Your Windows PC Has a Permanent ID That Follows You – Even With a VPN
Yes, it’s bad, but worth pointing out, they didn’t identify the user directly by somehow extracting GDID from their traffic, they identified them because their GDID happened to be in the same place at the same time at their hacking efforts that became statistically impossible to ignore.
Realistically this kind of tracking could be accomplished with any software with a unique ID that does, say, daily update checks or usage pings. This one is just extra bad because it’s ubiquitous (on Windows) and almost impossible to change, so they have a 1-stop-shop for spying.
All tracking is done by amalgamating as many different overlapping signals and indicators together as you can, and then establishing basically a confidence score/threshold.
This one is extra bad because it was never disclosed previously.
I think the ngrok tunnel server they setup to exfiltrate data actually sent the GDID to the ngrok servers. This GDID was then linked to non-VPN IP logs by Microsoft.
Yes, it’s bad, but worth pointing out, they didn’t identify the user directly by somehow extracting GDID from their traffic, they identified them because their GDID happened to be in the same place at the same time at their hacking efforts that became statistically impossible to ignore.
Realistically this kind of tracking could be accomplished with any software with a unique ID that does, say, daily update checks or usage pings. This one is just extra bad because it’s ubiquitous (on Windows) and almost impossible to change, so they have a 1-stop-shop for spying.
All tracking is done by amalgamating as many different overlapping signals and indicators together as you can, and then establishing basically a confidence score/threshold.
This one is extra bad because it was never disclosed previously.
Trust = Gone, what else is MSFT hiding?
I think the ngrok tunnel server they setup to exfiltrate data actually sent the GDID to the ngrok servers. This GDID was then linked to non-VPN IP logs by Microsoft.