6 ms·

The interesting part is not really the existence of a machine identifier. Almost every modern OS has some equivalent. The bigger question is the boundary: which

The interesting part is not really the existence of a machine identifier. Almost every modern OS has some equivalent. The bigger question is the boundary: which components can access it, and when does a local identifier become a remote tracking identifier? A machine-id sitting on disk is very different from an OS vendor correlating it with network activity.

llm_nerd 2mo ago
This is the part that isn't clear and is by far the most interesting. At what stage and what point did the GDID get correlated with a tool/web request. As is it almost sounds like Microsoft "telemetry" gathers everything and they did a bulk search for certain activity, pulling the GDID and correlating it with a user.
- mysteria 2mo ago
  From reading the official criminal complaint [1] it looks like Microsoft literally logs all web requests along with the GDID and sends it over as "telemetry". It basically associates the URL, the client's IP, and the GDID together. Or I suppose it's possible that it only sends the domain and not the full URL, but that's enough for the police to go to the hoster and demand logs containing the full URL for said IP. 1. https://www.justice.gov/usao-ndil/media/1450651/dl?inline https://www.justice.gov/usao-ndil/media/1450651/dl?inline
  - nailer 2mo ago
    > Microsoft literally logs all web requests Nope. That would be unbelievable but also very well known. It was a Windows software licensing matter, see my post above.
    - Sophira 2mo ago
      Can you link the specific post you're referring to? It's not "above" at this point in time.
    - nostrademons 2mo ago
      It's not unbelievable at all, and it is well-known. It's been publicized that Microsoft sends every URL you visit in Edge back to Microsoft servers, tied with all the IDs on the device: https://www.itpro.com/security/privacy/355029/microsoft-edge-branded-as-worrisome-for-user-privacy https://www.itpro.com/security/privacy/355029/microsoft-edge...
      - nailer 2mo ago
        > Microsoft literally logs all web requests > Microsoft sends every URL you visit in Edge back to Microsoft servers, Not the same thing.
        nostrademons 2mo ago
        Explain how they differ, in a practical way that's relevant to this discussion?
        nailer 2mo ago
        Request bodies and headers. You should be aware of this before you participate.
    - mysteria 2mo ago
      Are you talking about this post [1]? I don't see anything in the complaint alluding to a VPN license (for all we know he could have used an open source OpenVPN or Wireguard client to connect to the VPN), and the police seem to have gotten everything directly from Microsoft rather than from the VPN provider. While this is Google and not Microsoft it's worth noting that Chrome literally has a telemetry option which sends URLs to Google [2]. 1. https://news.ycombinator.com/item?id=48818984 https://news.ycombinator.com/item?id=48818984 2. https://ibb.co/k61WKSSB https://ibb.co/k61WKSSB
  - llm_nerd 2mo ago
    Clearly a bunch of defensive Microsoft employees are hitting these threads. The official complaint directly cites Microsoft as the source of these logs. They refer to Microsoft as the source of the records for web requests, app usage, and so on.
- nailer 2mo ago
  Good question. My understand is that it was licensing: Hackers cloaked IP address -> VPN license -> Windows GDID -> Hacker's name.
  - llm_nerd 2mo ago
