A North Korean imposter was uncovered, working as a sysadmin at Amazon U.S., after their keystroke input lag raised suspicions with security specialists at the online retail giant. Normally, a U.S.-based remote worker’s computer would send keystroke data within tens of milliseconds. This suspicious individual’s keyboard lag was “more than 110 milliseconds,” reports Bloomberg.
Amazon is commendably proactive in its pursuit of impostors, according to the source report. The news site talked with Amazon’s Chief Security Officer, Stephen Schmidt, about this fascinating new case of North Koreans trying to infiltrate U.S. organizations to raise hard currency for the Democratic People’s Republic of Korea (DPRK), and sometimes indulge in espionage and/or sabotage.
92 Comments
JoeBidet@lemmy.ml · 255 pts · 236d
Sounds much better than "Amazon surveils keystrokes of its IT workers"!
stoly@lemmy.world · 29 pts · 235d
This was also my takeaway. Sounds like a security nightmare if they are logging any data.
kieron115@startrek.website · 7 pts · 235d
Normal ass websites will monitor user inputs to do things like profile users. I’m pretty sure those “click to show youre not a robot” captchas actually capture how your mouse moves to the box, for example. It’s not that crazy honestly.
lka1988@sh.itjust.works · 1 pts · 234d
If you use a company-provided computer for work, then it's safe to assume they're already doing that.
stoly@lemmy.world · 1 pts · 234d
The problem is that you don’t want to record important information like passwords so if they did log them, it’s another possible vector of loss. I e if someone got into that copy of the data
lka1988@sh.itjust.works · 1 pts · 234d
That's a valid point.
Tangent5280@lemmy.world · 7 pts · 235d
Well it isn't paranoia if North Korean impostors really are working in your company.
Evotech@lemmy.world · 6 pts · 234d
Yeah, hate it all you want. But risk scales with the amount of employees you have. At the scale of Amazon you have to do literally everything to minimise risk.
SpaceNoodle@lemmy.world · 154 pts · 236d
How am I the first person to ask why they're measuring the latency on everyone's keystrokes?
a1studmuffin@aussie.zone · 79 pts · 236d
Given they've had 1800 recent infiltration attempts, I understand their suspicion.
PearOfJudes@lemmy.ml · 65 pts · 235d
DylanMc6@lemmy.ml · 3 pts · 235d
the amazon workers DOESN'T deserve to get pushed around by jeff bezos - the best way to remedy this is by educating these workers on socialism and organizing, and give them the tools they need to collectivize the warehouse. seriously!
CanadaPlus@lemmy.sdf.org · 24 pts · 235d
Literally, catching North Koreans might have been the idea. It's become a big issue.
Probably one of the less shocking things they track.
gerowen@piefed.social · 81 pts · 236d
I'm never quite sure how to feel about this. On one hand, if the person just wants to make some money and they're doing the job, why bother them. On the other hand though, I know that anybody who has consistent access to an internet connection in North Korea is almost certainly working for the benefit of the great leader and they aren't actually seeing any money or benefit for themselves. I just hate that the citizens of North Korea have to suffer and be punished because of their asswipe of a leader.
pilferjinx@piefed.social · 70 pts · 236d
When you look at the ISS pics of NK during the night, you get a sense of how bad it is for most of the population.
brbposting@sh.itjust.works · 47 pts · 236d
https://www.38north.org/2023/04/a-fresh-look-at-north-korea-at-night/
dubyakay@lemmy.ca · 34 pts · 236d
Maybe they just really like the Dark Sky initiative.
nomy@lemmy.zip · 19 pts · 235d
An entire country of astronomy nerds sounds like a tourist destination to me!
bold_atlas@lemmy.world · 4 pts · 234d
I like how they point out that tiny batch of lights near the coast are NK fishing boats while all the other massive clusters of lights on the ocean are South Korean, Chinese and Japanese fishing boats illegally using spotlights to attract fish.
