North Korean Economy Watch

According to Reuters:

The “Northern Limit Line (NLL)” off Korea’s west coast, a legacy of the 1950-53 Korean War, has been the site of several deadly clashes in the past, and with tensions running high after the corvette Cheonan exploded and sank, the chance of new skirmishes has risen.

It was unclear if the violations were intentional, but some of the fishing boats were known to be operated by the North Korean military, South Korea’s Yonhap News quoted spokesman for the Joint Chiefs of Staff, Park Sung-woo, as saying.

“We’ve confirmed that the North Korean military is operating fishing vessels on the side, but we haven’t yet established whether those ships were equipped with heavy weapons,” Park said.

In all of the roughly 20 cases so far this year the ships retreated after warnings by the South Korean navy, he said.

A team of international investigators, led by South Korea’s military, said in May that a North Korean submarine torpedoed the Cheonan, presenting evidence that included parts of the weapon recovered from the site of the incident.

Pyongyang says the incident was fabricated and has threatened military action if the U.N. Security Council punishes it.

Read the full story here:
N.Korea fishing boat incursions on the rise – South
Reuters
John Ruwitch and Jack Kim
6/17/2010

A few months ago I wrote about two attempts to hack into my computer.  The post is here if you are interested.  Well, since then I have fended off no less than six attempts to break into my computer–including two attempts just today (three this week).One email containing a virus was ostensibly from a North Korea expert and the second email was intended to look like it came from the Korea Economic Institute (it even referenced an actual upcoming event of theirs).  I know of several others who have been targeted and some who have even been infected so please be careful out there.Someone is still not playing nice.

UPDATE (2011-5-31): New Google Earth imagery, dated 2009-5-27, reveals the Sunchon Vinalon Complex area continues to shrink:

Here is an overview of the facilities in question.  Note the two yellow boxes:

Below are images from the complex in the yellow box on the left (March 2004 – May 2009):

Below are images from the complex in the yellow box on the right (March 2004 – May 2009):

ORIGINAL POST (2010-5-25): The Sunchon Vinalon Complex was launched in 1985.  It was intended to produce 100,000 tons of Vinalon as well as methanol, vinyl chloride, sodim carbonate, caustic soda, nitrogenous fertilizers, albuminous feed.  In October 1989 the government announced that the first-stage had gone into production (50,000 tons of vinalon).

Using Google Earth imagery and clandestine video footage we can see, however, that much of the Sunchon Vinalon Complex, what I believe is that largest industrial complex in the DPRK (in terms of geographic size), is now a shrinking pile of scrap materials.

Below is an overview of the Sunchon industrial area.  It is composed not only of the Sunchon Vinalon Complex, but also the Sunchon Thermal Power Plant and Sunchon Cement Complex.  I believe the Sunchon Vinalon Complex is actually composed of three distinct hubs. The two I will be looking at are highlighted in red in the below satellite overview image:

The  red box on the right has seen the most changes.  Between 2004 and 2006 it was nearly entirely stripped:

The red box on the left has been stripped as well–though not nearly to the same extent:

Recently KBS broadcast clandestine video shot at the Sunchon complex and someone posted a short clip on the web.  You can watch it here.  Below I have matched the clandestine video segments with the satellite imagery which shows just how derelict the facility has become. Satellite image dates are in the upper right hand corner.

The third zone of the complex seems unaffected over the years.  You can see it here.  I suspect this is the successfully launched “first stage”.

Additional Information:

1. Google Books has a blurb about the complex from North Korea: A Strange Socialist Fortress.  See the blurb here. I own this book and recommend it.

2.  Global Security asserts that the facility produces chemical weapons.

3. Here are all of the KCNA stories that mention the Sunchon Vinalon Complex (Courtesy of the invaluable STALIN Search Engine)

4. The Sunchon Vinalon Complex is the second vinalon facility to be constructed in the DPRK.  The first is the 2.8 Vinalon Complex in Hamhung.  This facility was recently reconstructed and opened after falling into disrepair during the Arduous March.

…and it is stunningly clear. 

We can finally see the galss starting to go up on the Ryugyong Hotel:

Click image for larger version

I also blogged a few weeks ago about new housing construction near the Potongang Gate (see here).  Well this project is nearing completion (at least from the outside).

