The Facebook page, which was available at https://www.facebook.com/KoreanCentralTV , appears to have been deleted shortly after this article was published.]

 

logo-urimin

Uriminzokkiri restoring after hack

2

130404-uriminzok-02This week’s hack of the Uriminzokkiri website certainly raised the bar in the cyber battle currently playing out online.

It marked the first time in the current round of attacks that anyone had managed to break in and deface a North Korean website. Over the last couple of weeks, several sites have been taken offline by denial of service attacks, but such attacks simply impede the website’s ability to serve pages and don’t affect the content.

This time around the attack saw the site removed and its Twitter and Flickr channels accessed. The Flickr channel is back under a new account, it appears Uriminzokkiri still doesn’t have access to its Twitter channel, and the site itself is back online, albeit with some previous content missing.

The site’s YouTube channel wasn’t apparently affected.

Four of Uriminzokkiri’s companion sites were also hit. One, AINDF.com, still displays a poster of Kim Jong Un depicted as a pig, while Ryugyongclip.com, Ryomyong.com and Ournation-school.com are offline.

From an analysis viewpoint, perhaps most interesting was the roughly 15,000 user account details that were also published. They are providing a fascinating profile of the type of people who registered with the site.

The details were released in two batches with the second of around 6,000 names coming on Saturday.

So, what’s next?

Some North Korean sites still appear to be under sporadic denial of service attack.

People posting Twitter messages under the name of Anonymous have been claiming further attacks will take place on April 19, under the name “OpFreeKorea,” and June 25, under the name “OpKoreanWar,” although the former date is being mentioned much less than the latter.

A lot will probably depend on the situation on the Korean peninsula. If tensions continue to rise, expect the attacks to continue. If things fall back to normal, North Korea won’t have such a high profile in news headlines and some attackers are likely to move on to other targets.

130404-anon

Uriminzokkiri, companion websites hacked

6

130404-anonUriminzokkiri, a China-based North Korean news website with close ties to Pyongyang, has been hacked. The site is currently inaccessible, companion websites have also been attacked and defaced, and it’s Twitter feed and Flickr pages have also been broken into.

The hack came hours after a list of apparently 9,000 registered users of the site was posted to the Internet.

The list contained user names, real names, email addresses, birth dates and other information including hashed passwords, which are the result of a process where a password is passed through an algorithm to disguise it. The attackers had apparently been able to break some of the simpler passwords, such as “123456,” and the password of the site administrator.

If the user ID and password of the site administrator was correct (North Korea Tech did not attempt to verify it by accessing the site), it would allow an intruder almost complete control over the site.

On Twitter, the Uriminzokkiri account saw it’s photo change to an illustration of a couple dancing the tango, the man with the Guy Fawkes mask that has become the symbol of the “Anonymous” hackers, and the words “Tango Down.”

130404-uriminzok-01

The account was also used to send out information on the attacks:

130404-uriminzok-02

 

130404-uriminzok-03The other websites mentioned are companion sites of Uriminzokkiri.

One of the sites was changed to include a “wanted” poster that showed an illustration of Kim Jong Un with a Mickey Mouse tattoo and a pig’s nose and ears. Among the listed crimes: Threatening world peace with ICBMs and nuclear weapons, Wasting money while his people starve to death, Concentration camps and the worst human rights violation in the world.

The hack and the poster will likely be deeply embarrassing for the people running Uriminzokkiri and could land them in serious trouble with the authorities in Pyongyang.

In early 2011 the site’s Twitter channel was hacked and used to send out messages disparaging then-leader Kim Jong Il. It also carried a link to a YouTube that showed Kim Jong Un driving a sports car filled with birthday gifts while mowing down pedestrians.

After the hack Free North Korea Radio reported officials of the website had been questioned by investigators from Pyongyang over the hack.

The attack is the latest in a string of cyber-actions against North Korean Internet properties.

130401-anon-uriminzokkiri

Hackers claim 15,000 Uriminzokkiri user records

13

130401-anon-uriminzokkiriA hacker or hackers working under the umbrella of “Anonymous” claims to have broken into Uriminzokkiri.com, the North Korean-run site based in China, and taken over 15,000 user records.

A message posted online makes the claim and includes details for six accounts, apparently showing user names, e-mail addresses, birth dates, and hashed passwords.

These are passwords that have been run through an algorithm to come out as something that contains the essence of it. It’s an alternative to storing the password in plain text and helps guard against losing passwords during hacks like the one apparently conducted on Uriminzokkiri.com.

Of the six users, three have Korean names and the other three appear to be Chinese.

Four of the six users have Chinese email addresses, there’s a Hotmail address and one South Korean address that apparently belongs to KEPCO KDN, a smart-gird systems provider that’s part of the Korea Electric Power Co. But that South Korean address could be fake. If all the data in the records are to be believed, one of the users was born on June 1, 1900.

