North Korean infiltrator caught working in Amazon IT department thanks to lag — 110ms keystroke input raises red flags over true location

Comments

• SomeRandomNoob@discuss.tchncs.de ⁨11⁩ ⁨hours⁩ ago

  To me that means Amazon can and will monitor every keystroke of every employee.

  source

  • Leather@lemmy.world ⁨6⁩ ⁨hours⁩ ago

    This is the real story.

    source
  • Templar238@lemmy.zip ⁨11⁩ ⁨hours⁩ ago

    Worked at Google and can confirm if you typed your password into a non org website you were flagged and asked to reset your PW. The problem is some of the training websites Google used and were Google branded were apparently non org websites. But it shows they are looking for “certain key strokes”

    source

    • fonix232@fedia.io ⁨10⁩ ⁨hours⁩ ago

      My employer does the same over a proxy. Luckily it can't breach HTTPS, but it was annoying to set all my APs and router and switches and other network nodes to HTTPS just because the damn thing would block the site the moment I sent my password in cleartext to a local device...

      source

      • -> View More Comments
  • Quexotic@infosec.pub ⁨8⁩ ⁨hours⁩ ago

    I mean, more like does and has been, but I guess that’s just semantics. Evil gon be evil.

    source
  • sqgl@sh.itjust.works ⁨10⁩ ⁨hours⁩ ago

    It wasn’t the lag from the employee’s computer to Amazon which was being monitored.

    It was the lag from the hacker to the employee. Amazon could not have monitored the hacker’s computer.

    source
• MonkderVierte@lemmy.zip ⁨2⁩ ⁨hours⁩ ago

  I would manage that lag. Partly ground partly open air landline to a farm, powerline over a wire that makes the receiver give up all few days.

  source
• sqgl@sh.itjust.works ⁨11⁩ ⁨hours⁩ ago

  How did Amazon know the lag?

  source

  • ShellMonkey@piefed.socdojo.com ⁨3⁩ ⁨hours⁩ ago

    This is a company that's been reported to use the dwell time of you mouse over a product as a potential indicator of interest. Something like a Citrix remote desktop is extremely chatty trying to keep the origin and server in sync with every move of a mouse or keystroke. If the ACKs from the origin confirming the receipt of screen change data took an abnormally long time it could show in system performance metrics pretty easily.

    source

    • MonkderVierte@lemmy.zip ⁨2⁩ ⁨hours⁩ ago

      to use the dwell time of you mouse over a product as a potential indicator of interest

      That’s common internet marketing practice and the main reason to use an adblocker.

      But didn’t they start to eye-track their drivers? Stuff like that.

      source
  • credo@lemmy.world ⁨11⁩ ⁨hours⁩ ago

    Probably a remote kvm system with QOS monitoring. Many secure systems won’t let you connect directly to sensitive resources from your personal workstation.

    source

    • sqgl@sh.itjust.works ⁨10⁩ ⁨hours⁩ ago

      So they cannot simply use a generic remote desktop? The infiltrator has to use some Amazon remote desktop software?

      source

      • -> View More Comments
• plz1@lemmy.world ⁨7⁩ ⁨hours⁩ ago

  I’m kind of surprised the latency was that low. Unless the NK “employee” was spoofing being in SK or something.

  source

  • W3dd1e@lemmy.zip ⁨7⁩ ⁨hours⁩ ago

    The article says he was remotely controlling a company laptop located in Arizona. A woman located in AZ was facilitating the NK workers, but she was recently charged with the fraud.

    source
  • dan@upvote.au ⁨6⁩ ⁨hours⁩ ago

    Hong Kong to Los Angeles is around 70ms latency (140ms round trip) so I’m not too surprised.

    source
  • goatinspace@feddit.org ⁨7⁩ ⁨hours⁩ ago

    How was he hired 🤯 ? It’s a skill

    source

    • atrielienz@lemmy.world ⁨4⁩ ⁨hours⁩ ago

      There was a scam going where they would offer for someone to apply for a role and use that good candidates clean information to get it v they would do the work and split the pay with the person who’s info they used.

      In exchange that person would get “job experience”, the perks of WFH, and the ability to hold down more than one of these figurehead jobs simultaneously.

      source

      • -> View More Comments
    • RedGreenBlue@lemmy.zip ⁨6⁩ ⁨hours⁩ ago

      Probably worked for next to no pay.

      source
• vk6flab@lemmy.radio ⁨11⁩ ⁨hours⁩ ago

  And now you know why you should encrypt your data on any cloud provider.

  source

  • Saapas@piefed.zip ⁨7⁩ ⁨hours⁩ ago

    To save it from North Koreans?

    source

    • vk6flab@lemmy.radio ⁨6⁩ ⁨hours⁩ ago

      … and anyone else who should not have access to your data.

      source

      • -> View More Comments
• muusemuuse@sh.itjust.works ⁨7⁩ ⁨hours⁩ ago

  Let’s see if Amazon gets trump to yell at Un.

  source