Tangled Web

The tech world was abuzz on June 27 with the unveiling of Google's tablet, the Nexus 7. But there could be another kid on the scrappy tablet-market block: the Samjiyon.

Bloomberg picked up the story, based on a report in the South Korean newspaper "Dong-a Ilbo" that was sourced to unidentified defectors.

The Marmot's Hole blog has more details:

There have been some tablet rumblings before in North Korea. In May, Martyn Williams at North Korea Tech wrote about a tablet computer that was demoed at the Pyongyang International Trade Fair.

The tablet was reportedly produced by the Korea Computer Center (KCC), which is a state-run IT research center, and there's some pictures of the display in the posts.

According to an interview with a representative of the KCC, "the tablet was invented by the Korea Computer Center to enable people to study revolutionary ideas, to use science and technology, to carry out their business and to enjoy movies."

Where it was produced, however, is a mystery.

Williams links to a previous post looking at the origins of a North Korean netbook, which appears to be a generic and low-cost Chinese-made model, tricked out, no doubt, with North Korean software and restrictions.

In recent years, North Korea has made tentative steps in embracing new technologies and the Internet (although that narrative of progress is mostly just for outside consumption). The country has launched social-media accounts and has revamped its outward-facing website in English of the country's official news service.

However, even if the tablet did connect to the Internet, it would only get the "Kwangmyong," North Korea's heavily filtered national intranet.

That the Samjiyon wouldn't be Internet-connected and without a camera would come as no surprise. "Wired" reported in April 2011 about the smuggling of smartphones across the border from China. According to "Wired," "the unlicensed mobile phones have allowed families in the North to clandestinely connect with foreign intelligence services in South Korea and the United States and spread news through the rumor mill."

In fact, a Japanese organization, AsiaPress, has been working clandestinely with North Koreans to get uncensored images, captured with smartphones, out of the country.

Individuals active in the pro-Tibetan human rights community have been targeted by malware embedded in a European Parliament document.

A report into the incident has just been published by the Citizen Lab, a University of Toronto research group that focuses on digital media, global security, and human rights.

On June 14, the European Parliament issued a resolution calling on China to reveal the whereabouts of people who have self-immolated and also to allow access to rights monitors in the region.

Since 2009, more than 40 Tibetans have self-immolated to protest what they say are the discriminatory practices of the Chinese government. The authorities have labeled them as terrorists encouraged by the Dalai Lama and the whereabouts of some of those who survived is unknown.

A day after the European Parliament's resolution, which was criticized by China, an e-mail was sent from an account appearing to be a legitimate Tibetan organization to more than 80 Tibetan activists.

The e-mail, with a subject heading "FW: the new decision of EUROPEAN PARLIAMENT about tibetan human right in China,” contained a document purporting to be the European Parliament resolution, which was in fact a malicious .doc file.

According to the Citizen Lab, the "malware utilized in this attack is the same as that described in other reports detailing attacks with Tibet-related themes. Once the malicious code is executed, it starts to communicate with a command and control (C2) server located in Hong Kong." That could give the hackers access to the files on the victims' computers.

The text in the document wasn't, in fact, the resolution, but the European Parliament's joint motion for a resolution, which was issued two days earlier and was freely available for download as a Word document on the parliament's website.

This type of spoofing has been done before -- not just fraudulent phishing attempts but also to target activists:

In March, a security vendor AlienVault released a report about attempts to install a remote access computer Trojan, which could steal information from pro-Tibetan activists' computers, via an e-mail with an infected Word document.

AlienVault believed those attacks were the work of a group of Chinese hackers who, in 2011, launched attacks against chemical companies.

A few days after the AlienVault report, hackers began spoofing AlienVault's e-mail address in a new attack. From Computer World:

In the past, pro-China hackers have also used bots to suffocate discussions around Tibet-related hashtags on Twitter, by spamming them with masses of junk tweets. Similar spamming has been seen on Syria- and Russian-related hashtags during times of crisis.

The most recent European Parliament attack is disturbing, not just because of the potential of the malware to wreak havoc, but as Citizen Lab points out, it results "in a chilling effect whereby the Tibetan community is discouraged from circulating information on the resolution, which is now associated with malware."