facow [he/him, any]

  • 0 Posts
  • 84 Comments
Joined 4 years ago
cake
Cake day: March 16th, 2022

help-circle




  • GNOME really seems to be targeting some mythical user who is tech savvy enough to install Linux, is likely running Windows currently, wants their new operating system to feel like MacOS but is also helplessly confused by any settings/customizability or the smallest change in behavior from other operating systems.

    I don’t generally see recommendations for new users/less tech savvy to use GNOME anymore since there are plenty of DEs that behave closer to what they’re already used to and it feels like most of the enthusiasts have largely abandoned it already. I just don’t understand who they think this is for. Just baffling decision after baffling decision





  • Thinking about it more this story smells. They’re clearly not being truthful about some part. If it was a remote controlled laptop from Arizona the time between a keystroke on the laptop and Amazon receiving it should be normal.

    If the remote controlled laptop part is true that would be because Amazon only allows company issued devices to access the VPN (and then access internal resources) which lines up with my experience. To get around that and not have to use the corp laptop they would have to crack whatever secure endpoint attestation Amazon is using to connect to the VPN. Then they’d have to reverse engineer and spoof all the spyware (that’s doing shit like apparently precisely tracking every keystroke). Because without the spyware checking in reporting normal they’d probably detect it even faster. After that’s done you’re right they’d obviously want to use a proxy but again that doesn’t seem at all why they were caught and getting to the point of being able to just directly connect to Amazon’s VPN through a proxy would be a heavy lift requiring a very sophisticated attacker.

    The corporate laptop is probably very locked down and I bet Amazon actually caught this from the remote control software being detected by some local security scanner that wasn’t properly circumvented.



  • Um not really? They claim that they detected it because of the high ping, that’s a network infra and speed of light limitation. All a proxy would have done was make the ping worse.

    They tracked down the corporate issued laptop to Arizona where it was allegedly being remotely controlled. From there the article doesn’t say how they identified it as North Korean, maybe it was coming from a North Korean IP or maybe it wasn’t but they already have a group setup to find North Korean remote workers so that’s what they decided it was.

    Amazon’s success can be almost entirely credited to the fact that it is actively looking for DPRK impostors, warns its Chief Security Officer. “If we hadn’t been looking for the DPRK workers,”

    Whoever it was, was already busted when it was tracked to Arizona so again a proxy wouldn’t have avoided detection