Click image for larger version

We can also see the new Pyongyang Folk Village taking shape (39° 3’40.12″N, 125°49’28.42″E).  Here is an overview of the facility:

Here are the replicas of Pyongyang landmarks under construction:

As I mentioned in a previous blog post, there seem to be replicas of different burial mounds, the West Sea Barrage, Monument to Party Founding, Ryugyong Hotel, Mangyongdae Children’s Palace, and much more.  There even appears to be a miniture Korean Penninsula that visitors can walk around.

According to Yonhap:

Trade between South and North Korea nearly doubled last month compared with a year ago amid a nascent economic recovery in the South, a government report showed Wednesday.

Inter-Korean trade jumped 88.5 percent from a year ago to US$204.03 million in March, according to the report by the Korea Customs Service. Compared with two years ago, before the South Korean economy was hit by the global financial crisis, trade between the two Koreas rose 29.7 percent in the reported month.

South Korea imports a range of labor-intensive goods such as clothes and watches from the joint Kaesong industrial complex in North Korea, as well as seafood and some agricultural produce. North Korea imports textiles such as cotton and other staple fabrics, along with electronics products including computers and machinery.

South Korea’s outbound shipments to the North came to $84.36 million while its imports from the communist country amounted to $119.67 million. This marked the highest trade deficit for the South in 17 months at $35.31 million, the report said.

The surge came on the back of an economic turnaround in the South. Inter-Korean trade did not seem to be affected by ongoing political tensions on the Korean Peninsula.

During the first quarter of this year, two-way trade soared 64.3 percent from a year earlier to $526.72 million, it said.

Bilateral trade has increased steadily over the past decade from $328.65 million in 1999 to $651.68 million in 2002 and surpassing the $1 billion mark for the first time in 2005.

Inter-Korean trade reached $1.79 billion in 2007 and peaked at $1.82 billion the following year before falling slightly to $1.66 billion last year.

Read the full story here:
Inter-Korean trade nearly doubles to $200 mln in March
Yonhap
4/28/2010

Dear Ms. Ling and Ms. Lee,

I am very interested in mapping the locations you were held in the DPRK and the central court where you were tried.  If you are able to do so, please add this geographic information to your upcoming Current TV special, or feel free to drop me a message letting me know where these places are (or even your best guess).

I have been mapping North Korea on Google Earth for several years.  You can download an older version of the project on this web page.

Here is a satellite image of the building where you were brought to meet President Clinton.

Best,

Curtis

According to Voice of America:

Peking University Professor Zhu Feng, one of the forum participants, issued a frank warning to the North not to expect any large handouts from China.

“Bailing out North Korea’s economy [is] easy.  We have the capability.  We have no intention,” said Zhu.

Three decades after opening its economy and encouraging market activity, Beijing is one of the three largest economies in the world.  In November, Pyongyang enacted what economists say is the mirror opposite of the Chinese reforms; clamping down on markets, and extinguishing the savings of small traders with a surprise currency revaluation.

Reports from North Korea indicate the measures strangled economic activity and sparked hyperinflation in prices for basic foods.

Zhu says Pyongyang needs to adjust its course, and unless it does, China will not help.

“Offering North Korea sizable aid, and keeping it [afloat], without any change to their very bizarre policy, is detrimental to the China national interest,” said Zhu.

Soon after North Korea invaded the South in 1950, China sent hundreds of thousands of troops to aid the North.  In the past, the two countries have said their relationship was as close as “lips and teeth.”  Zhu says times have changed.

“The Korean War is over.  Beijing changed tremendously.  Our relation also altered almost completely,” he said.

Zhu says China will continue to engage with the North on humanitarian issues to prevent mass starvation.  However, he says Beijing’s North Korea policy is not centered on preserving Kim Jong Il’s rule.

“China is now ready for any form of very substantive change in North Korea – including collapse,” he said.

It is not clear if the Chinese government backs Zhu’s comments. But such blunt language from China about North Korea is unusual. Beijing has been Pyongyang’s biggest economic supporter for nearly 20 years, and, regional security experts say, it wants to avoid an economic collapse in North Korea that would send hundreds of thousands of refugees across the border.

