Privacy problems with Windows GDID

[Italian Panic]

The breaking news in April was the arrest of a 19 year old guy in Finland, Peter Stokes as member of the hacker group Scattered Spider. He has now been extradited to the United States, where he will face a federal trial for defrauding American citizens in the fields of cryptocurrency and social engineering/psychology.

The latest update of this days is that Stokes used sophisticated systems for connections he believed to be secure: for example, in addition to a VPN service, he also used a authomatic continuous IP rotation system with three IP addresses constantly appeared and disappeared between Estonia, thailand and the United state, and he also used Ngrok to further encrypt the traffic.

I'm not here to debate about Stoke arrest, if it's right or not, but I talking about the GDID windows system which made possible to identify Stokes and his arrest.

What’s the problem? The problem is the Windows GDID (Global Device Identifier) system and the fact that this guy was using windows systems. Ngrok is not open source it’s proprietary software that’s tied to microsoft.

What is the GDID? It is a unique code that Microsoft assigns to every device on which a Windows operating system (OS) is installed, whether pre installed on the machine or installed at a later date. In effect, it is a system native IP address that transmits complete telemetry (fingerprint) data about the machine to Microsoft servers, including reports on system crashes, unspecified reports, licence checks, traffic, software and hardware. In practice, it’s a complete fingerprint taken without your agree.

What makes GDID dangerous for ours privacy? Its persistence: this system is extremely persistent and deeply embedded in your OS and on your pc or device, disabling it risks compromising the operation of the operating system itself. All the measures taken by Stokes protect the user at the network traffic level, but the operating system remains exposed, which is precisely why GDID has compiled a complete data package containing the PC specifications, timestamps and real IP address, and sent it to Microsoft servers. Consequently, when using ngrok on a Windows OS, the exact moment when a device with a specific GDID code logged into ngrok was recorded, by simply cross controls few data, the FBI was able to track the user down.
WARNING: Uninstalling Windows does not eliminate the persistence of the GDID system. Microsoft states that the GDID system ceases to function upon uninstallation, however, specialists have demonstrated that even after formatting a system and installing another OS, traces of the GDID system remain amongst the remnants of Windows and can potentially still communicate with the servers. Worse still, if any Windows system were to be reinstalled at a later date, this would "officially" bring GDID back to life, and it would send historical data and timestamps to Microsoft servers.

GDID and Bitcoin, it's safe? Of course not, a windows system will never be able to replace a linux system. Linux don't have a dog nose for your data, the data you transmit is the data you want transmit.
Can we be sure that GDID is limited to what Windows claims? Of course not. It could well be another widespread case of large espionage (potentially another Snowden style case).
Can a user with a wallet installed on a Windows system rest safe? Of course not. GDID is native in Win systems since 2015/2016, from win10 onwards.
Could this system communicate with national tax authorities, pass on the details of those with wallets installed, and uncover undeclared bitcoin? Of course they can, it’s already happening. For example in Europe we will have serius problems with law approach and data systems.


I don’t want to sit here debating whether a hacker used Windows systems to do what they did, they have only got themselves into trouble. With a Linux system, no one of this would have happened.

So, guys, use Linux or opensource systems in general to be on the safe side, the open source community has no interest in your data or telemetry or fingerprints, in fact, it fights every day to protect you from these malicious activities associated with Windows.

Linux has a machine identification system too

Code:

/etc/machine-id

but it remains local, it is not communicated externally and can be regenerated or modified by the user. There is no background telemetry system, you can use your wallet safely in linux. Otherwise, for max security, you can use your own wallets on live versions of Linux distributions, or Debian, all with a sandbox which when the system is shut down forgets everything that has been done without leaving a trace. This is ours strenght!!

[ABCbits]

Could this system communicate with national tax authorities, pass on the details of those with wallets installed, and uncover undeclared bitcoin? Of course they can, it’s already happening. For example in Europe we will have serius problems with law approach and data systems.

What do you mean by "it’s already happening"? Can you share news or article that prove it?

So, guys, use Linux or opensource systems in general to be on the safe side, the open source community has no interest in your data or telemetry or fingerprints, in fact, it fights every day to protect you from these malicious activities associated with Windows.