    From the reading of the document, I really don't think that's it. The suspects used phishing to get access to one company's servers, then used those servers to push software to other servers. It 100% reads that they enlisted Microsoft to correlate telemetry data with some known activities, backtracking from that. Barring specific additional data, this should be extraordinarily concerning. Repeatedly the documents cite "Microsoft's records" for the activity - installing ngrok, accessing certain sites, RDP connections, etc.
    - nailer 2mo ago
      Ngrok license not VPN license but yes, it’s correct as other posters have mentioned
    - baranul 2mo ago
      But it has long been known that Microsoft actively collaborates with and provides user data to legal entities. It is more a matter of the general public not being aware of this, the kind of data collected, and to what extent will users continue to tolerate Microsoft's behavior.
J-Kuhn 2mo ago
Systemd (part of many major linux distributions) has for example machine-id[1], readable by anyone on the machine under /etc/machine-id. [1]: https://www.freedesktop.org/software/systemd/man/latest/machine-id.html https://www.freedesktop.org/software/systemd/man/latest/mach...
- drnick1 2mo ago
  Unlike the Microsoft equivalent (?), nothing prevents you from scrambling it or outright chmodding to 700 to protect it from prying eyes. I go further and bubblewrap software that I don't fully trust like Steam on my gaming machine. I simply don't expose /etc at all in most cases. The Linux security model is actually quite weak against potentially invasive software running in a main user account. For example /home is also completely exposed to programs such as games and anti-cheat software.
- felooboolooomba 2mo ago
  Yep, and firefox ships it to it's servers.
dlenski 2mo ago
Yeah, this is what's glaringly missing from the article. Exactly how does Microsoft's device identifier get associated with the ngrok session (normally initiated via its closed-source CLI)? I can't tell from the article whether Microsoft is doing something underhanded to inject its device identifiers into network traffic, or whether the ngrok client software (again, closed-source!) grabbed the device identifier… and might well do the same on any other OS, using /etc/machine-id on Linux for example. Since ngrok uses a "freemium" model, it wouldn't surprise me at all if its clients send machine IDs to try to catch users trying to get around its free limits.
- srichard16 2mo ago
  I work at ngrok, and this is not how our freemium plan works. Free plans limit based on usage alone, not on machine IDs.
  - nailer 2mo ago
    Sure but you still know which connection belongs to which licensed customer which seems to be how this person was identified.
  - felooboolooomba 2mo ago
    I think the defendant might want to see this. Looks like an expert witness lied in court.
  - dlenski 2mo ago
    > I work at ngrok, and this is not how our freemium plan works. Free plans limit based on usage alone, not on machine IDs. Thank you! This is not only good to know as an ngrok user myself, but it's also more informative than what's in the article. Sounds like we can rule that out as the avenue of detection.
    - srichard16 2mo ago
      For what its worth, this has been swiriling around on socials and i saw someone noted that the guy had been busted for something at age 17, maybe he was on some list?
Bender 2mo ago
Adding another example of this is the NetworkID in about:networking#networkid in Firefox. There was a point in time that cause some controversy. Every AI has the wrong information about it's origin and use.