Echolynx@lemmy.zip · 1 pts · 234d
UnderpantsWeevil@lemmy.world · -2 pts · 235d
Always curious to hear how NK has no electricity, but they manage to hack the systems of a trillion dollar conglomerate on the opposite side of the Pacific Ocean.
The contradictions abound.
Soulg@ani.social · 6 pts · 235d
Do you seriously not realize that the corrupt dictatorial government might have a bit more quality of life things and resources than the oppressed peasant class?
BanMe@lemmy.world · 3 pts · 235d
I think maybe they're just better about not pointing their lights upward at night
Vorticity@lemmy.world · 3 pts · 235d
You believe that North Korea actually is electrified but they just avoid light pollution? They are among the least electrified countries in the world.
Wispy2891@lemmy.world · 4 pts · 235d
The ironic part is that they're the only country of the world with a drawing of an hydroelectric plant on their emblem
UnderpantsWeevil@lemmy.world · 2 pts · 234d
Wait, are we talking about Korea or Amazon?
Serinus@lemmy.world · 15 pts · 236d
It kind of amazes me they don't have better infrastructure. It's not like they're shy about forced labor.
Honytawk@feddit.nl · 13 pts · 235d
You can only do so much with forced labour. They aren't doing their best, just "enough" to not get punished.
I'm sure plenty of them also use malicious compliance and sabotage stuff to get back at the top brass.
UnderpantsWeevil@lemmy.world · 3 pts · 235d
There's a certain irony in this statement, coming from folks who consume it regularly.
mrgoosmoos@lemmy.ca · 9 pts · 236d
seeing the stars instead of light pollution doesn't sound like a bad thing on its own
NOT_RICK@lemmy.world · 43 pts · 236d
They’re also a security threat. Any opportunity to exfiltrate potentially profitable or leverageable data will be taken. I’d bet they’re used to sniff out vulnerabilities for ransomware attacks too. I definitley identify and agree with the healthy sympathy (I guess empathy if you’re in the states, our leader more than qualifies as an asswipe) for the citizens of North Korea
Socialism_Everyday@reddthat.com · -4 pts · 235d
But thats good, the USA is carrying out genocide in Palestine and is about to invade Venezuela. And Amazon is no saint either.
NOT_RICK@lemmy.world · 3 pts · 235d
The US is enabling and providing political cover for the Palestinian genocide, Israel is carrying it out. I don’t think an invasion of Venezuela is imminent, just the same kind of underhanded manipulation and isolation that has been done to Cuba for the past half century. Agreed Amazon sucks.
None of that changes the fact that only thing that these North Korean tech workers do is help Kim fund his military projects and his Bourgeoisie lifestyle
Socialism_Everyday@reddthat.com · -2 pts · 235d
...and economic support, and military support defending their coastlines and boats, and military support defending them from Iran, and most of the weapons used on Palestinians are of US origin.
Then you'll be probably horrified to learn that US+EU economic sanction have murdered half a million people per year since 1971 per the latest academic health research estimates. This is more death than the deaths from war since 1971 on average.
NOT_RICK@lemmy.world · 2 pts · 235d
I’m aware of all that about Gaza. No excuses from me, I find it horrifying and shameful. Same as far as sanctions go (I do agree with the Russia ones where it’s a tool to get an actual war to end, or sanctions against individuals in certain contexts). I agree with you on the last point too, it’s just that Jeff doesn’t style himself as a hero of the Proletariat. I dunno who’s responsible for more human suffering between the two, but the hypocrisy does piss me off. They can both get fucked as far as I’m concerned.
Socialism_Everyday@reddthat.com · -1 pts · 234d
Good, at least we agree that sanctions against Cuba and Venezuela are horrifying and they murder hundreds of thousands.
My main problem with the big criticism against North Korea is how little we actually know of the country, the level of corruption, and the actual reasons why the people there have a low material standard of living.
