GDID is the persistent Windows ID that helped FBI trace a Scattered Spider hacker despite VPNs. Here's how it works and how to limit it.
  • Windex007@lemmy.worldEnglish
    2·
    9 days ago

    This seems the most likely… but still I want clarity on the mechanism. An identifying token defined in the registry is being sent over the wire. That mechanic is pretty substantial, and I’m surprised a bigger fuss hasn’t been made about that. This is pretty far beyond conventional header fingerprinting.

    • The_Decryptor@aussie.zoneEnglish
      2·
      9 days ago

      From other articles I’ve seen (Here’s an example) it was telemetry and cross referencing the IPs used.

      VPNs might help hide from passive identification, but they don’t help when you connect to the same service on your normal and private connections alternatively. The computer equivalent of using both your real name and an alias with the same person, they’ll know who you are.