DeSpooking RedStarOS (Removing Malicious Components)

Overview

The video reviews RedStar OS, a Linux distribution described as being based on Fedora and reportedly used as the main OS in North Korea. The speaker argues it was modified from Fedora to include malicious components/tracking, and presents a “de-spooking” guide to disable those components and regain more normal control.

---

Background / rationale (analysis)

RedStar OS is framed as Fedora-based, but allegedly altered with:

• Tracking/malware to monitor citizens and prevent forbidden activity.
• Claims of proprietary OS surveillance (Windows/macOS) prompting interest in open-source alternatives—contrasted with the assertion that North Korea would avoid US/Western backdoors.

The creator emphasizes that RedStar should be used only for experimentation, not as a reliable everyday OS, unless it’s sanitized.

---

UI / desktop modification (“rice”)

• The distro’s desktop can be themed (“iced/riced”) to resemble macOS style.
• The speaker refers to it as the “Kim desktop environment,” describing a KDE appearance styled like a MacBook.

---

Tutorial / guide steps to regain control

1) Become root (admin access)

The guide starts by enabling root user access through the GUI:

• Open the Korean-labeled settings/app folder (wrench/hammer icon).
• Use a command prompt to set up a root shell.

It mentions running a command like su (root shell) and interacting with password prompts in the Korean UI.

2) Switch system language to English

Change language settings for the GUI using commands targeting KDE/global config and locale:

• Replace ko_KP with en_US.
• Mentioned file paths include:
  • /etc/sysconfig/...
  • KDE globals under /usr/share/config/kdeglobals

Some Korean parts may only fully update after a reboot.

3) Enable internet access (DHCP + networking changes)

• First confirm DHCP is enabled (the speaker references confusion during install steps).
• Then modify iptables, because the distro is described as blocking outgoing traffic:
  • Remove or reset iptables rules (e.g., rm /etc/sysconfig/iptables).
  • Restart firewall services (e.g., service iptables restart).
• Perform a reboot to apply changes.

4) Switch browser language to English

Even after system language changes, the browser remains in Korean. The speaker changes the browser settings via tabs/menus to switch to English.

5) Practical limitation: old browser / HTTP-only

• The browser appears outdated (compared to an older Firefox).
• It is limited to HTTP sites, reducing usability (e.g., issues with common search sites depending on HTTPS availability).

---

“De-spooking” / removing malicious components (core review/fix)

After localization/networking, the video focuses on removing alleged threats. The speaker claims remaining control limits include:

• SELinux, still enabled with restrictive rules.
• A suspicious “virus scanner”, believed to be a fake antivirus.
• Watermarking/forensics functionality:
  • Adds a unique identifier/tag into image (and possibly text) metadata (e.g., EXIF).
  • Intended to track which files were shared/downloaded, linking content back to the source.

---

Script-based remediation from GitHub

The guide references a GitHub project/script:

• red star tools / diffuse dot sh (name as heard in subtitles).

Getting the script is described as difficult because:

• The site doesn’t load over HTTP (the browser can’t access it).
• curl also can’t retrieve it.

---

Workaround: paste/ghostbin + manual editing

The speaker uses a text-hosting workaround:

• Upload/copy the script into a paste service (attempts ghostbin, then falls back to pastebin).
• Adds security exceptions to access the paste service.
• Then edits/creates a local file using terminal tools (e.g., vi) and runs it as root.

---

What the script does (explicitly stated outcomes)

The video states the script performs actions including:

• Disable SELinux
• Kill/stop security daemons (e.g., security d)
• Kill the RT scan (virus/scanner process)
• Kill/replace specific programs/libraries, including replacing libos
• Disable auto-start for some malicious components
• Reboot after changes

---

Main speakers / sources

• Main speaker: the YouTube narrator (host) giving the walkthrough/commands and describing research findings.
• Primary external source referenced: a GitHub repository/project labeled “Red Star Tools” with a script diffuse.sh (also referenced as “take sh ixx” in subtitles).
• Secondary references (context): the host’s earlier RedStar OS video and notes/blog links mentioned at the end (not detailed in subtitles).