North Korea is a reclusive and inwards country not because of a personal idea of the Kim family, but because of its recent history. In the 1950s, North Korea was bombed by the USA with an unimaginable amount of explosives, in one of the most violent and extensive bombing campaigns in human history, to the point that [85% of all buildings in the country were destroyed] (https://en.wikipedia.org/wiki/Bombing_of_North_Korea?wprov=sfla1), and hundreds of thousands if not millions died violent deaths (without counting starvation and disease from the destruction of all infrastructure). The country was quite literally bombed into the stone age.
After being utterly destroyed, when the Korean War froze, North Korea was subjected to an almost complete economic embargo by all nations except the eastern block, so it could rely only in the USSR for trade. As a country without much in the way of arable lands (mountainous and cold) or natural resources (its only reliable energy sources are coal and hydro), it was forced by external forces to adopt its current policy of Juche.
When in 1990 the USSR was dissolved, North Korea, much like Cuba, saw itself entirely isolated from the world, unable to trade with any partner due to the immense economic sanctions it was subjected to for the cardinal sin of being communist. This caused a massive rise in poverty in the country, problems with energy generation, food supplies...
Maybe if North Korea had been allowed to freely trade in the international market to exploit its advantages and cover its disadvantages, it would have thrived much more than it has, and it wouldn't rely so much on state power to secure its own ideological thesis without external interference. Most of what we read about North Korea is false anyway, stuff like the "intergenerational gulags" is literally made up much like the Iraq WMDs.
My point is: the west is entirely responsible for the current state of North Korea, from the entire destruction of the country to its isolation in the international economic sphere. Criticizing from our high point of view the people that have been subjected to millions of deaths from our actions isn't exactly the most honest thing to do, especially when it's done using false stuff like the intergenerational prisons I mentioned. North Korea has a lot of problems, no doubt, but the way to solve these problems is to let them flourish and develop by themselves, not to further continue murdering millions of them through economic sanctions.
someguy3@lemmy.world · 25 pts · 236d
North Korea intentionally does this to get revenue for the state.
Diplomjodler3@lemmy.world · 21 pts · 236d
These people are definitely not there just to make some money. And whatever money they make will be used to prop up the genocidal regime.
Socialism_Everyday@reddthat.com · -2 pts · 235d
Are you talking about the USA Amazon workers propping up the USA genocidal regime, as seen in Palestine? Because, AFAIK, there's no genocide going on as a consequence of North Korea. Care to elaborate?
Diplomjodler3@lemmy.world · 0 pts · 235d
I'd say locking up a substantial part of your population, including their families in murderous gulags amounts to genocide. Oh, and did anybody say Arduous March?
Socialism_Everyday@reddthat.com · 1 pts · 235d
US has highest prison population in the world, 1 in 5 black men go through the prison system. Is that genocide?
This is fox news propaganda, similar level to "weapons of mass destruction in Iraq"
Gulags are just prisons. GULAG is the acronym of the penitentiary system of the USSR.
WoodScientist@sh.itjust.works · 19 pts · 236d
Eh, this doesn't sound like the job you would give someone in a prison camp. You're talking about people that you're allowing to interact and work regularly with foreigners outside the country. That does not sound like the type of position you trust to a political prisoner. That sounds like a position you put someone of high trust. It's probably a pretty cushy job as the standards of North Korea go. Sure beats scratching at dirt or working in some godawful arms factory. It's probably the type of job you need some good family connections in the Party in order to get. Sure, the government takes all the direct monetary benefit of the work, but that is just kindof how Communist systems work. I imagine the people working those jobs have some of the highest standards of living available to people that aren't senior party leadership.
vega208@sh.itjust.works · 1 pts · 235d
wheezy@lemmy.ml · 3 pts · 234d
North Korea is the result of a genocide carried out by Japan during WW2 and the subsequent genocidal bombing campaign of the US during the Korean war. It was then shut off from the rest of the world as a punishment for successfully resisting US and pro Japanese occupation. What type of leadership and society do we expect to grow out of that? Like, honestly, what type of freedom can be given to people when a country is being cut off from the rest of the world by a large military superpower like the US?
