GDID is the persistent Windows ID that helped FBI trace a Scattered Spider hacker despite VPNs. Here’s how it works and how to limit it.
Microsoft’s records showed that at that exact same minute, a Windows device carrying GDID g:6755467234350028 had visited the ngrok signup page. Three hours later, the same GDID visited the retailer’s own website, through the same Tzulo proxy address used to set up the ngrok account. It gave the FBI a device, that don’t rotate the way VPN exit nodes do.
I’m not surprised MS fingerprints everything, what is insane is that their telemetry has most if not all outgoing network requests. They literally have your browser history. Better actually, because it includes non-browser activity too.
crazy.
So bad opsec helps catch bad actor. Tale as old as time.
