No. I’m talking about measuring the time in-between inputs being received over the remote connection. Purely observation from the receiver side of the connection.
Network overhead + dropped and re-sent packets, introducing unusual lag in between commands/keystrokes.
A key being pressed and key being released are two separate events that get transmitted separately and usually happen pretty close together. That gap getting larger, due to the long-distance connection introducing lag, could be what they were looking at.
porcoesphino@mander.xyz 17 hours ago
With access to the final remote desktop, and access to the workers laptop you know the delay from these two so if there is more delay, then you can infer it’s coming from somewhere else? I’m sure there are more paths too but access to the North Koreans hardware doesn’t seem required
partofthevoice@lemmy.zip 6 hours ago
also, time between key presses on the compromised machine could indicate network lag to what is actually a Remote Desktop.
porcoesphino@mander.xyz 17 hours ago
Also worth pointing out that this was a flagged employee (probably from something like data access logs) so they would be under more scrutiny and surveillance than the average employee