North Korean infiltrator caught working in Amazon IT department thanks to lag — 110ms keystroke input raises red flags over true location
https://www.tomshardware.com/tech-industry/cyber-security/north-korean-infiltrator-caught-working-in-amazon-it-department-thanks-to-lag-110ms-keystroke-input-raises-red-flags-over-true-location
354 points · 50 comments · view on lemmy.world
50 Comments
SomeRandomNoob@discuss.tchncs.de · 236 pts · 244d
To me that means Amazon can and will monitor every keystroke of every employee.
Templar238@lemmy.zip · 77 pts · 244d
Worked at Google and can confirm if you typed your password into a non org website you were flagged and asked to reset your PW. The problem is some of the training websites Google used and were Google branded were apparently non org websites. But it shows they are looking for "certain key strokes"
fonix232@fedia.io · 16 pts · 244d
My employer does the same over a proxy. Luckily it can't breach HTTPS, but it was annoying to set all my APs and router and switches and other network nodes to HTTPS just because the damn thing would block the site the moment I sent my password in cleartext to a local device...
Brkdncr@lemmy.world · 18 pts · 244d
You’re sure they aren’t decrypting your traffic? Check the root cert of any site and see if it’s their own root.
dan@upvote.au · 12 pts · 244d
Larger companies that monitor for corporate passwords being entered on third-party sites usually use a browser extension that's force-installed using Chrome Enterprise. That's especially the case if they mandate the usage of Chrome.
Brkdncr@lemmy.world · 2 pts · 244d
Why do you say usually? It’s not what I do. I MitM every machine.
dan@upvote.au · 2 pts · 243d
It's what I've experienced at FAANG companies. MitM isn't used and would break certificate pinning on sites (including internal tools) that use both certificate pinning and HSTS. The Chromium source code has a list of domains that are hard-coded to only accept particular root certificates.
Brkdncr@lemmy.world · 1 pts · 243d
I don’t MitM sites that are know to break. I also don’t decrypt healthcare or banking sites. In most cases you wouldn’t know it’s happening unless you look at the cert issuer.
BrianTheeBiscuiteer@lemmy.world · 5 pts · 244d
This is definitely a thing.
EncryptKeeper@lemmy.world · 1 pts · 244d
Only if the site they’re visiting isn’t using HSTS, but it’s possible
foobaz@lemmy.world · 3 pts · 244d
I don't think this is correct. HSTS only prevents downgrading.
ShellMonkey@piefed.socdojo.com · 2 pts · 244d
HSTS says it must be encrypted but a proxy will create two connections and look at it clear in the middle. On the other hand cert pinning says it must be a specific cert that breaks the site if decryption is used. Apple is big on doing that for a lot of their site and apps.
fonix232@fedia.io · 2 pts · 244d
Yep, they're not decrypting HTTPS, I've triple checked. But we do have an MDM forced proxy service that does check any non-encrypted traffic...
Ghoelian@piefed.social · 9 pts · 244d
What does that mean? HTTPS is a client-server thing, your APS and switches don't really have anything to do with that.
Darkassassin07@lemmy.ca · 6 pts · 244d
Setting their management interfaces to be accessed via https because the VPN blocks (after snooping on) http only access would be my guess
fonix232@fedia.io · 6 pts · 244d
Web control panel. All my network runs OpenWrt and I prefer to manage it from the web UI instead of terminal tinkering.
Ghoelian@piefed.social · 2 pts · 244d
Ahh that makes sense. I thought you were claiming you somehow got all your traffic over HTTPS with some AP settings.
porcoesphino@mander.xyz · 1 pts · 244d
Annoying, but ideally it would have been the initial configuration
fonix232@fedia.io · 1 pts · 244d
Leather@lemmy.world · 31 pts · 244d
This is the real story.
Bahnd@lemmy.world · 21 pts · 244d
Yep, thats corporate monitoring software for you. Everyones got it, if you dont see it, assume its there. If the PC is not yours and or built with your own hands, assume its bugged or key logged. This goes for school PCs as well for the youngins, this is not to make people paranoid, just manage expectations on privacy. If you didnt make it, assume its recorded.
Quexotic@infosec.pub · 18 pts · 244d
I mean, more like does and has been, but I guess that's just semantics. Evil gon be evil.
sqgl@sh.itjust.works · 13 pts · 244d
It wasn't the lag from the employee's computer to Amazon which was being monitored.
It was the lag from the hacker to the employee. Amazon could not have monitored the hacker's computer.
yggstyle@lemmy.world · 8 pts · 244d
Sorta like north korea then. Understandable why they got the job... Must have felt like home.
sqgl@sh.itjust.works · 36 pts · 244d
How did Amazon know the lag?
credo@lemmy.world · 27 pts · 244d
Probably a remote kvm system with QOS monitoring. Many secure systems won’t let you connect directly to sensitive resources from your personal workstation.
sqgl@sh.itjust.works · 5 pts · 244d
But the infiltrator hacked the remote worker's computer.