Read the full story here:
Chinese Continued Financial Support of N. Korea Questioned
Voice of America
Kurt Achin
3/31/2010

UPDATE: This is the second attempt to hack into my computer by someone claiming to be a journalist.  It is similar to the first attack but this time there is no PDF, just a link to a hostile server:

Dear Curtis Melvin,

My name is Ichikawa Hayami, from Nihon TV
Would you have some time to do a short
interview on the foreign direct investment in NK by letter?
If possible, prefer to below please.

documents

Best regards.

Ichikawa Hayami
Producer
Nihon TV World View

If you click on “documents” you are routed to a hostile server.

Here is the email header:

Delivered-To: nkeconwatch@gmail.com
Received: by 10.224.28.208 with SMTP id n16cs123243qac;
Tue, 6 Apr 2010 00:20:31 -0700 (PDT)
Received: by 10.220.107.227 with SMTP id c35mr3152197vcp.42.1270538430714;
Tue, 06 Apr 2010 00:20:30 -0700 (PDT)
Return-Path: <Ichikwa.hayami@asia.com>
Received: from imr-da03.mx.aol.com (imr-da03.mx.aol.com [205.188.105.145])
by mx.google.com with ESMTP id 26si25578441vws.46.2010.04.06.00.20.30;
Tue, 06 Apr 2010 00:20:30 -0700 (PDT)
Received-SPF: neutral (google.com: 205.188.105.145 is neither permitted nor denied by best guess record for domain of Ichikwa.hayami@asia.com) client-ip=205.188.105.145;
Authentication-Results: mx.google.com; spf=neutral (google.com: 205.188.105.145 is neither permitted nor denied by best guess record for domain of Ichikwa.hayami@asia.com) smtp.mail=Ichikwa.hayami@asia.com
Received: from imo-da04.mx.aol.com (imo-da04.mx.aol.com [205.188.169.202])
by imr-da03.mx.aol.com (8.14.1/8.14.1) with ESMTP id o367KUP1027363
for <nkeconwatch@gmail.com>; Tue, 6 Apr 2010 03:20:30 -0400
Received: from Ichikwa.hayami@asia.com
by imo-da04.mx.aol.com  (mail_out_v42.9.) id o.c35.7794a375 (44225)
for <nkeconwatch@gmail.com>; Tue, 6 Apr 2010 03:20:25 -0400 (EDT)
Received: from smtprly-mb03.mx.aol.com (smtprly-mb03.mx.aol.com [64.12.207.150]) by cia-dd08.mx.aol.com (v127_r1.2) with ESMTP id MAILCIADD083-5c6c4bbae0b8112; Tue, 06 Apr 2010 03:20:25 -0400
Received: from web-mmc-d04 (web-mmc-d04.sim.aol.com [205.188.103.94]) by smtprly-mb03.mx.aol.com (v127_r1.2) with ESMTP id MAILSMTPRLYMB032-5c6c4bbae0b8112; Tue, 06 Apr 2010 03:20:24 -0400
To: nkeconwatch@gmail.com
Subject: interview request
Date: Tue, 06 Apr 2010 03:20:24 -0400
X-MB-Message-Source: WebUI
X-AOL-IP: 211.103.134.39
X-MB-Message-Type: User
MIME-Version: 1.0
From: ichikwa.hayami@asia.com
Content-Type: multipart/alternative;
boundary=”——–MB_8CCA370C27E93F1_136C_1AF_web-mmc-d04.sysops.aol.com”
X-Mailer: Mail.com Webmail 31226-STANDARD
Received: from 211.103.134.39 by web-mmc-d04.sysops.aol.com (205.188.103.94) with HTTP (WebMailUI); Tue, 06 Apr 2010 03:20:24 -0400
Message-Id: <8CCA370C27C3290-136C-D4@web-mmc-d04.sysops.aol.com>
X-Spam-Flag:NO
X-AOL-SENDER: Ichikwa.hayami@asia.com

ORIGINAL POST: A week ago I received a personal email from someone requesting an interview.  However, this person was not who he/she claimed.  This person (unsuccessfully) tried to hack into my computer.  Details below:

——————————————————
From: greg.fayle@asia.com
To:
Date: Wed, Mar 10, 2010 at 2:05 AM
Subject: interview request

Dear Curtis Melvin,

My name is Greg Fayle, from SBS Radio
Australia’s program World View.
Would you have some time to do a short
interview on the latest developments regarding
Northeast asia and NK situation please?