I think people have learned a lot in recent years by looking at Gaza and the conditions the US and Israel have placed on the Palestinians there. I think people understand that Hamas and it's leadership are the inevitable result of that type of occupation. I hope people can learn from that and realize that there is not something inferior with a place like North Korea. It's structures of isolation and state control are the inevitable result of the history and current material conditions it faces.
There is a reason that support for Palestine liberation is nearly 100% among the non western world. Because they all see themselves in the Palestinians.
Do I like the leadership of North Korea? No. Do I like the leadership of Hamas? No. But I understand that they won't change until the threat and oppression of outside powers is stopped.
The west fucks with so many countries and then uses the current instability that the west caused as a reason for why they need to fuck with them more. Venezuela being the latest iteration.
Gammelfisch@lemmy.world · 0 pts · 234d
Are you the North Korean Amazon employee? Anyway, North Korea is a CCP vassal state, you invaded South Korea and isolated yourselves.
wheezy@lemmy.ml · 1 pts · 234d
Given that you seem to know a lot about Korean history. Do you think the Jeju Massacre was justified?
Like, we learn about the Boston Massacre and cheer on American revolutionaries. But for some reason a militant response to an oppressive state filled with Japanese loyalist is considered bad when Koreans do it.
South Korea's history is largely that of state oppression and a fascist dictatorship. What in your opinion was the reason the North attacked the South? Do you think events unfolded before that? Or did the North just attack because they wanted to prevent kpop?
Gammelfisch@lemmy.world · 0 pts · 233d
Full support from China to return the entire Korean peninsula under their control as a vassal state.
Socialism_Everyday@reddthat.com · 2 pts · 235d
Then you surely condemn the global sanctions on North Korean economy? Especially given the recent study showing how US+EU sanctions murder half a million people yearly since over 50 years ago.
Wispy2891@lemmy.world · 36 pts · 235d
On one side I feel like "cool, they managed to find a spy on this sophisticated way"
On the other side I'm thinking what kind of intrusive keylogging malware did they install on all their employees laptops...
amzd@lemmy.world · 9 pts · 234d
This article is just building justification for spying on your employees
lka1988@sh.itjust.works · 3 pts · 234d
I mean, if it's a company-owned laptop, they can do whatever the fuck they want with it. I bring a personal laptop to work for browsing and YouTube and whatnot, attached to a VPN.
Echolynx@lemmy.zip · 3 pts · 234d
Way too fucking much.
BurnedDonutHole@ani.social · 34 pts · 235d
North Korea got better ping than mine ahahaha...
CucumberFetish@lemmy.dbzer0.com · 4 pts · 234d
Looking at my 300ms ping with 1500ms jitter....
(Yes, I counted the zeros)
flamingo_pinyata@sopuli.xyz · 24 pts · 236d
I guess this is inevitable at huge companies. Nobody cares about the actual person you're hiring, it's just another position to fill. Of course there will be fakes of all kinds.
TragicNotCute@lemmy.world · 20 pts · 236d
It’s not that, it’s that they are incredibly sophisticated in their techniques. I just had to sit through 90 minutes of training about how to spot fake applicants.
WoodScientist@sh.itjust.works · 9 pts · 236d
I don't get why companies can't solve this problem entirely by just flying out applicants for in-person interviews towards the end of the hiring process. Or hell, maybe only even ask the candidate to fly out for a visit after they've already accepted the job offer. Just one minimal and relatively cheap step to confirm the remote worker you're hiring is who they claim to be. For the cost of a flight, a night or two in a hotel, and some meal vouchers, you can verify someone's identity. Sure, maybe not for freelance work. But for any well paid technical field? This is a trivial expense.
oce@jlai.lu · 8 pts · 235d
I feel this can be bypassed the same way remote interviews have been passed, you have a talented dude A actually trained to pass whatever verification is needed, and whenever there's privacy, it switches to dude B, while dude A moves to another recruitment process. I think I have heard about this kind of dude A offering his services online for anyone ready to pay.
Anyone else has never seen the face of one of their full remote colleague? I have one in my team, he does a good job though, however many they may be behind him.