llm_nerd 2mo ago

This is the part that isn't clear and is by far the most interesting. At what stage and what point did the GDID get correlated with a tool/web request. As is it almost sounds like Microsoft "telemetry" gathers everything and they did a bulk search for certain activity, pulling the GDID and correlating it with a user.

mysteria 2mo ago
From reading the official criminal complaint [1] it looks like Microsoft literally logs all web requests along with the GDID and sends it over as "telemetry". It basically associates the URL, the client's IP, and the GDID together. Or I suppose it's possible that it only sends the domain and not the full URL, but that's enough for the police to go to the hoster and demand logs containing the full URL for said IP. 1. https://www.justice.gov/usao-ndil/media/1450651/dl?inline https://www.justice.gov/usao-ndil/media/1450651/dl?inline
- nailer 2mo ago
  > Microsoft literally logs all web requests Nope. That would be unbelievable but also very well known. It was a Windows software licensing matter, see my post above.
  - Sophira 2mo ago
    Can you link the specific post you're referring to? It's not "above" at this point in time.
  - nostrademons 2mo ago
    It's not unbelievable at all, and it is well-known. It's been publicized that Microsoft sends every URL you visit in Edge back to Microsoft servers, tied with all the IDs on the device: https://www.itpro.com/security/privacy/355029/microsoft-edge-branded-as-worrisome-for-user-privacy https://www.itpro.com/security/privacy/355029/microsoft-edge...
    - nailer 2mo ago
      > Microsoft literally logs all web requests > Microsoft sends every URL you visit in Edge back to Microsoft servers, Not the same thing.
      - nostrademons 2mo ago
        Explain how they differ, in a practical way that's relevant to this discussion?
        nailer 2mo ago
        Request bodies and headers. You should be aware of this before you participate.
  - mysteria 2mo ago
    Are you talking about this post [1]? I don't see anything in the complaint alluding to a VPN license (for all we know he could have used an open source OpenVPN or Wireguard client to connect to the VPN), and the police seem to have gotten everything directly from Microsoft rather than from the VPN provider. While this is Google and not Microsoft it's worth noting that Chrome literally has a telemetry option which sends URLs to Google [2]. 1. https://news.ycombinator.com/item?id=48818984 https://news.ycombinator.com/item?id=48818984 2. https://ibb.co/k61WKSSB https://ibb.co/k61WKSSB
- llm_nerd 2mo ago
  Clearly a bunch of defensive Microsoft employees are hitting these threads. The official complaint directly cites Microsoft as the source of these logs. They refer to Microsoft as the source of the records for web requests, app usage, and so on.
nailer 2mo ago
Good question. My understand is that it was licensing: Hackers cloaked IP address -> VPN license -> Windows GDID -> Hacker's name.
- llm_nerd 2mo ago
  From the reading of the document, I really don't think that's it. The suspects used phishing to get access to one company's servers, then used those servers to push software to other servers. It 100% reads that they enlisted Microsoft to correlate telemetry data with some known activities, backtracking from that. Barring specific additional data, this should be extraordinarily concerning. Repeatedly the documents cite "Microsoft's records" for the activity - installing ngrok, accessing certain sites, RDP connections, etc.
  - nailer 2mo ago
    Ngrok license not VPN license but yes, it’s correct as other posters have mentioned
  - baranul 2mo ago
    But it has long been known that Microsoft actively collaborates with and provides user data to legal entities. It is more a matter of the general public not being aware of this, the kind of data collected, and to what extent will users continue to tolerate Microsoft's behavior.

J-Kuhn 2mo ago

Systemd (part of many major linux distributions) has for example machine-id[1], readable by anyone on the machine under /etc/machine-id. [1]: https://www.freedesktop.org/software/systemd/man/latest/machine-id.html https://www.freedesktop.org/software/systemd/man/latest/mach...

drnick1 2mo ago
Unlike the Microsoft equivalent (?), nothing prevents you from scrambling it or outright chmodding to 700 to protect it from prying eyes. I go further and bubblewrap software that I don't fully trust like Steam on my gaming machine. I simply don't expose /etc at all in most cases. The Linux security model is actually quite weak against potentially invasive software running in a main user account. For example /home is also completely exposed to programs such as games and anti-cheat software.
felooboolooomba 2mo ago
Yep, and firefox ships it to it's servers.

dlenski 2mo ago

Yeah, this is what's glaringly missing from the article. Exactly how does Microsoft's device identifier get associated with the ngrok session (normally initiated via its closed-source CLI)? I can't tell from the article whether Microsoft is doing something underhanded to inject its device identifiers into network traffic, or whether the ngrok client software (again, closed-source!) grabbed the device identifier… and might well do the same on any other OS, using /etc/machine-id on Linux for example. Since ngrok uses a "freemium" model, it wouldn't surprise me at all if its clients send machine IDs to try to catch users trying to get around its free limits.

srichard16 2mo ago
I work at ngrok, and this is not how our freemium plan works. Free plans limit based on usage alone, not on machine IDs.
- nailer 2mo ago
  Sure but you still know which connection belongs to which licensed customer which seems to be how this person was identified.
- felooboolooomba 2mo ago
  I think the defendant might want to see this. Looks like an expert witness lied in court.
- dlenski 2mo ago
  > I work at ngrok, and this is not how our freemium plan works. Free plans limit based on usage alone, not on machine IDs. Thank you! This is not only good to know as an ngrok user myself, but it's also more informative than what's in the article. Sounds like we can rule that out as the avenue of detection.
  - srichard16 2mo ago
    For what its worth, this has been swiriling around on socials and i saw someone noted that the guy had been busted for something at age 17, maybe he was on some list?

Bender 2mo ago

Adding another example of this is the NetworkID in about:networking#networkid in Firefox. There was a point in time that cause some controversy. Every AI has the wrong information about it's origin and use.