It's not fully true. Some application (such as Firefox) send some telemetry data by default, but AFAIK it's not as insane as what windows does and can be disabled much easier.

[Synchronice]

It's so insane that person goes far to hide his network activity but does nothing to OS-level and account-level telemetry. I don't understand what's wrong with these people, Windows is my favorite OS too because I've been using it since my childhood and playing lots of PC games on it but once you grow up a little and start to take care of your privacy, this is not the best OS and you should move from Windows to Linux. An uncomfortable month or two worth it.

Can a user with a wallet installed on a Windows system rest safe? Of course not. GDID is native in Win systems since 2015/2016, from win10 onwards.
Could this system communicate with national tax authorities, pass on the details of those with wallets installed, and uncover undeclared bitcoin? Of course they can, it’s already happening. For example in Europe we will have serius problems with law approach and data systems.

Are you telling me that if I use Windows and have a Bitcoin wallet on it and don't pay taxes, they'll get information from Windows by secretly scanning my wallet apps? I don't really think so. They get information through exchanges and crypto-asset service providers.

[Italian Panic]

Could this system communicate with national tax authorities, pass on the details of those with wallets installed, and uncover undeclared bitcoin? Of course they can, it’s already happening. For example in Europe we will have serius problems with law approach and data systems.

What do you mean by "it’s already happening"? Can you share news or article that prove it?

It should be noted that this is one of the first cases in which the use of GDID for cybercrime cases has been explicitly stated. Many cases documented online and on specialist forums suggest that GDID is widely used for this purpose (it exist since 10 years).
For example, there are documented cases of dark web dev operating on win systems, and the arrest warrants state that the FBI and Europol used "traditional techniques" or "tracement techniques". Furthermore, there are many cases in which Microsoft states that it has used hardware identifiers.
This leads me to conclude, with a fair degree of certainty, that this type of data transfer is widely practised.

It's not fully true. Some application (such as Firefox) send some telemetry data by default, but AFAIK it's not as insane as what windows does and can be disabled much easier.

On page 1 of the privacy manual, it says not to use browsers with too much tracking, fingerprints, cookies: Chrome, Firefox and Edge are the worst. Unfortunately, even DuckDuckGo is not doing well either.

If you use Linux with Firefox, it’s like using Edge on Windows… it’s not safe. Mullvad and Brave offer incredible privacy features.

Here’s a link where you can find out about the best browsers: https://privacytests.org/private

It's so insane that person goes far to hide his network activity but does nothing to OS-level and account-level telemetry. I don't understand what's wrong with these people, Windows is my favorite OS too because I've been using it since my childhood and playing lots of PC games on it but once you grow up a little and start to take care of your privacy, this is not the best OS and you should move from Windows to Linux. An uncomfortable month or two worth it.

Can a user with a wallet installed on a Windows system rest safe? Of course not. GDID is native in Win systems since 2015/2016, from win10 onwards.
Could this system communicate with national tax authorities, pass on the details of those with wallets installed, and uncover undeclared bitcoin? Of course they can, it’s already happening. For example in Europe we will have serius problems with law approach and data systems.

Are you telling me that if I use Windows and have a Bitcoin wallet on it and don't pay taxes, they'll get information from Windows by secretly scanning my wallet apps? I don't really think so. They get information through exchanges and crypto-asset service providers.

If you’ve got a few sats to spare, obviously not, after that, it depends on how economic desperate the country you live in is.
A true bitcoiner doesn’t keep funds on CEX, they store them privately (not your keys, not your money rulez). If you live in europe and have your BTC on CEX probably your department of taxes know it. And given the extensive telemetry that GDID provides to those who are much curious, I wouldn’t be surprised if it were possible to identify, using a simple script or search filter, who has installed a software wallet on Windows systems or connected a hardware wallet. Do you find this exagerate? Yeah, maybe it is, but nothing surprises me anymore.

[Italian Panic]

Also, if I understand the complaint correctly, a Windows reinstall creates a new GDID. So the claim that GDID survives formatting or keeps communicating after switching to another OS should probably be backed by a technical source.