Honytawk@feddit.nl · 1 pts · 235d
I wonder how much it would cost to hire an actor for that. You know they would find ways around them.
TragicNotCute@lemmy.world · 1 pts · 235d
It not practical at a remote first company to fly people out to where we happen to have offices when they could be working from anywhere.
It’s cheap-ish for a flight, but at scale, the starts to become an expensive hiring pipeline.
dubyakay@lemmy.ca · 3 pts · 236d
So what did you learn?
TragicNotCute@lemmy.world · 6 pts · 235d
It’s more a list of warnings signs.
There’s more than that, but those are the highlights.
justaman123@lemmy.world · 3 pts · 235d
Yeah capitalism says: but cheaper worker ok
BoycottTwitter@lemmy.zip · 18 pts · 235d
I don't like Amazon but I will admit here I got to respect both the fact that they disclosed this instead of hid it and the fact that they are actively looking for this instead of burying their heads in the sand.
kossa@feddit.org · 7 pts · 234d
Oooor it's corporate propagande about their totalitarian surveillance system.
lka1988@sh.itjust.works · 2 pts · 234d
¿Por que no los dos?
pulsewidth@lemmy.world · 7 pts · 235d
I wonder how many they've missed over the years, this kind of thing has been occuring since at least 2012.
Reminded me of the 'critical infrastructure company' (I presume utility) software developer who handed all his credentials over to a worker in China, including mailing them his RSA keyfob, and wasn't discovered for months until the company security team noticed VPN logins coming from China.
https://arstechnica.com/information-technology/2013/01/worlds-most-industrious-lazy-man-outsources-all-of-his-work-to-china/
Apparently it's become even easier for malicious remote workers to fake resumes and identities to gain jobs via AI, so I hope all major companies are monitoring their remote access very closely.
https://au.pcmag.com/security/106436/security-firm-discovers-remote-worker-is-really-a-north-korean-hacker
Calabast@lemmy.ml · -1 pts · 236d
umbrella@lemmy.ml · -6 pts · 235d
treesquid@lemmy.world · 9 pts · 235d
Correct. The hostile actor gained employment with their victim, a common method of infiltration. You should look up the definition of infiltration.
umbrella@lemmy.ml · -4 pts · 235d
vaultdweller013@sh.itjust.works · 4 pts · 235d
It kinda is, its practically a requirement for a lot of corporate espionage and a lot of spies have entire lives alongside their spy duties. Also fun joke I've heard about Vladivostok during the Cold war, "There were surprisingly only a handful of people in that city, American spies, Soviet counter intelligence, smugglers, cargo movers, and baristas who ignored the whole mess" heard that from an ex-CIA guy who was doing a talk at a spy exhibit back when I was a kid.
umbrella@lemmy.ml · -2 pts · 235d
vaultdweller013@sh.itjust.works · 1 pts · 234d
The Norks have quite literally done data breaches and major hacks via this exact method in the past. They basically have nothing to lose on the international level so they do this and then trade it to countries like China or Russia for whatever it is they want. If they didn't have a documented history of doing shit like that nobody would assume espionage.
If they didn't have a known tendency towards weird espionage shit going back to the 50 and 60s nobody would care, but they do have a known tendency towards doing weird espionage shit.
umbrella@lemmy.ml · -1 pts · 234d
Soulg@ani.social · 4 pts · 235d
It can be if that's the purpose. But considering it's NK it is almost certainly a government attempt to infiltrate.
But considering youre from .ml I doubt you'll ever acknowledge lol
dejected_warp_core@lemmy.world · 2 pts · 235d
By itself no, but employment absolutely is compatible with infiltration. In fact, it doesn't even have to be a foreign-state actor, or even a witting party (e.g. clicking on stuff in spam mail). See: insider threat, and data exfiltration.
UnderpantsWeevil@lemmy.world · 0 pts · 235d
Yeah, and its curious to see you getting downvotes for the intra-departmental outsourcing that's been rampant through the tech sector for a while now.