I’m looking forward to hearing from you

Paper for Interview

Warm
regards,
Greg Fayle

Greg Fayle
Producer
SBS Radio World View
PO Box 290
South Melbourne VIC 3211
Tel: (03) 9749 2421
——————————————————

The “Paper for interview” was an attached PDF document that hid a virus.  Luckily it did not infect my computer.

Here is what  my friend tells me about the email itself — it did not come from Australia:

inetnum:      222.96.0.0 – 222.122.255.255
netname:      KORNET
descr:        KOREA TELECOM
descr:        Network Management Center
country:      KR
admin-c:      DL248-AP
tech-c:       GK40-AP
remarks:      ***********************************************
remarks:      KRNIC of NIDA is the National Internet Registry
remarks:      in Korea under APNIC. If you would like to
remarks:      find assignment information in detail
remarks:      please refer to the NIDA Whois DB
remarks:      http://whois.nida.or.kr/english/index.html
remarks:      ***********************************************
status:       Allocated Portable
mnt-by:       MNT-KRNIC-AP
changed:      hm-changed@apnic.net 20031027
changed:      hm-changed@apnic.net 20041007
source:       APNIC
person:       Dong-Joo Lee
address:      128-9 Yeong-Dong Jongro-Ku Seoul
address:      Network Management Center
country:      KR
phone:        +82-2-766-1407
fax-no:       +82-2-766-6008
e-mail:       ip@krnic.kornet.net
e-mail:       abuse@kornet.net
nic-hdl:      DL248-AP
mnt-by:       MAINT-NEW
changed:      hostmaster@nic.or.kr 20061010
source:       APNIC
person:       Gyung-Jun Kim
address:      KORNET
address:      128-9, Yeong-Dong, Jongro-Ku
address:      SEOUL
address:      110-763
country:      KR
phone:        +82-2-747-9213
fax-no:       +82-2-3673-5452
e-mail:       ip@krnic.kornet.net
e-mail:       abuse@kornet.net
nic-hdl:      GK40-AP
mnt-by:       MNT-KRNIC-AP
changed:      hostmaster@nic.or.kr 20061009
source:       APNIC
inetnum:        222.96.0.0 – 222.122.255.255
netname:        KORNET-KR
descr:          Korea Telecom
country:        KR
admin-c:        IA9-KR
tech-c:         IM9-KR
status:         ALLOCATED PORTABLE
mnt-by:         MNT-KRNIC-AP
remarks:        This information has been partially mirrored by APNIC from
remarks:        KRNIC. To obtain more specific information, please use the
remarks:        KRNIC whois server at whois.krnic.net.
changed:        hostmaster@nic.or.kr
source:         KRNIC
person:         ijeksolrusyun a
descr:         aijeksolrusyun
descr:         4cheung jaehyunbilding 230beonji jongro6ka jongroku
descr:         110-126
country:        KR
phone:         +82-2-3676-7100
e-mail:         kimyg09@kt.co.kr
nic-hdl:        IA9-KR
mnt-by:         MNT-KRNIC-AP
changed:        hostmaster@nic.or.kr
source:         KRNIC
person:         IP Manager
descr:         DACOM Corporation
descr:         Hangangno1Ga, Yongsan-gu, Seoul
descr:         65-228DACOM Bldg.
descr:         135-987
country:        KR
phone:         +82-2-2089-7755
fax-no:         +82-505-888-0706
e-mail:         ipadm@nic.bora.net
nic-hdl:        IM9-KR
mnt-by:         MNT-KRNIC-AP
changed:        hostmaster@nic.or.kr
source:         KRNIC

Here is what my friend tells me about the virus–it was pretty sophisticated:

To analyze the PDF  file (which contained the virus), we used scripts to parse through and pick out sections of the code that had Javascript (the virus) embedded in it.  We received an error parsing the /FlateDecode filter sections of the PDF. This section of the document is where the compressed Javascript (virus) and other embedded objects would live, and it has different object and reference pointers. We found that the text section of the code instead of starting with /FlateDecode started with [null character] latedecode. We believe this was done intentionally to make de-obfuscation and analysis by a novice more difficult. We used a Hex Editor to correct the null character byte and make it an ASCII F. Once this was done we were able to see heavily obfuscated javascript and pull it out of the document.