I’m afraid that’s not quite right; in the latest versions of Windows, the GDID remains even after a deep format and is linked back to the previous one in the event of a fresh installation of the same OS.

If you change your version of Windows in the belief that you can trick the GDID, be aware that it reports hardware components to the servers, such as: the motherboard UUID, the CPU serial number, the cryptographic keys of the TPM chip and the motherboard MAC address. This data is then linked between two different GDID for the same machine.

So yes, Windows telemetry is a real privacy problem. But we should separate “Windows telemetry can help correlate activity” from “Windows is automatically reporting all Bitcoin wallet users to tax authorities.”

In my country, there is a centralised system that monitors an individual income and compares it with their real estate and personal assets, it also monitors their expenditure and what they declare to the tax authorities each year. Applied to 60 million people, this is known as "income measurement". It’s not fiction, it really does exist, and you will receive a letter from the tax office at home asking you to pay up or provide an explanation, even for just a few euro or dollar.
Do you think that if a country needed money income, it would be a problem for Microsoft to query a server? In these countries, they have trade agreements to sell their systems, they control the market.

I’m not here to persuade you, let me make it clear that I’m not interested, I’m simply setting out some doubts and deep observations

[ABCbits]

This leads me to conclude, with a fair degree of certainty, that this type of data transfer is widely practised.

That makes sense. While it can't be proved for sure, it's enough as another reason not to use windows.

It's not fully true. Some application (such as Firefox) send some telemetry data by default, but AFAIK it's not as insane as what windows does and can be disabled much easier.

On page 1 of the privacy manual, it says not to use browsers with too much tracking, fingerprints, cookies: Chrome, Firefox and Edge are the worst. Unfortunately, even DuckDuckGo is not doing well either.

If you use Linux with Firefox, it’s like using Edge on Windows… it’s not safe. Mullvad and Brave offer incredible privacy features.

Here’s a link where you can find out about the best browsers: https://privacytests.org/private

I already know Firefox isn't as private as some people suggest, but thanks for the reminder. Although my point is not all on open source software avoid using telemetry.

[Mia Chloe]

~snip

I think I have reasons to believe most of these. I saw a story online too of how a guy was busted just because he was using windows and according to the video clip I saw they were able to track him with only the GDID even if he was actually using a VPN and his IP wasn't really consistent.

The only thing I didn't really understand is how they were able to get the GDID of the device if that's shared publicly every time too then windows is just a total trash honestly.

[Cricktor]

It's not a bad idea if OP would've quoted or cited his sources for the story. I recently stumbled over it in a video here https://www.youtube.com/watch?v=kOoP4BSATJs but didn't dig deeper as I wasn't too surprised about how M$ tracks people.

Actually, I highly recommend to every cybercriminal to ONLY use Windows and Windows services as much as possible.    For a reason or two...

If you find traces of elements of S, Ar, Ca and Sm, well, feel free to do some (word) chemistry.

[LoyceV]

I find this the most shocking part:

Microsoft’s records showed that at that exact same minute, a Windows device carrying GDID g:6755467234350028 had visited the ngrok signup page. Three hours later, the same GDID visited the retailer’s own website, through the same Tzulo proxy address used to set up the ngrok account. It gave the FBI a device, that don’t rotate the way VPN exit nodes do.

Does that mean Windows uploads every website you visit to Microsoft? How is that going to comply with EU's General Data Protection Regulation (GDPR) privacy regulation?
I remember how confused politicians were when they discovered "cookies", and made the most annoying cookie law ever. This is a million times bigger (so I guess nothing will be done about it).

Windows is my favorite OS too because I've been using it since my childhood

If you have kids, do them a favor and give them a Linux installation from the start

Are you telling me that if I use Windows and have a Bitcoin wallet on it and don't pay taxes, they'll get information from Windows by secretly scanning my wallet apps?

Not yet! The fact that this GDID case was a high-profile case shows it's not something that's very common yet. It feels like they went the extra mile to catch this hacker. But this might as well become a very common thing in the future.
I wonder how long it will take for hackers to start spoofing someone else's GDID, so authorities end up with a 96 year suspect who only uses Facebook to see her grandchildren.

[Italian Panic]

Thanks, Loycev. This shows that many of my suggestions are correct. It’s an interesting article, I would recommend everyone read this.