What we've got isn't some nefarious plot by the Chinese-Adjacent to invade our precious trillion dollar tech industry. Its the deliberate consequence of sanctioning a country to the hilt to devalue local labor, then exploiting the sanctioned locals to extract labor at below market rate.
capuccino@lemmy.world · -11 pts · 236d
This is not some kind of facewashing?
ripcord@lemmy.world · 1 pts · 236d
No
rhythmisaprancer@piefed.social · 5 pts · 236d
What is facewashing?
massive_bereavement@fedia.io · 11 pts · 236d
When you lick your paw and then you rub it on your face.
You should try it sometime.
Evil_Shrubbery@thelemmy.club · 7 pts · 235d
Oh, I've seen our sysadmins do that ...
Honytawk@feddit.nl · 4 pts · 235d
It is about the only way we have enough time to wash ourselves.
Theprogressivist@lemmy.world · -16 pts · 236d
Nurse_Robot@lemmy.world · 41 pts · 236d
Isn't this an example of them taking it pretty seriously?
jol@discuss.tchncs.de · 17 pts · 236d
Right? I never heard of tracking employee's keystroke latency before. Pretty genius.
stevestevesteve@lemmy.world · 9 pts · 236d
How do they even?? They can't know the difference in time between the humans key input and the computer's receipt of it, since they can't possibly know the exact millisecond the human input was made...?
The reported article really sounds like a misreading of a more technical document
jol@discuss.tchncs.de · 10 pts · 236d
If you're on an ssh connection to a server, they can probably track the keystroke latency and average out over time. All network packets have timestamps, so you can know the latency of each one. If it's consistently high, that's unlikely to be a fluke or temporary network slowness.
user224@lemmy.sdf.org · 4 pts · 236d
But apparently they remotely used a laptop located in the US, so from there it should've been fine, no? Unless it was simply used as a proxy.
atzanteol@sh.itjust.works · 1 pts · 235d
Tcp/ip packets don't have timestamps. They wouldn't be reliable even if they did. And they certainly wouldn't be "millisecond accurate".
Brkdncr@lemmy.world · 4 pts · 236d
Vdi tracks round trip latency but 100ms isn’t that far.
I bet they didn’t use keystroke latency but that’s what they said they used. They probably used drone reconnaissance.
ripcord@lemmy.world · 5 pts · 236d
Yeah 100ms is like coast-to-coast US
JasonDJ@lemmy.zip · 4 pts · 236d
Light in fiberoptic travels at about 0.66c, or about 124,000 mi/sec. Data on copper actually has an advantage here, travelling at 0.99c, but it's not sustainable for long distance.
100ms being 1/10th of a second would be 12,400 miles.
The earth is about 24,000 miles at the equator.
At most, 100ms one-diredtional would be literally halfway around the world.
Of course, I have 60ms packet latency to my office 45 miles away as the crow flies. So maybe packet latency isn't the best way to tell.
Brkdncr@lemmy.world · 1 pts · 236d
Cool.
guy@piefed.social · 4 pts · 236d
They had the drone follow the fibre cable all the way to NK
Nurse_Robot@lemmy.world · 2 pts · 236d
Hopefully someone can share the original paywalled Bloomberg article, maybe it goes into more detail
ChunkMcHorkle@lemmy.world · 3 pts · 235d
Reader mode worked for me: https://www.bloomberg.com/news/newsletters/2025-12-17/amazon-caught-north-korean-it-worker-by-tracing-keystroke-data
But if you need the archive link: https://archive.ph/p4AcP
plantfanatic@sh.itjust.works · 2 pts · 236d
Average response from entering a line and starting the next. There’s a delay while the information is sent, and before they start typing the next line.
tidderuuf@lemmy.world · 0 pts · 236d
It's actually common for micromanaging to have software that tracks this. I believe Microsoft Teams has something similar managers can use to track "productivity". Someone probably just compiled all of it and clicked sort, then saw some Asian name at the top and that's what raised the red flag.