{"id":23644,"date":"2025-07-20T11:22:15","date_gmt":"2025-07-20T11:22:15","guid":{"rendered":"https:\/\/www.newsbeep.com\/us\/23644\/"},"modified":"2025-07-20T11:22:15","modified_gmt":"2025-07-20T11:22:15","slug":"n-korean-smartphone-app-evolved-from-simple-id-tool-to-permanent-surveillance-platform","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/us\/23644\/","title":{"rendered":"N. Korean smartphone app evolved from simple ID tool to permanent surveillance platform"},"content":{"rendered":"

Daily NK has obtained both the original and upgraded versions of an app North Korea uses to identify mobile phone users. A comparison of the two versions shows that the app transformed from a basic data collection module into a comprehensive surveillance platform<\/a> that permanently monitors smartphones.<\/p>\n

The core function of the app \u201cMobile User Identification,\u201d obtained by Daily NK, is to issue and verify individual \u201cdigital numbers\u201d that the state manages for every smartphone<\/a> user and device<\/a>.<\/p>\n

This isn\u2019t an ordinary app that users download and install themselves. The app remains hidden\u2014it doesn\u2019t even appear in the app folder\u2014and quietly activates when other service apps, such as games or e-payment platforms, require subscriptions or verifications. The app works similarly to how financial apps in South Korea<\/a> require users to verify their identities using digital certificates or mobile phone verification.<\/p>\n

After verification, the server assigns a 10-digit caller ID, or CID, to the user and device. Once issued, this number becomes a permanent \u201cdigital citizen ID number\u201d linked to the user\u2019s personal data, SIM card International Mobile Subscriber Identity (IMSI), and device International Mobile Equipment Identity (IMEI).<\/p>\n

When users later subscribe to other apps, such as the Samhung Wallet, they must enter the CID, giving the state the technical foundation to comprehensively track and manage the user\u2019s personal activity across all digital services.<\/p>\n

From simple module to surveillance platform<\/p>\n

Daily NK obtained versions 1.0 and 1.0.2 of the app\u2014the first digit indicates the major release, the second the minor release, and the third a patch. While the jump from version 1.0 to 1.0.2 might suggest minor improvements, analysis revealed substantial changes that fundamentally altered the app\u2019s identity.<\/p>\n

Version 1.0 didn\u2019t require any internet access permissions. It used only SMS communication functions in a simple and discreet manner. When users needed verification, the app collected and encrypted the device\u2019s unique IMSI and other key data, then sent it in \u201cdata SMS\u201d format\u2014invisible to the user\u2014to North Korea\u2019s specific server number (+8501950003). The amount of data that could be transferred was limited, creating clear restrictions for transmitting complex information<\/a> in real-time.<\/p>\n

However, version 1.0.2 underwent dramatic changes\u2014so significant that it can now be called a \u201cplatform.\u201d The most important change is that it adopted the internet as its primary communication channel. This means the \u201cinternet access permission\u201d requested by the app is for accessing North Korea\u2019s closed national intranet, not for connecting to the global internet.<\/p>\n

Expanded permissions and capabilities<\/p>\n

Version 1.0.2 requests several concerning permissions:<\/p>\n

INTERNET: The primary channel for exchanging data with servers. This represents the biggest change from version 1.0, which required no such permissions.<\/p>\n

READ_PHONE_STATE: Enables user identification by reading the smartphone\u2019s unique ID numbers, such as the IMSI.<\/p>\n

RECEIVE_BOOT_COMPLETED: Allows continuous surveillance by automatically launching the app whenever the phone is turned on.<\/p>\n

WRITE_EXTERNAL_STORAGE: Permission to read or write files on the device, suggesting the ability to extract data or download additional files.<\/p>\n

SEND_SMS \/ RECEIVE_SMS: Backup communication channel when internet communication isn\u2019t possible.<\/p>\n

Analysis of the internal code, which underwent obfuscation, revealed that the app uses \u201cryomyong.com\u201d as its specific API for communication. This not only provides intranet access but also strictly controls communications, with the app designed to communicate securely only with authorized servers using a public key infrastructure (PKI) that trusts only private certificates issued by the state.<\/p>\n

Always-on surveillance<\/p>\n

The updated app now runs constantly, representing a complete transformation in its nature. The app automatically launches whenever the phone is turned on and requests permission to read and write files stored on the device. Essentially, the function extends far beyond verification and can potentially spy on the phone, accessing files while permanently residing on the device.<\/p>\n

The updated version is no longer a passive \u201cmodule\u201d that runs only when external services need it, but an active \u201csurveillance platform\u201d embedded on the device that carries out its own objectives.<\/p>\n

The updated version demonstrates North Korean authorities\u2019 goals to comprehensively manage all digital activity by citizens using \u201cdigital IDs\u201d issued by a central server. This can be seen as building robust infrastructure for digital population control.<\/p>\n

Version comparison<\/p>\n

Feature
\nVersion 1.0 (Simple Module)
\nVersion 1.0.2 (Surveillance Platform)<\/p>\n

Core Goals
\nIssue single-use device registrations and CIDs
\nContinuously manage IDs and verifications<\/p>\n

Execution
\nPassively runs when called by external apps
\nAutomatically starts at boot and runs in background<\/p>\n

Communication
\nExclusively uses SMS (discrete, low bandwidth)
\nPrimarily internet with SMS fallback (high functionality)<\/p>\n

Security
\nBasic data hash (SHA256)
\nIndependent PKI, native codes, and AES encryption<\/p>\n

Data Access
\nIMSI and basic personal data
\nICCID support and file system access<\/p>\n

Dependencies
\nStandard Android library
\nStandard library and native library<\/p>\n

Server Endpoint
\nPhone number (+8501950003)
\nhttps:\/\/www.ryomyong.com\/?page=cid.gen&action=reg&cert=p12&data=<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"Daily NK has obtained both the original and upgraded versions of an app North Korea uses to identify…\n","protected":false},"author":2,"featured_media":23645,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[41],"tags":[165,74],"class_list":["post-23644","post","type-post","status-publish","format-standard","has-post-thumbnail","category-mobile","tag-mobile","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/23644","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/comments?post=23644"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/23644\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media\/23645"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media?parent=23644"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/categories?post=23644"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/tags?post=23644"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}