North Koreans are using Casper

mcrispin
Contributor II

http://nknetobserver.github.io

Guys does scans looking for North Korean use of IP space, finds something called "Recon Suite" (actually Casper), says North Koreans are using a MacBook.

Kinda hilarious actually.

3 REPLIES 3

franton
Valued Contributor III

Since there's a huge trade embargo with the "people's republic" on anything to do with technology, you can pretty much be assured that JAMF have not sold them it.

So looks like they're either ripping people off or getting it via 3rd party intermediateries.

chris_kemp
Contributor III

I don't think that's JAMF's Recon running. I could be wrong, but AFAIK the Casper apps do everything over SSH, not over proprietary ports. Quick test here , a port scan running Recon returns nothing unusual.

mcrispin
Contributor II

More highly "secure" environments *could* choose to run SSH over something other than the standard port. I'm not making any conclusions here. In fact, I think this is probably a western journalist who happens to have a MacBook and also happens to be in NK - there are many countries with more cordial relations than between the US and NK, as the writer seems to indicate.