The javascript code contained two well known PDF exploits, one for Reader version 8 and another for Reader version 9. The virus was structured this way because most people use one of these versions of Reader to view PDF documents. One other interesting thing to note was that the PDF document itself was blank.

Here is what we know about the payload from behavioral analysis. Once the PDF runs, it will execute the payload and instruct Adobe’s internal updater (update.exe) to download a file from a non-Adobe owned DNS name which resolves to an IP address in Malaysia. All of the attacking code references the same DNS names. Once downloaded this file will sit on the system and acts as a second stage (or stager) for the additional files to be downloaded. So in summary, the first stage was the initial payload in the PDF shellcode.  This first stage downloads a secod stage program which in turn downloads (we believe) a ‘rootkit’ before deleting itself. This leftover ‘rootkit’ is how the attackers would maintain full command and control of the system.

We visited the website from which the files were to come and found a default instance of Apache and cPanel–so we can assume one of two things: First, whoever administers this server probably doesn’t realize it is being used in this fashion (it was probably compromised by the attackers). Second, perhaps this is the attacker’s server and they want to throw us off by throwing up a cPanel install so we’ll think it’s a compromised host. We think the first scenario is more likely.

The files themselves that come after do behave in a ‘rootkit’ like fashion. What we have observed is that they install themselves in the %WINDOWS%\System32 directory. They modify the registry to allow themselves to be used as a system service (this is done through the second stage payload); they hide their existence from view once they are installed (total rootkit behavior); and they start to call out to the server for additional commands. We noticed that these additional commands were not actually coming back as 200 OK status messages, but instead where coming back as 404 NOT FOUND HTTP messages. This could mean that the reference files have been removed, or it could mean that the 404’s are acting as a beacon.  We are not sure which scenario is the case here at this time.

Also worth noting, the second stage payload prevented hooking with a debugger for analysis during runtime and also prevented analysis through virtual machines. The file also leveraged potential DLL Injection to make other executables run commands on its behalf. This means that it would be obscured from routine detection.  We ran the final rootkit executable through a debugger for static analysis and noticed code sections that contained messages within the application stack like “installation as a system service”, “calls to winspool (which is the library for printing and potentially document creation?)”, “calls to imm32.dll (which could be used for keylogging)”, and some very interesting UNICODE characters that we are still deciphering.

As you can tell, we are still conducting additional research and do not want to reveal the exact location of where we have seen this code before. What we can say is that a quick Google search for this code snippet revealed few results with the same region of the world.  In conclusion, I must say that this was not an amateuristic attack–these people were good. But certain things don’t make sense and we are still looking at the file.

According to the Associated Press (via Los Angeles Times):

The North Korean’s note, scrawled in pen, was simple: “I want to go to South Korea. Why? To find freedom. Freedom of religion, freedom of life.”

The ex-logger, on the run from North Korean authorities, handed the note over to a South Korean missionary in the Russian city of Vladivostok last week in hopes it would lead to political asylum.

Just before he was to meet Thursday with the International Organization for Migrants, a team of men grabbed him, slapped handcuffs on him and drove off, rights activists in Moscow said Friday. He was spirited away to the eastern port city of Nakhokda, where he is sure to be handed back over to North Korean officials and repatriated to his communist homeland, activists said in Seoul.

Police in Vladivostok refused to comment. A senior South Korean diplomat in Vladivostok said he had no information. Officials from the U.S. consulate in Vladivostok could not be reached for comment.

The 51-year-old would be the third North Korean logger in Russia in a week to make a bid for asylum. On March 9, two other North Koreans who had fled their jobs as loggers managed to get into the South Korean consulate in Vladivostok.

Russia’s RIA Novosti news agency reported last week that two North Koreans climbed a fence, ran past the guards and entered the consulate, saying they wanted political asylum. ITAR-Tass carried a similar report.

The incidents focused attention on the precarious existence of tens of thousands of North Koreans sent by the impoverished regime to work in neighboring Russia.

Russian government figures from 2007 put the number of North Korean laborers at 32,600, most of them working in logging in the remote east.

The Rev. Peter Chung, a Seoul-based activist, said there are about 40,000 North Korean loggers in Russia, but that some 10,000 of them have fled their work sites. Some are finding work as day laborers while others are in hiding as they try to map out how to win asylum in foreign diplomatic missions.