The actual worker may have been require to use...
https://aws.amazon.com/workspaces/desktop-as-a-service/
But the lag from the infiltrator to that is what was detected. There was presumably no Amazon software installed on the infiltrator's computer so how can the lag be measured?
Brkdncr@lemmy.world · 5 pts · 244d
Keyboard input over kvm is pretty awful. It’s possible the kvm software was enforcing a delay between keystrokes to make sure they are delivered in order. Seeing keys consistently pressed with 500ms separation would be odd.
Darkassassin07@lemmy.ca · 0 pts · 244d
Perhaps something like time between key pressed and key released being abnormally high? Or erratic mouse movement?
I know whenever a PC I'm using is being remotely controlled, the mouse jerks around instead of moving smoothly around the screen. I'd imagine that gets even worse with ping/more layers of remote connections.
sqgl@sh.itjust.works · 0 pts · 244d
Yes but you need access to the culprit's computer for the lag measurement.
Darkassassin07@lemmy.ca · 4 pts · 244d
No. I'm talking about measuring the time in-between inputs being received over the remote connection. Purely observation from the receiver side of the connection.
Network overhead + dropped and re-sent packets, introducing unusual lag in between commands/keystrokes.
A key being pressed and key being released are two separate events that get transmitted separately and usually happen pretty close together. That gap getting larger, due to the long-distance connection introducing lag, could be what they were looking at.
porcoesphino@mander.xyz · 4 pts · 244d
With access to the final remote desktop, and access to the workers laptop you know the delay from these two so if there is more delay, then you can infer it's coming from somewhere else? I'm sure there are more paths too but access to the North Koreans hardware doesn't seem required
porcoesphino@mander.xyz · 4 pts · 244d
Also worth pointing out that this was a flagged employee (probably from something like data access logs) so they would be under more scrutiny and surveillance than the average employee
partofthevoice@lemmy.zip · 1 pts · 244d
also, time between key presses on the compromised machine could indicate network lag to what is actually a Remote Desktop.
ShellMonkey@piefed.socdojo.com · 10 pts · 244d
This is a company that's been reported to use the dwell time of you mouse over a product as a potential indicator of interest. Something like a Citrix remote desktop is extremely chatty trying to keep the origin and server in sync with every move of a mouse or keystroke. If the ACKs from the origin confirming the receipt of screen change data took an abnormally long time it could show in system performance metrics pretty easily.
MonkderVierte@lemmy.zip · 3 pts · 244d
That's common internet marketing practice and the main reason to use an adblocker.
But didn't they start to eye-track their drivers? Stuff like that.
vk6flab@lemmy.radio · 17 pts · 244d
And now you know why you should encrypt your data on any cloud provider.
Saapas@piefed.zip · 2 pts · 244d
To save it from North Koreans?
vk6flab@lemmy.radio · 8 pts · 244d
.. and anyone else who should not have access to your data.
Saapas@piefed.zip · 2 pts · 244d
Ah that's true
plz1@lemmy.world · 12 pts · 244d
I'm kind of surprised the latency was that low. Unless the NK "employee" was spoofing being in SK or something.
W3dd1e@lemmy.zip · 16 pts · 244d
The article says he was remotely controlling a company laptop located in Arizona. A woman located in AZ was facilitating the NK workers, but she was recently charged with the fraud.
dan@upvote.au · 5 pts · 244d
Hong Kong to Los Angeles is around 70ms latency (140ms round trip) so I'm not too surprised.
goatinspace@feddit.org · 1 pts · 244d
How was he hired 🤯 ? It's a skill
atrielienz@lemmy.world · 9 pts · 244d
There was a scam going where they would offer for someone to apply for a role and use that good candidates clean information to get it v they would do the work and split the pay with the person who's info they used.
In exchange that person would get "job experience", the perks of WFH, and the ability to hold down more than one of these figurehead jobs simultaneously.
Agent641@lemmy.world · 9 pts · 244d
Why didn't my guidance counselor tell me this was an option it sounds perfect for me!
atrielienz@lemmy.world · 4 pts · 244d
Probably because it gets you in trouble with the feds.
RedGreenBlue@lemmy.zip · 1 pts · 244d
Probably worked for next to no pay.
BigBolillo@mgtowlemmy.org · 6 pts · 244d
These north koreans are really hard working people..
northernlights@lemmy.today · 1 pts · 244d
MonkderVierte@lemmy.zip · 1 pts · 244d
GaMEChld@lemmy.world · 1 pts · 244d
I have no idea what that means.
muusemuuse@sh.itjust.works · 0 pts · 244d
Let’s see if Amazon gets trump to yell at Un.