Ein nordkoreanischer Eindringling wurde aufgrund einer Verzögerung bei der Arbeit in der IT-Abteilung von Amazon ertappt – eine Tasteneingabe von 110 ms löst Alarm aus, wenn es um den tatsächlichen Standort geht
https://www.tomshardware.com/tech-industry/cyber-security/north-korean-infiltrator-caught-working-in-amazon-it-department-thanks-to-lag-110ms-keystroke-input-raises-red-flags-over-true-location
26 Kommentare
Yeah, they’re still at 56k in North Korea, got caught immediately 😝
This also confirms they’re using keyboard monitoring software – so kind of a good and bad story.
How the hell did they get that far in the hiring process if it’s a US based position ?
Did they have someone show up with a fake passport, I9 and work permit or is Amazon just verifying this stuff online ?
110ms is what I get playing WoW from south America
> Amazon reckoning it is seeing a 27% QoQ uplift in North Koreans trying to get into the Amazon corporation.
Funny to see this stated this way. I’m used to seeing „27% QoQ uplift in revenue in whatever division“.
[deleted]
Shit like this is another reason why remote work is so cooked. RIP.
With so many people willing to be on-site in this job market to even have a job, companies don’t want to to deal with this BS.
I remember a time at my last company where a particular piece of software logged every keystroke to a plaintext file. Because that’s never a bad idea. /s
Better than getting capped by a camper I guess
Amazon = spy this is will sit very well globally
What tool were they using to capture the latency of the keyboard?
Oh! Must typer more fast!
I think this article is nonsense and if the security staff in Amazon really said this then it’s even more nonsense.
The 110ms keystroke measured between what and what? If the laptop is controlled remotely? I can’t wrap my head around this stupid statement
How can the keystroke and the input be detected as delayed? The difference on camera vs the actual key entered? Because if he’s working remotely the PC will detect the stroke when it detects it so how would software capture that?
Note to North Korea: make sure keystroke lag time < 15 ms
Lag between what?
Not like its possible to measure lag between keypress and characters appearing on screen.
I knew of six or so people at a big tech company that were not working from where they were listed. I taught them stuff, wrote them AI models, worked there longer than they did and was moved internally under them. Then the exexs above ended up laying me off, since those people were my middle management, and I wasn’t part of their shady clique.
E.g. one guy claimed to be in Poland, actually he lived outside a van in Oregon using starlink.
Not sure why I’m sharing this other than to say, this is guaranteed to be happening, all of the time.
Can someone explain how this works? How would they be able to tell when the key is physically pushed?
Also if it was being remote controlled from NK, wouldn’t whatever software be flagged in the Amazon laptop?
companies are going to start using this as an excuse to more aggressively bring people back into the office.
„well if we can’t see you in person, how do we know you’re not a foreign threat actor?“
> It turns out that the DPRK had access to this Amazon laptop located in Arizona. A woman found to be facilitating this fraud on behalf of North Korean imposter workers was sentenced to several years in prison earlier this year.
The penalty really isn’t high enough for this.
I don’t think they only “routered” the traffic. The correct term is “routed”.
If the traffic is only routed through that pc in Arizona then it’s easier to find out the source of packets on that Arizona pc than to measure the latency. I think with an operation of such scale the North Korean government would be more careful.
Additionally, does their software measure the stroke timestamp at the origin? In North Korea? This isn’t a monitoring software, this is quantum hacking software lol!
Trust me this is a bogus article
110ms of lag occurred between what two events? I read the article and I still can’t puzzle it out.
Kinda pathetic on Amazon IT to have caught this because of the delay when they’re recording the keystrokes. Not that it’s being sent half the world away to another location first.
Lock these people up. Punishment should justify a reason not to do it.
What was he infiltrating? Sounds like they outsourced work abroad. Was he or she doing the work well?
How does LAG prove location?
You don’t know when he started typing and the only “lag” visible to the employer is from network so everything will have a latency… but again it’s not relevant or useful since you type at X chars per second.
This seems made up. Like you’d need to know they saw whatever they were responding to in a timely
Fashion.
Not replying for 100ms to a say DM message gives me no indication they are in NK