Infosec researcher gets in with admin/password creds

May 31, 2016 11:11 GMT  ·  By

Towards the end of last week, Internet analytics service Dyn spotted what seemed to be a Facebook clone hosted on a North Korean server, at the starcon.net.kp URL.

During the weekend, the site was taken down, after Scottish security researcher Andrew McKean discovered that the admins forgot to change its default credentials.

North Korea's Facebook clone was running on phpDolphin

Since the portal was running on phpDolphin, a self-hosted platform for building social networks, McKean tried the platform's default credentials, which worked and granted him access to the admin panel.

The researcher didn't stay idle and started taking screenshots, which he shared on social media and with reporters, and also began modifying the site's ads, writing in one of them, "Uh, I didn't create this site just found the login.. @mckeany_"

After having a few laughs, McKean said that someone took the reins of site from him and later redirected the website's URL to a YouTube video, before being taken down for good.

It is yet unknown if the government was behind it, but it's possible

Dyn and McKean both claimed there's no real evidence to sustain the theory that this is the work of the North Korean government.

Dyn did say that the site's IP address is hosted in North Korea, a country with very strict Internet access rules, even stricter domain registration policies, and very few proper Web hosting systems outside government facilities. Nevertheless, Dyn also pointed out that all other North Korean government websites are hosted in China, and not inside the country, so this might strike someone as odd.

During its short lifespan, the site had a lot of placeholder text displayed in many of its sections. Screenshots taken by McKean reveal little to no activity. Furthermore, the fact that non-Korean users could register on the site also means there was no firewall filter to prevent external users from accessing it, a slip-up we wouldn't expect from the North Korean government. All of these lead to the obvious conclusion that the site was still in development, and not quite yet a full-blown "Facebook clone."

Screenshot of the site's admin panel
Screenshot of the site's admin panel

Photo Gallery (2 Images)

The North Korean Facebook clone landing page
Screenshot of the site's admin panel
Open gallery