Aside from the user records, the message includes the rationale for the hack and a protest against the governments of both the United States and DPRK.

North Korean government is increasingly becoming a threat to peace and freedom. Don’t misunderstand us: As well we disagree with the USA government too – these guys are crooks, USA is a threat to world peace too, and direct democracy (or any kind of democracy) doesn’t exist there. The American government is a target and enemy of Anonymous as well!
This is not about country vs country – This is about we, the people, the 99% (of USA and of North Korea) vs oppressing and violent regimes (like USA gov. and N.K. gov)! We, the people, are gathering together because we are stronger now and we won’t fight your wars anymore, we won’t eat your shit anymore!!!

It then went on to make a series of demands:

We demand:
– N.K. government to stop making nukes and nuke-threats
– Kim Jong-un to resign
– it’s time to install a free direct democracy in North Korea
– uncensored internet access for all the citizens!

To Kim Jong-un:
So you feel the need to create large nukes and threaten half the world with them?
So you’re into demonstrations of power?, here is ours:
– We are inside your local intranets (Kwangmyong and others)
– We are inside your mailservers
– We are inside your webservers
Enjoy these few records as a proof of our access to your systems (random innocent citizens, collateral damage, because they were stupid enough to choose idiot passwords), we got all over 15k membership records of www.uriminzokkiri.com and many more. First we gonna wipe your data, then we gonna wipe your badass dictatorship “government”.

It’s worth noting that while sample data was included for Uriminzokkiri.com, there was no evidence supplied that supported the assertion that web and mail servers in North Korea or anything on the domestic intranet system had been accessed.

Getting onto the domestic intranet is highly unlikely based on our current understanding of the network. It’s believed to be totally separate from the Internet with no network link between the two for security purposes. So a proven hack would be very interesting.

The message ends:

To the citizens of North Korea we suggest to rise up and bring these motherfuckers of a oppressive government down!
We are holding your back and your hand, while you take the journey to freedom, democracy and peace.
You are not alone.
Don’t fear us, we are not terrorist, we are the good guys from the internet. AnonKorea and all the other Anons are here to set you free.

The claim comes as access to North Korean websites is returning to normal after a series of attacks made them difficult or impossible to access over the weekend. The attacks took place under the Twitter hashtag #OpNorthKorea.

More are planned, for both April 19 and June 25.

130320-uriminzokkiri-04

North Korea: The Podcast

0

130320-uriminzokkiri-04Uriminzokkiri, the Chinese-based website that carries most of North Korea’s official propaganda output, has started a podcast and it’s available through Apple’s iTunes.

The podcast is advertised on the front page of the website with a link that jumps to an Apple iTunes page. The page currently carries ten episodes of the podcast, which is entirely in Korean and combines spoken word with music.

The episodes were uploaded between February 20 and 23 this year and range between 3 minutes and 22 minutes long. There haven’t been any updates in the last month.

It’s classified in the “News and Politics” section of iTunes’ podcasts and doesn’t appear to have attracted any listener reviews yet.

Apple requires podcasts to be approved before they appear in iTunes and it’s not clear if the Uriminzokkiri content was vetted by Apple U.S. or Korea. Apple did not respond to a request for comment.

130320-uriminzokkiri-05Uriminzokkiri has been operating around 10 years and is believed to be based in Shenyang, which is close to the North Korean border. The site, which is registered to a company called “Korea 615 Shenyang,” has strong links with North Korean and carries much of the output of the state media machine and some articles of its own.

It’s proved to be the most social-media aware of all sites carrying official news.

Uriminzokkiri operates a Twitter feed with over 13,000 followers, has racked up more than 5 million video views on YouTube, and posts images from North Korea to Flickr. The podcast is advertised alongside these on the site as it’s latest way to push North Korean propaganda to the world.

It hasn’t navigated the social media space without problems.

In 2010, it attempted to gain a Facebook following but Facebook twice deleted its account. The company said it zapped the account because it was created as a personal account and not a “page,” which is required of all organizations on the site.

Most recently it achieved short-lived success with two propaganda videos. One included footage from a video game of New York City in flames and the other used a soundtrack from a different game. After a brief burst of life, the two videos were the subject of YouTube takedown requests by the copyright owners, but not before they amassed thousands of views as a result of the publicity surrounding them.

130320-uriminzokkiri-02

YouTube zaps another Uriminzokkiri video

2

Another Uriminzokkiri video has been removed from YouTube for copyright infringement. This time it’s a propaganda video that borrowed its soundtrack from the video game “The Elder Scrolls IV: Oblivion.”

The takedown, confirmed by a message when users attempt to access the clip, comes just two weeks after a previous propaganda video was removed after a copyright complaint by Activision. That video used a computer-generated animation clip from Activision’s “Call of Duty: Modern Warfare 3.”