The North Korean described the conditions as unbearable. His government took half his meager wages, while the North Korean company operating the logging camp took 35 percent. He kept just 15 percent — about $60 a month — an arrangement that rendered him “virtually a slave,” he told activists.

He eventually fled the logging camp, taking odd jobs to survive. He also became a Christian, Chung and Kim Hi-tae said, which could draw severe punishment, even execution, back home.

The successful asylum bid of two other former North Korean loggers inspired Kim to make a similar attempt, Chung said.

Previous posts on the North Korean loggers in Russia can be found here. More here. And here. And here.

Read the full story below:
3rd North Korean logger attempts to defect in Russia, propelled by dream of ‘freedom of life’
Associated Press (via Los Angeles Times)
Kim Kwang Tae
3/19/2010

This weekend Kim Jong Il attended a mass rally in Hamhung to celebrate the re-opening of the 2.8 Vinalon Complex.  This is the first mass rally (of which I am aware) that he has attended outside of Pyongyang (Kang Chol Hwan agrees).  

According to Yonhap:

North Korean leader Kim Jong-il attended a massive rally celebrating the reopening of a long-suspended factory, state media reported Saturday, a rare move that appears aimed at appeasing public sentiment worsened after the regime’s currency reform.

North Korea often organizes such pro-government rallies, forcing citizens to turn out to mark major state events including the country’s launch of a long-range rocket and recent nuclear test. But Kim has rarely attended such rallies, limiting his appearances only to military parades or ceremonies to welcome key foreign guests.

Leader Kim and top aides attended the 100,000-strong rally held in Hamhung to celebrate the reopening of the February 8 Vinalon Complex in the northeastern city, Pyongyang’s Korean Central TV Broadcasting Station and other state media reported.

The move appears aimed at showing North Koreans that their leader is focusing on the economy as public sentiment has deteriorated in the wake of the government’s currency redenomination. The currency reform reportedly disrupted the already troubled economy, prompting senior officials to apologize and Kim to sack those in charge.

Kim’s attendance in the rally also reflects his strong interest in the vinalon factory that resumed operation last month after shutting down 16 years earlier. Vinalon, an artificial textile similar to nylon, was invented in North Korea and is used in many of the country’s textiles.

According to state media, Kim visited the factory twice last month, and sent a thank-you letter to officials and workers involved in the reconstruction. The totalitarian regime also decorated about 2,400 people for their contribution to the factory’s reopening.

Mr. Kim stood on a balcony on the Hamhung Grand Theater and faced North East towards the monument in the plaza square:

Here are some photos of the rally: photo 1, photo 2, photo 3, photo 4.

Josh found a Youtube video of the rally here.  Apologies to readers in China.

The Febuary 8 Vinalon Complex is located here.  It has been featured quite frequently in DPRK media recently.  Mr. Kim just participated in an inspection tour of the facility on February 15th: Youtube video here.

Here is the Wikipedia blurb on Vinalon:

Vinalon is a synthetic fibre, produced from polyvinyl alcohol using anthracite and limestone as raw materials. Vinalon was first developed by the Korean scientist Ri Sung Gi at the Takatsuki chemical research institute in 1939. The fibre was largely ignored until Ri defected to North Korea in 1950. Trial production began in 1954 and in 1961 the massive February 8 Vinalon Complex was built in Hamhung.[citation needed] Its success and widespread usage in North Korea is often pointed to in propaganda as an example of the success of the juche philosophy. Hamhung remains a major production centre for vinalon; in 1998, a vinalon factory opened up in South Pyongan.  Vinalon, also known as Juche fibre, has become the national fibre of North Korea and is used for the majority of textiles, outstripping fibre such as cotton or Nylon, which are only produced in small amounts in North Korea. Other than clothing, Vinalon is also used for canvas shoes, ropes and quilt wadding. Vinalon is resistant to heat and chemicals but has numerous disadvantages: it is stiff, uncomfortable, shiny, prone to shrinking and difficult to dye.

NTI has much more substantive break down of vinalon and February 8 Complex—and maybe points to why this factory is getting so much attention.  Read the NTI summary here.

Here are Kang Chol Hwan’s thoughts.

The DPRK also produces vinalon at the Sunchon Vinalon Complex–also known as the April 25 Vinalon Complex.  It is located here. More about it here.