Probably a remote kvm system with QOS monitoring. Many secure systems won’t let you connect directly to sensitive resources from your personal workstation.
But the lag from the infiltrator to that is what was detected. There was presumably no Amazon software installed on the infiltrator’s computer so how can the lag be measured?
Keyboard input over kvm is pretty awful. It’s possible the kvm software was enforcing a delay between keystrokes to make sure they are delivered in order. Seeing keys consistently pressed with 500ms separation would be odd.
Perhaps something like time between key pressed and key released being abnormally high? Or erratic mouse movement?
I know whenever a PC I’m using is being remotely controlled, the mouse jerks around instead of moving smoothly around the screen. I’d imagine that gets even worse with ping/more layers of remote connections.
No. I’m talking about measuring the time in-between inputs being received over the remote connection. Purely observation from the receiver side of the connection.
Network overhead + dropped and re-sent packets, introducing unusual lag in between commands/keystrokes.
A key being pressed and key being released are two separate events that get transmitted separately and usually happen pretty close together. That gap getting larger, due to the long-distance connection introducing lag, could be what they were looking at.
How did Amazon know the lag?
Probably a remote kvm system with QOS monitoring. Many secure systems won’t let you connect directly to sensitive resources from your personal workstation.
But the infiltrator hacked the remote worker’s computer.
The actual worker may have been require to use…
https://aws.amazon.com/workspaces/desktop-as-a-service/
But the lag from the infiltrator to that is what was detected. There was presumably no Amazon software installed on the infiltrator’s computer so how can the lag be measured?
Keyboard input over kvm is pretty awful. It’s possible the kvm software was enforcing a delay between keystrokes to make sure they are delivered in order. Seeing keys consistently pressed with 500ms separation would be odd.
Perhaps something like time between key pressed and key released being abnormally high? Or erratic mouse movement?
I know whenever a PC I’m using is being remotely controlled, the mouse jerks around instead of moving smoothly around the screen. I’d imagine that gets even worse with ping/more layers of remote connections.
Yes but you need access to the culprit’s computer for the lag measurement.
No. I’m talking about measuring the time in-between inputs being received over the remote connection. Purely observation from the receiver side of the connection.
Network overhead + dropped and re-sent packets, introducing unusual lag in between commands/keystrokes.
A key being pressed and key being released are two separate events that get transmitted separately and usually happen pretty close together. That gap getting larger, due to the long-distance connection introducing lag, could be what they were looking at.