The latest removal comes after a copyright complaint from ZeniMax Media, a Maryland-based computer game publisher that puts out the game under its Bethesda Software division.

Uriminzokkiri regularly uses footage from foreign media in its productions. It usually goes largely unnoticed, but the Activision takedown a couple of weeks — likely as a result of coverage of the clip in the U.S. video gaming media — has meant extra eyes are now watching its output. As NKNews notes, some clips were taken from foreign TV coverage.

The Uriminzokkiri operation, which is based in China, needs to watch out that it doesn’t fall foul of YouTube’s copyright system otherwise it could lose the channel.

130220-elderscrolls

Activision cuts short North Korea’s space dreams

7

That didn’t last long. U.S. video game maker Activision has filed a copyright takedown demand with YouTube resulting in the removal of a video that sees a North Korean man dream of reunification, Korean domination of space and the collapse of the United States.

130205-dream-activision

Uriminzokkiri is a semi-official North Korean web site based in China. It speaks for the North Korean government and carries much of the output of state media, but it also produces its own content. The video was one such original piece.

The clip, posted on the Uriminzokkiri YouTube channel and website over the weekend, attracted a lot of interest on Tuesday. It managed to attract 460,000 views before being taken down — that’s about 10 percent of all views on the Uriminzokkiri channel.

130205-dream-activision-02

Part of its success was the curiosity of the video and music that accompanies the piece: a gentle piano rendition of “We Are The World,” the 1985 anthem of a U.S. campaign to help the starving of Ethiopia.

In the Uriminzokkiri video, an instrumental version of the song plays alongside an image of a North Korean rocket blasting into space. In the dream, it’s an Unha-9 rocket. Presumably that’s a more advanced version of the Unha-3 rocket that recently placed a satellite into orbit.

130205-dream-01

I had a dream last night, a dream of soaring into space on board our Unha-9 rocket — Uriminzokkiri YouTube channel, February 2, 2013, via “Our Kwangmyongsong-21 spacecraft got separated from the rocket and traveled through space,” he says.New York Times Lede Blog.

What’s the rocket carrying? The Kwangmyongsong-21 spacecraft, a much more advanced version of the Kwangmyongsong-3 satellite that was launched on the aforementioned Unha-3 rocket in December. The satellite isn’t believed to be functioning, but the Kwangmyongsong-21 in the dream has achieved a lot more success.

130205-dream-02

“Our Kwangmyongsong-21 spacecraft got separated from the rocket and traveled through space,” — Uriminzokkiri YouTube channel, February 2, 2013, via “Our Kwangmyongsong-21 spacecraft got separated from the rocket and traveled through space,” he says.New York Times Lede Blog.

130205-dream-03

It’s apparently a reusable space vehicle, along the same lines as the U.S. Space Shuttle.

So why is Activision making such a fuss? As Kotaku noted, the computer-generated scenes destruction across New York as the city’s skyscrapers burn come straight from the “Call Of Duty: Modern Warfare 3″ video game.

Here’s a look at a frame from the Uriminzokkiri video and, below it, one from “Call Of Duty.”

130205-dream-04

130205-dream-05See the tall building in the center? Yup, it’s the same one in both clips.

While the video is gone from YouTube, it remains available on LiveLeak.

111218-kim-kcna-urgent

Kim Jong Il’s death – How DPRK websites broke the news

4

A familiar newscaster dressed in black appears on screen and makes a tearful announcement: Kim Jong Il is dead. When North Korean state TV and radio broke the news at noon on Monday they had already given advance notice that a major announcement was coming. Its delivery was an attempt to set a national mood of mourning.

On the Internet things were a bit different with the news being carried as if it was any other story.

North Korea’s state media ventured online last year when a new Internet connection was brought to Pyongyang. The state-run news agency, the major national daily and the international radio outlet all have websites and steadily churn out daily propaganda about economic growth, scientific breakthroughs and the trips of Kim Jong Il across the country.

The audience is purely international — almost no one in North Korea has Internet access — and the subject matter not one that lends itself to breaking news. So perhaps it’s not surprising that North Korea’s media didn’t immediately replace their sites with somber pictures, banner headlines, or breaking news tag.

First word came shortly after midday — after the news had broke on TV and radio — with bulletins on the KCNA website.

KCNA’s Korean front page was pretty much the same. North Korea’s other websites, the national Rodong Sinmum daily and Voice of Korea international radio service, didn’t bother to immediately update their websites. Uriminzokkiri, a China-based site with close links to Pyongyang, was also slow out the gate in getting the news up.

But don’t read too much into this. The death of Kim Jong Il is a huge event for the country and the state propaganda machine. The lack of national mourning on the websites is likely much more to do with an inability to turn around a slick website redesign in hours that anything else.

A little over an hour after the announcement, KCNA had added a picture to its front page:

Go to Top