5 ms·

North Korean infiltrator caught at Amazon due to 110ms keystroke lag

80 points by bns 10mo ago

belter 10mo ago
A employee of an Amazon contractor... Article is clear as mud, and its sourcing Bloomberg, on who has sketchy reputation on this type of stories.
- wmf 10mo ago
  I'm not sure how keypress delay is measured but the rest sounds entirely consistent with the documented MO of North Korean hackers.
ivraatiems 10mo ago
The Arizona woman the article refers to was sentenced to 102 months in prison for her role in this scheme: https://www.justice.gov/opa/pr/arizona-woman-sentenced-17m-information-technology-worker-fraud-scheme-generated-revenue https://www.justice.gov/opa/pr/arizona-woman-sentenced-17m-i... Pretty fascinating stuff.
channeleaton 10mo ago
I’ve come across two of these in the last few years of running interviews. All you have to do is ask about where they live and what they like about it. One, when asked about living in a dead-flat suburb of Houston, said he liked the mountains.
- vablings 10mo ago
  Easy workaround, AI & LLMS can generate you a random area you live and a simple profile from the perspective of people What do you like about New Jersey? "I like New Jersey for its proximity to NYC and Philadelphia, the huge variety of food (from diners to boardwalk pizza), and the great beaches and boardwalks like Asbury Park and Cape May."[1] [1]: gpt5-mini on duck duck ai chat
the_biot 10mo ago
When you work for Amazon, your computer is monitored to the point they check your keyboard typing speed. Dystopian doesn't even begin to describe it.
- chatmasta 10mo ago
  According to the article (and therefore Amazon, so take it with a grain of salt), they’ve “foiled more than 1,800 DPRK infiltration attempts since April 2024.” Company laptops are company property, and employees are warned prominently about the privacy implications of this. Endpoint security is the most critical protection against insider threats, which are the highest leverage attack vectors. One bad actor inside your infrastructure can do untold damage to company finances, reputation, trade secrets, etc. Add to this the sensitive data Amazon processes on behalf of clients, and protecting against these threats becomes necessary for survival. Also, this detection method doesn’t require full key logging. It just requires measuring the latency between some sample of keystrokes and receiving them on the server. It could be implemented in JavaScript on the login page. In fact it’s actually a clever technique that could be used for VPN detection by normal websites… in the case of Amazon it’s probably more complicated since the “client” may be behind a KVM/VNC server, but the same concept works.
  - farbklang 10mo ago
    I fail to understand how you can measure keystroke latency coming from a KVM. Everything behind the KVM is invisible to you, assuming that it is spoofing a legitimate logitech dongle and emulating a legitimate screen edid. The KVM uses buffering and queues the keystrokes. So the net time between them is the same as if I would type them locally. What you could measure is the fingerprint of USB initialization and enumeration of keyboard, mouse etc when connecting and starting up.
    - vablings 10mo ago
      It's actually the buffering in this case that will get you dinged. The stated 110ms "lag" is probably the minimum time between keystrokes ever. If you have ever recorded data on the mean time between keystrokes you get a nice even distribution but for someone on a KVM it will look very skewed with most being under 110ms and zero below 110ms which is impossible for a normal human at a machine to replicate Furthermore, there are a number of other side channel attacks here you could use to make things really inconvenient. Something super powerful would-be having a fido2 key such as a YubiKey and recording the mean time to human press keypress. Your average person who is present at the machine will touch the button in a number of seconds. A remote operator in NK will have to summon the homeowner which could take significantly longer. Another technique you could use is look at the mouse movement data. You would also see the same truncated. distribution, I think a few people have put together a PoC for detecting cheaters in games based on mouse movements. I do wonder also if the KVM devices they are using support HDCP. Showing media over HDCP on the screen that instructs the user to write an email or make a phone call instantly would be pretty cool.
keyle 10mo ago
Mind boggling. But well done Amazon. So if I'm reading this right, all the NK perpetrators have to do "next time", is to have a local remote-desktop as a proxy?
deafpolygon 10mo ago
This is kind of dystopian if you think about it — they’re collecting all kinds of data from their workers. They probably can clock you in and out of your bathroom breaks automagically at some point soon.
- wh_123 10mo ago
  True, something Microsoft wants to do with teams data.
PaulHoule 10mo ago
Reminds me of the Michael Crichton "Mousetrap" story which was published at the top of the Wargames craze: https://codegolf.stackexchange.com/questions/41417/michael-crichtons-mousetrap https://codegolf.stackexchange.com/questions/41417/michael-c...
wh_123 10mo ago
This is a side channel defense.
burnt-resistor 10mo ago
Amazon doesn't care that it hired malnourished slaves in sanctioned countries or that warehouse workers are subjected to extreme screening procedures and lack of accommodations to universal biology that lead to urination in bottles in the US and UK, they only care that it makes them lose profits from boycott blowback from bad PR.

