Comment on North Korean infiltrator caught working in Amazon IT department thanks to lag — 110ms keystroke input raises red flags over true location

• sqgl@sh.itjust.works ⁨15⁩ ⁨hours⁩ ago

  So they cannot simply use a generic remote desktop? The infiltrator has to use some Amazon remote desktop software?

  source

  • Brkdncr@lemmy.world ⁨13⁩ ⁨hours⁩ ago

    Keyboard input over kvm is pretty awful. It’s possible the kvm software was enforcing a delay between keystrokes to make sure they are delivered in order. Seeing keys consistently pressed with 500ms separation would be odd.

    source
  • Darkassassin07@lemmy.ca ⁨14⁩ ⁨hours⁩ ago

    Perhaps something like time between key pressed and key released being abnormally high? Or erratic mouse movement?

    I know whenever a PC I’m using is being remotely controlled, the mouse jerks around instead of moving smoothly around the screen. I’d imagine that gets even worse with ping/more layers of remote connections.

    source

    • sqgl@sh.itjust.works ⁨14⁩ ⁨hours⁩ ago

      Yes but you need access to the culprit’s computer for the lag measurement.

      source

      • porcoesphino@mander.xyz ⁨13⁩ ⁨hours⁩ ago

        Amazon security experts took a closer look at the flagged ‘U.S. remote worker’ and determined that their remote laptop was being remotely controlled – causing the extra keystroke input lag.

        With access to the final remote desktop, and access to the workers laptop you know the delay from these two so if there is more delay, then you can infer it’s coming from somewhere else? I’m sure there are more paths too but access to the North Koreans hardware doesn’t seem required

        source

        • -> View More Comments
      • Darkassassin07@lemmy.ca ⁨13⁩ ⁨hours⁩ ago

        No. I’m talking about measuring the time in-between inputs being received over the remote connection. Purely observation from the receiver side of the connection.

        Network overhead + dropped and re-sent packets, introducing unusual lag in between commands/keystrokes.

        A key being pressed and key being released are two separate events that get transmitted separately and usually happen pretty close together. That gap getting larger, due to the long-distance connection introducing lag, could be what they were looking at.

        source