Priyom reverse-engineers North Korean DPRK-ARQ diplomatic modem
Since the reactivation of V15 in June 2016, North Korea is back in the numbers station world. Probably spurred by the escalating international tensions around the nuclear ambitions of the North Korean regime, monitoring of Radio Pyongyang and V15 has hit a bit of a craze - with reports that sometimes get a bit overly enthusiastic about radio signals sporadically heard under Radio Pyongyang on the same frequency, yet unrelated, such as the Common and Precious Morse beacon from Germany; or of correlation patterns between V15 transmissions and upcoming missile tests by the North Korean regime, from enthusiasts probably oblivious that V15 messages simply follow a known, predictable bi-monthly schedule.
The FSK waveform quickly yielded a basic synchronous packet structure. But that turned out to be only the first step of many. Beneath these small 8-byte packets, slowly emerged a sophisticated multi-mode, full-duplex protocol, with several regional variants coexisting on the network, and an impressive list of link control command codes. Beneath this protocol, the payload too revealed several message types, and a complete binary header structure; we struggled but managed to identify and understand, one by one, the purpose of each field; and we observed how they tied in with the topology of the embassy network and the way messages were distributed and relayed. In the mean time, being able to decode and identify the stations behind these data bursts, we could list up a schedule of all the known links and contacts involving each embassy.
Although there are still a few details here and there left to clarify, and only one third of the embassy network has been precisely mapped so far, the Priyom team is proud to share and publish this research: it is the first time to our knowledge that the DPRK-ARQ protocol and operations get publicly documented to this extent and in such depth - although we imagine that intelligence agencies were already familiar with this knowledge! Visit our diplomatic stations section to read all the details.
http://priyom.org/blog/priyom-reverse-engineers-north-korean-dprk-arq-diplomatic-modem
North Korea will probably be p-d:
In this case, the GRU sought to make it appear as though the intrusions were the work of North Korean hackers by using North Korean IP addresses and other tactics, said the officials.