Actually hilarious line

At what cost???

I've heard of a few places in the news that have had secret DPRK employees, and the whole spy angle doesn't really make sense when you realize they basically never do any actual spying, they just do the work that's required of them and send the money back through various remittance services usually through China or SEA countries.

The tipoff for a lot of these places is either a lot of weird changes to their direct deposit info in a short period of time (indicating laundering through different banks/remittance services), or having odd behaviour during video calls/interviews; sometimes they'll hire someone in the usa to be their face, and one case I've read about apparently used an AI generated voice and filter.

I used to play online games in the global south with triple digit ping as normal (I sucked ass)

That's because you know when you pressed the key and you expect an immediate response. I still don't understand how it would be noticed in the context of IT work.

Maybe for fighting games. Pretty much anything else it doesn't matter much

Easiest way I can come up with would be to have the keylogger send timestamps with the keystrokes, which would be compared with the time at the server that receives them.

I'm no expert but I've worked with people who've accessed our corporate VPN while abroad in another global north country and that raised alarm bells. Surely Amazon is at least as careful as my rinkydink org, and would've blocked a request from DPRK, no?

Just speculating since the article's light on details but I'll bet they had to VPN to get on Amazon's net in the first place, and that's where the latency was introduced. Not sure how you'd work backwards to DPRK from there but again I'm not an expert.

Um not really? They claim that they detected it because of the high ping, that's a network infra and speed of light limitation. All a proxy would have done was make the ping worse.

They tracked down the corporate issued laptop to Arizona where it was allegedly being remotely controlled. From there the article doesn't say how they identified it as North Korean, maybe it was coming from a North Korean IP or maybe it wasn't but they already have a group setup to find North Korean remote workers so that's what they decided it was.

Amazon’s success can be almost entirely credited to the fact that it is actively looking for DPRK impostors, warns its Chief Security Officer. “If we hadn’t been looking for the DPRK workers,”

Whoever it was, was already busted when it was tracked to Arizona so again a proxy wouldn't have avoided detection