Live data from Hacker News

Full Writeup of the Windows GDID

github.com

31–40 of 57 posts

Re: Full Writeup of the Windows GDID

#31

How a Windows device's global ID is generated may be new info in the public sphere, but the fact that the global ID exists is not a secret. This format of device ID has been in Windows since the initial release of Windows 10 in 2015, when it was introduced as part of Windows' current telemetry subsystem. To see your device's global ID, open Windows Feedback Hub, then go to Feedback Hub Settings and look under Device…

What I'm more interested in is how/where the GDID is used . Imagine if e.g. Edge started sending your GDID as a header in every single web request.

[dead]

Re: Full Writeup of the Windows GDID

#32

For those like me who were not abreast of this issue: the FBI was able to arrest some kid who hacked/is alleged to have hacked a jewellery retailer through a VPN. They were able to track the hacker via the user's GDID, which is a stable identifier unaffected by VPN usage. This surveillance is certainly going to expand in scope as age verification comes into widespread usage. Personally I see little legitimate use cas…

[deleted]

Re: Full Writeup of the Windows GDID

#33
AI-generated "research" once more. How can anyone call it full writeup?

As someone pointed out in the X argument comments, this is unconfirmed and most likely NOT how the actual GDID being sent to microsofts servers looks like.

1. The GDID that most closely resembles the one mentioned in the DOJ indictment of Stokes is found inside the registry key Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\IrisService\IrisActionCreatives, which starts with the "g:" prefix and is explicitly called GLOBALDEVICEID. This keys holds cached json response from microsoft servers and this is clear as night and day what value microsoft servers consider a "GDID"

2. According to the research, a Microsoft account is required. No, it's not necessary. Whether or whether you are not logged into your Microsoft device, GDID is being filled in. Did AI forget to check that?

3. How can author claim this is full writeup of GDID, when you did not verify whether the value your AI found, is the one being sent along with telemetry network requests? Author did not even verify whether he found the right thing

I also verified the value computed as suggested by the repository's creator and it is different from the value discovered inside the Iris registry key that begins with "g:".

Summary: The value author of repo claims is a GDID, is not the same value as saved on microsoft servers.

Re: Full Writeup of the Windows GDID

#36
post #28

Earlier quoted context omitted.

How did they query his GDID/PUID to make the arrest though? Does the browser have access to it during some requests? Also, if it’s stored as plaintext, what’s stopping anyone from randomizing it on machine startup?

I'm guessing Ngrok gets subpoena'd, hands over the IP who created the account, page access timestamp, etc - FBI hands over to Microsoft, finds which Windows PCs were active with a certain IP on that time period, tries to correlate other characteristics such as OS version or anything to get a single hit, and then return other IPs used by that machine and everything else they have, like SmartDefender / Edge telemetry.

> finds which Windows PCs were active with a certain IP on that time period

.. and how do they do that?

While we're on the subject of telemetry, has anyone got a GDPR orientated writeup of what's known?

Re: Full Writeup of the Windows GDID

#37

For those like me who were not abreast of this issue: the FBI was able to arrest some kid who hacked/is alleged to have hacked a jewellery retailer through a VPN. They were able to track the hacker via the user's GDID, which is a stable identifier unaffected by VPN usage. This surveillance is certainly going to expand in scope as age verification comes into widespread usage. Personally I see little legitimate use cas…

This isn't "tracking", this is attribution in a court. The defence can't stand there and say "That's not him/this device" when the forensics point exactly at it.

Re: Full Writeup of the Windows GDID

#38

For those like me who were not abreast of this issue: the FBI was able to arrest some kid who hacked/is alleged to have hacked a jewellery retailer through a VPN. They were able to track the hacker via the user's GDID, which is a stable identifier unaffected by VPN usage. This surveillance is certainly going to expand in scope as age verification comes into widespread usage. Personally I see little legitimate use cas…

This isn't "tracking", this is attribution in a court. The defence can't stand there and say "That's not him/this device" when the forensics point exactly at it.

It's still tracking. Just like tracking your car movements to attribute them to you is still tracking.

Re: Full Writeup of the Windows GDID

#39
post #33

AI-generated "research" once more. How can anyone call it full writeup? As someone pointed out in the X argument comments, this is unconfirmed and most likely NOT how the actual GDID being sent to microsofts servers looks like. 1. The GDID that most closely resembles the one mentioned in the DOJ indictment of Stokes is found inside the registry key Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\…

Very interesting.

Some users have been deleting the entire IrisService in the registry, it appears to also be related to the systray icons on the taskbar.

The first link is a couple years old but the second one is from a couple months ago. Apparently triggered now by the latest update kb5094126, so there may be some questionable new changes going on in this particular monkey-business department:

https://gist.github.com/JMMBA/d56923502a74b6b7196dd800fad0a8...

https://thegeekpage.com/taskbar-missing-after-sign-in-6-fixe...

"Fix 3" is the one where the IrisService reg key is nuked.

Re: Full Writeup of the Windows GDID

#40
post #5
post #3

Wasn't this the GUID (Globally Unique Identifier) of early 00s Windows? When did it change to GDID? Are they the same?

No relation. GUID is just a format for a 128-bit unique number, used throughout the software industry. This is a specific 64-bit number assigned to your Windows device.

So another GUID, gotcha
Post reply on HN