Just a simple change to an unguarded file, and anyone who uses Red Star OS can get root. Of course, that's a pretty small population of potential hackers.

North Korea is a technological island in many ways. Almost all of the country's "Internet" is run as a private network, with all connections to the greater global Internet through a collection of proxies. And the majority of the people of the Democratic People's Republic of Korea who have access to that network rely on the country's official operating system: a Linux variant called Red Star OS.

Red Star OS, first introduced in 2003, was originally derived from Red Hat Linux. In theory, it gave North Korea an improved level of security against outside attacka Security Enhanced Linux operating system based on Red Hat that could enforce strict government access controls on the few who got to use it.

However, because Red Star has had so few people with access to it, one of the ironic side effects has been that security holes in the operating system may have gone undetected. And as a security researcher who tested the latest release of Red Star's desktop version reported today, one flaw in the system would allow any user to elevate their privileges to those of the system's root account and bypass all those security policies put in place by the North Korean regime.

Red Star OS Desktop 3.0, which recentlyfound its way ontotorrents and various download sites as an .ISO image, is interesting for a number of reasons, including its attempt to look like Apple's Mac OS X (earlier versions of Red Star mimicked Windows' user interface).

But as an anonymous researcher referring to himself as "Hacker Fantastic" noted in a post today to the Open Source Software Security (oss-sec) mailing list, it also has one significant security hole: a mistake made in permissions settings on a key file that allows anyone with access to the system to run commands as root. "Red Star 3.0 desktop ships with a world-writeable udev rules '/etc/udev/rules.d/85-hplj10xx.rules' which can be modified to include 'RUN+=' arguments executing commands as root by udev.d," the researcher wrote.

Udev.d is a generic kernel device manager that can identify hardware "hot-plugged" into a Linux system. The rules file determines how to handle the events associated with the connection of a new device and can include commands to be launched when certain devices are connectedcommands that are run with system-level privileges. The "85-hplj10xx.rules" file is the ruleset associated with drivers for a USB-connected Hewlett Packard LaserJet 1000 series printer and is common to most Linux distributions.

That's probably not a device most North Koreans would typically hot-plug into their PCs. But because the permissions on that file are set as "world writable," any user regardless of permission levels could make changes to the rules to activate it for any device and execute any command they wanted with system-level privileges.

Ironically, there's a similar file permission error that the researcher discovered in Red Star OS 2.0's desktop version, in a different file that's even easier to abusethe system configuration file for Linux's rc utility, which manages the operating system's boot-up. That vulnerability would allow anyone to add commands to be executed during system boot--a great way to ensure that surveillance software or other malware loads up persistently.

Configuration errors like these in the default installation of North Korea's official desktop operating system suggest that there are other security flaws to be found in Red Star. And the NSA may have already found them.

Here is the original post:

Heads up, dear leader: Security hole found in North Koreas home-grown OS