80 points by bns 10mo ago

belter 10mo ago

A employee of an Amazon contractor... Article is clear as mud, and its sourcing Bloomberg, on who has sketchy reputation on this type of stories.

wmf 10mo ago
I'm not sure how keypress delay is measured but the rest sounds entirely consistent with the documented MO of North Korean hackers.

ivraatiems 10mo ago

The Arizona woman the article refers to was sentenced to 102 months in prison for her role in this scheme: https://www.justice.gov/opa/pr/arizona-woman-sentenced-17m-information-technology-worker-fraud-scheme-generated-revenue https://www.justice.gov/opa/pr/arizona-woman-sentenced-17m-i... Pretty fascinating stuff.

channeleaton 10mo ago

I’ve come across two of these in the last few years of running interviews. All you have to do is ask about where they live and what they like about it. One, when asked about living in a dead-flat suburb of Houston, said he liked the mountains.

vablings 10mo ago
Easy workaround, AI & LLMS can generate you a random area you live and a simple profile from the perspective of people What do you like about New Jersey? "I like New Jersey for its proximity to NYC and Philadelphia, the huge variety of food (from diners to boardwalk pizza), and the great beaches and boardwalks like Asbury Park and Cape May."[1] [1]: gpt5-mini on duck duck ai chat

the_biot 10mo ago

When you work for Amazon, your computer is monitored to the point they check your keyboard typing speed. Dystopian doesn't even begin to describe it.

chatmasta 10mo ago
According to the article (and therefore Amazon, so take it with a grain of salt), they’ve “foiled more than 1,800 DPRK infiltration attempts since April 2024.” Company laptops are company property, and employees are warned prominently about the privacy implications of this. Endpoint security is the most critical protection against insider threats, which are the highest leverage attack vectors. One bad actor inside your infrastructure can do untold damage to company finances, reputation, trade secrets, etc. Add to this the sensitive data Amazon processes on behalf of clients, and protecting against these threats becomes necessary for survival. Also, this detection method doesn’t require full key logging. It just requires measuring the latency between some sample of keystrokes and receiving them on the server. It could be implemented in JavaScript on the login page. In fact it’s actually a clever technique that could be used for VPN detection by normal websites… in the case of Amazon it’s probably more complicated since the “client” may be behind a KVM/VNC server, but the same concept works.
- farbklang 10mo ago
  I fail to understand how you can measure keystroke latency coming from a KVM. Everything behind the KVM is invisible to you, assuming that it is spoofing a legitimate logitech dongle and emulating a legitimate screen edid. The KVM uses buffering and queues the keystrokes. So the net time between them is the same as if I would type them locally. What you could measure is the fingerprint of USB initialization and enumeration of keyboard, mouse etc when connecting and starting up.
  - vablings 10mo ago
    It's actually the buffering in this case that will get you dinged. The stated 110ms "lag" is probably the minimum time between keystrokes ever. If you have ever recorded data on the mean time between keystrokes you get a nice even distribution but for someone on a KVM it will look very skewed with most being under 110ms and zero below 110ms which is impossible for a normal human at a machine to replicate Furthermore, there are a number of other side channel attacks here you could use to make things really inconvenient. Something super powerful would-be having a fido2 key such as a YubiKey and recording the mean time to human press keypress. Your average person who is present at the machine will touch the button in a number of seconds. A remote operator in NK will have to summon the homeowner which could take significantly longer. Another technique you could use is look at the mouse movement data. You would also see the same truncated. distribution, I think a few people have put together a PoC for detecting cheaters in games based on mouse movements. I do wonder also if the KVM devices they are using support HDCP. Showing media over HDCP on the screen that instructs the user to write an email or make a phone call instantly would be pretty cool.

keyle 10mo ago

Mind boggling. But well done Amazon. So if I'm reading this right, all the NK perpetrators have to do "next time", is to have a local remote-desktop as a proxy?

deafpolygon 10mo ago

This is kind of dystopian if you think about it — they’re collecting all kinds of data from their workers. They probably can clock you in and out of your bathroom breaks automagically at some point soon.

wh_123 10mo ago
True, something Microsoft wants to do with teams data.

PaulHoule 10mo ago

Reminds me of the Michael Crichton "Mousetrap" story which was published at the top of the Wargames craze: https://codegolf.stackexchange.com/questions/41417/michael-crichtons-mousetrap https://codegolf.stackexchange.com/questions/41417/michael-c...

wh_123 10mo ago

This is a side channel defense.

burnt-resistor 10mo ago

Amazon doesn't care that it hired malnourished slaves in sanctioned countries or that warehouse workers are subjected to extreme screening procedures and lack of accommodations to universal biology that lead to urination in bottles in the US and UK, they only care that it makes them lose profits from boycott blowback from bad PR.