North Korea's RED STAR OS (it spies on you)...

Overview

The video is a tech/security walkthrough and analysis of North Korea’s “Red Star OS” (the creator also refers to earlier versions as “RedStar 3.0” and “RedStar 2.0”). It focuses on how the OS behaves like a customized Linux/Windows clone, and it reportedly includes surveillance, telemetry, and content/file watermarking.

---

Sponsor / privacy angle (Aura)

• The sponsor (Aura) frames the privacy problem as data brokers selling personal data to scammers and spammers.
• It references major leak claims (including an example: AT&T customer records reportedly ending up on the dark web).
• Aura is described as bundling:
  • Antivirus
  • VPN
  • Password manager
  • Identity/credit monitoring
• It also claims to file opt-out requests for users.

---

What Red Star OS is (high-level)

• Red Star OS is presented as a North Korean Linux distribution meant to replace Microsoft Windows.
• The creator argues this is partly because:
  • Linux is flexible enough to be tailored to mimic Windows, and
  • Using Western software (e.g., Microsoft) could introduce spyware risks.
• Based on a subtitle citation (including a BetaWiki mention), the OS aims to mimic Windows while remaining more controlled.

---

Reported security model / lockdown behavior

• The OS includes “lockdown” mechanisms that may prevent disabling protections even as root.
• Attempts to disable features can trigger errors or force reboots.
• Some versions are described as not retrievable externally (“behind the Iron Curtain”), with the creator only obtaining version 2.0.

---

Version analyzed in the demo: Red Star 2.0 (Windows XP lookalike)

The creator describes the desktop as extremely close to Windows XP, including:

• Control panel and directory structure
• Multimedia/sound settings
• Visual styling (themes/icons resembling Windows Vista/XP)
• Installation and navigation that require translation software, since the OS language is Korean

---

Early observations during boot/use

• The video mentions an error related to “desktop media manager” not starting (exact wording uncertain due to subtitles).
• The UI/behavior demonstrates internet capability and audio support.
• The creator emphasizes branding/knowledge cues that suggest intentional control.

---

System update and internal connectivity limits

An “update tool” exists, but the creator says:

• It can’t find updates externally (connection fails).
• An internal endpoint/URL is referenced (subtitles include something like ok.inf and a domain/host ending with a Korean/“KP”-like pattern).

The OS is discussed in the context of North Korea’s internal intranet / walled-garden model, where much internal content is unreachable from outside.

---

Internal networking concepts explained

The creator describes North Korea’s network as a walled garden:

• Internally uses private address space (subtitles mention 10.0.0.0/10.x ranges).
• External access is restricted by providers and routing.

In this framing, the OS’s browser and services connect to internal endpoints rather than the open internet (the creator later claims they could reach Google, possibly reflecting reachable connectivity in the demo environment).

---

USB/device controls

• A “USB security manager” is shown with a password initially unset.
• The creator demonstrates:
  • setting a password
  • restricting USB media access to authorized users
• This is presented as device control intended to limit what removable media can do on the system.

---

Applications, themes, and the “copying Windows” claim

The creator repeatedly emphasizes that the OS:

• Looks like Windows (XP/Vista)
• Includes Windows-like utilities, such as:
  • Themes and icons
  • Tools resembling file viewers/folders
  • A MS Paint–like drawing utility

Some elements are described as potentially involving unlicensed Microsoft asset redistribution (e.g., wallpapers/icons/themes).

---

Gaming demo (Windows XP-style)

The video includes a segment of “what games exist,” including:

• Solitaire with auto-play/auto-solve
• A tanks/war-themed title
• A Korean checkers–like game
• Minesweeper
• A Candy Crush–like tile game

The creator implies these games may be deliberately altered or “rough/ soulless,” and notes whether features like auto-play exist.

---

Browser: “Nara” (and government portal claims)

• The OS includes a browser called Nara.
• The creator claims:
  • Nara is available in English translation (and uses a Korean language pack by default).
  • It loads an internal intro landing page about Red Star OS 2.0.
• The browser is described as connecting to Nara BBS (old-school forum/message services).
• The creator identifies Nara as the North Korean government web portal, created in 1996 (citing Wikipedia), and claims the latest posts shown are from 2024.
• The video also mentions an external directory/resource listing North Korean websites (referenced as tech.org), organized by categories such as:
  • company sites
  • government
  • news/media
  • travel/tourism
  • universities

---

Reported surveillance: watermarking and tracking

The most important technical/security claims come later, describing how Red Star OS may spy and identify file creators.

• The creator references a write-up (subtitles mention “Insinuator domnet”) describing:
  • Watermarking information embedded into files/content
  • A possible virus-scanner-like component that processes certain documents/media

Subtitles describe technical steps consistent with forensic watermarking, including:

• processing document/image information
• encryption/normalization
• DCT (Discrete Cosine Transform) extraction/processing
• audio/image processing pipelines
• searching for watermarking artifacts

Key privacy implication (as stated)

If the government can extract/recognize watermarks, it can determine which system created/opened files—enabling attribution.

The video also cites historical-style tracking logic, including:

• printer machine identification codes (subtitles mention reverse engineering by an entity like the EFF and “tracer dots” on prints)
• cold-war style tracking analogies
• “typewriter transmitter” style surveillance (historical analogy)

---

Safety guidance / operational cautions

The creator concludes:

• Using Red Star OS can get users in trouble if they create/share media that could be interpreted as dissent.
• Even with precautions (VMs, VPN, isolated networking), any OS connected to the internet could still send telemetry.

The video shows the creator using “safeguards” (VM, VPN, network concealment), but warns this can’t guarantee privacy.

---

External research referenced

• The video references a 2021 article (subtitles attribute it to “size of cat”) that tracks North Korea’s internal IPs and maps them to websites/services.
• The creator claims many endpoints exist only inside North Korea and can’t be accessed from outside.

---

Main speakers / sources

• Speaker: “me mudahar” (video creator and presenter)

Referenced sources in narration/subtitles

• Ora (Aura) (sponsor)
• BetaWiki (Red Star OS description)
• Insinuator domnet (watermarking/spying write-up)
• EFF (reverse engineering printer watermark/tracer dots)
• Wikipedia (Nara portal information)
• “size of cat” (2021 internal IP/web mapping research)
• tech.org (directory/resource listing North Korean websites)