Introduction
Microsoft has recently confirmed the existence of the Global Device Identifier (GDID), a persistent identifier linked to Windows installations. This revelation came as part of a federal complaint involving an alleged member of the Scattered Spider hacking group. What makes the GDID particularly intriguing is its permanence and resistance to deactivation without affecting Windows activation and Microsoft Store apps.
What is the GDID?
The Global Device Identifier, or GDID, is generated when a Windows installation is set up with a Microsoft Account. This process is triggered by the Windows Live ID service (wlidsvc) which requests a Device PUID from login.live.com. This PUID is then registered in Microsoft's Device Directory Service by the Connected Devices Platform. Windows updates, through delivery optimization, report the GDID back to Microsoft. It is stored in the Windows registry under the key HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties with a "g" prefix followed by a decimal number.
Use in the FBI Case
In the FBI case against Peter Stokes, an alleged member of Scattered Spider, the GDID played a key role. Investigators were able to track Stokes through VPN connections, proxy servers, and several countries over an eight-month period. For instance, the GDID g:6755467234350028 was recorded visiting the ngrok signup page at the same time an account used in the attack was created via a Tzulo VPN proxy. Three hours later, the same GDID accessed a victim retailer's website through the same proxy.
Security Implications
The existence of such a persistent identifier raises privacy and security concerns. Users cannot disable the GDID without affecting crucial aspects of Windows usage, which raises questions about surveillance and user tracking by external entities. Microsoft noted that multiple GDIDs can be linked to a single user through their accounts, OneDrive, and activation history, making traceability even more complex.
Impacts for Businesses
For businesses, the GDID can be both a useful tracking tool and a potential vulnerability. The ability to track devices across complex networks can aid internal security but can also expose the company to risks if this information is compromised.
Conclusion
The GDID serves as a reminder that the balance between security and privacy is delicate. As Microsoft continues to secure its platforms, it is crucial for businesses and users to be aware of the implications of such technologies. Ultimately, transparency and user control need to be at the heart of any technological innovation.
Let's discuss your project in 15 minutes.