Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Full Writeup of the Windows GDID

github.com

Post reply on HN
Print view View original

21–30 of 57 posts

Re: Full Writeup of the Windows GDID

#21

Post by hyperrail »

ranger_danger wrote: post #15
hyperrail wrote: post #10

How a Windows device's global ID is generated may be new info in the public sphere, but the fact that the global ID exists is not a secret. This format of device ID has been in Windows since the initial release of Windows 10 in 2015, when it was introduced as part of Windows' current telemetry subsystem. To see your device's global ID, open Windows Feedback Hub, then go to Feedback Hub Settings and look under Device…

What I'm more interested in is how/where the GDID is used . Imagine if e.g. Edge started sending your GDID as a header in every single web request.

In a sense it doesn't matter how the global ID is used now. The fact that it exists allows it to be used in ways like what you describe, either by a malicious (?) Microsoft itself or by a malicious third-party attacker.

I'm familiar with these global IDs because I routinely used the Windows telemetry system as part of my work on the Windows core at Microsoft. We had strong policies on how and when we could access or use data for a single device as identified by global ID.

But ultimately, these policies will have a "government or court order" exception in reality even if not in theory, just like in most other consumer software observability systems. The Windows difference is simply the breadth of data that is intentionally collected by Microsoft or can be identified by any Microsoft-controlled IDs. That difference is huge in potential impact but very small conceptually.

Re: Full Writeup of the Windows GDID

#23

Post by m463 »

ranger_danger wrote: post #15
hyperrail wrote: post #10

How a Windows device's global ID is generated may be new info in the public sphere, but the fact that the global ID exists is not a secret. This format of device ID has been in Windows since the initial release of Windows 10 in 2015, when it was introduced as part of Windows' current telemetry subsystem. To see your device's global ID, open Windows Feedback Hub, then go to Feedback Hub Settings and look under Device…

What I'm more interested in is how/where the GDID is used . Imagine if e.g. Edge started sending your GDID as a header in every single web request.

When IE did this at the very beginning of the internet it was a real scandal.

then verizon did it for (to?) mobile phones.

I guess these things get normalized, people might say "those jerks" and then put it out of their mind.

Re: Full Writeup of the Windows GDID

#26

Post by jimbob45 »

stackghost wrote: post #9

For those like me who were not abreast of this issue: the FBI was able to arrest some kid who hacked/is alleged to have hacked a jewellery retailer through a VPN. They were able to track the hacker via the user's GDID, which is a stable identifier unaffected by VPN usage. This surveillance is certainly going to expand in scope as age verification comes into widespread usage. Personally I see little legitimate use cas…

How did they query his GDID/PUID to make the arrest though? Does the browser have access to it during some requests? Also, if it’s stored as plaintext, what’s stopping anyone from randomizing it on machine startup?

Re: Full Writeup of the Windows GDID

#27

Post by denkmoon »

rks404 wrote: post #25

is there a mac equivalent to the windows GDID?

Every little bit of hardware off an apple line is serialised out the wazoo, and the device's serial number is associated with every apple ID ever used to sign in to the device. I doubt it ever gets deleted. So yeah.

Re: Full Writeup of the Windows GDID

#28

Post by davikr »

jimbob45 wrote: post #26
stackghost wrote: post #9

For those like me who were not abreast of this issue: the FBI was able to arrest some kid who hacked/is alleged to have hacked a jewellery retailer through a VPN. They were able to track the hacker via the user's GDID, which is a stable identifier unaffected by VPN usage. This surveillance is certainly going to expand in scope as age verification comes into widespread usage. Personally I see little legitimate use cas…

How did they query his GDID/PUID to make the arrest though? Does the browser have access to it during some requests? Also, if it’s stored as plaintext, what’s stopping anyone from randomizing it on machine startup?

I'm guessing Ngrok gets subpoena'd, hands over the IP who created the account, page access timestamp, etc - FBI hands over to Microsoft, finds which Windows PCs were active with a certain IP on that time period, tries to correlate other characteristics such as OS version or anything to get a single hit, and then return other IPs used by that machine and everything else they have, like SmartDefender / Edge telemetry.

Re: Full Writeup of the Windows GDID

#29

Post by nullpoint420 »

ranger_danger wrote: post #14
Joker_vD wrote: post #12

Earlier quoted context omitted.

Well, it's a darn good thing there is nothing like that over here on the Linux side. I'm pretty sure that if e.g. systemd attempted to generate a unique, persistent machine identifier during the installation process, it'd be shot down and patched off extremely quickly.

https://www.linux.org/docs/man1/systemd-machine-id-setup.htm...

cool. we definitely needed this
Post reply on HN