I find this the most shocking part:

Microsoft’s records showed that at that exact same minute, a Windows device carrying GDID g:6755467234350028 had visited the ngrok signup page. Three hours later, the same GDID visited the retailer’s own website, through the same Tzulo proxy address used to set up the ngrok account. It gave the FBI a device, that don’t rotate the way VPN exit nodes do.

Does that mean Windows uploads every website you visit to Microsoft? How is that going to comply with EU's General Data Protection Regulation (GDPR) privacy regulation?
I remember how confused politicians were when they discovered "cookies", and made the most annoying cookie law ever. This is a million times bigger (so I guess nothing will be done about it).

The GDID is under Article 4 of the GDPR because it is a unique code which, when combined with other information identifies a natural person. Therefore, the consent of the person being tracked should be required.
However, Microsoft is an American company and the request comes from the US federal authorities, there is no mutual agreement between the Americans and Europeans in personal data (more american sites are blocked in Eu, for example), and so Microsoft was able to hand over the data collected via GDID to the federal authorities. This is why biggest american companies operate on a different level; they are often above the rules and collect data on a global scale. And sell it.

Not yet! The fact that this GDID case was a high-profile case shows it's not something that's very common yet. It feels like they went the extra mile to catch this hacker. But this might as well become a very common thing in the future.
I wonder how long it will take for hackers to start spoofing someone else's GDID, so authorities end up with a 96 year suspect who only uses Facebook to see her grandchildren.

As I have said, we are not quite at that stage yet, but tracking cryptocurrencies in the future using the GDID isn’t impossible. Up until 13 years ago, no one would have even imagined that regulations could tie CEXs to national authorities, yet that’s exactly what happened, and it has created problems.
Once the telemetry is available (past telemetry too), microsoft can query the servers in 1 minute to provide data on who has installed desktop wallet software or set up cold storage on a Windows PC, it’s simply a matter of analysing the available data. An eventual state in economic crisis (more of Eu states) can pay for this data and recover money from taxes.

[vapourminer]

I find this the most shocking part:

Are you telling me that if I use Windows and have a Bitcoin wallet on it and don't pay taxes, they'll get information from Windows by secretly scanning my wallet apps?

Not yet! [...]

the big thing MS is getting to (in win11) is wanting to default save all your stuff to one drive, where they pinkie promise not to peek at it.

the lengths one has to go through now for simple privacy is getting absurd.

[LoyceV]

the lengths one has to go through now for simple privacy is getting absurd.

Using Windows and still wanting privacy just doesn't make sense at this point. The basics are fairly easy: boot from USB, install Linux. The installer will wipe the disk for you.

[Cricktor]

Does that mean Windows uploads every website you visit to Microsoft? How is that going to comply with EU's General Data Protection Regulation (GDPR) privacy regulation?

AFAIR it's a feature called Microsoft Defender SmartScreen which I think is enabled by default or M$ sells it to the user as utterly important, necessary, inevitable, ...

I'll quote what Google's AI search result burped, because it summarizes it quite nicely:

Microsoft Defender SmartScreen is a built-in Windows 11 security feature that protects you from phishing, malicious websites, and dangerous file downloads. It actively checks URLs and apps against Microsoft’s threat databases, blocking suspicious content or displaying a warning screen before you open unfamiliar software.

SmartScreen operates across several key areas of the Windows operating system:

• Web and Browser Protection: Integrated into browsers like Microsoft Edge to block access to known phishing sites, fraudulent advertisements, and deceptive web pages.
• App & Browser Control: Inspects downloaded files and applications. If you attempt to install a program that is unverified, rarely downloaded by others, or known to be malicious, SmartScreen intervenes to prevent potential harm.
• Reputation Checks: Utilizes cloud-based analysis to evaluate the reputation of files and apps to stop malware and social engineering attacks before they execute on your PC.

https://learn.microsoft.com/en-us/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/

I'm pretty sure M$ has it somewhere in the tiny footprints to label such data harvesting as "legitimate interest", especially when the user consents to the features under the label of safety and protection. Who reads the footprint, anyway? 

If you have kids, do them a favor and give them a Linux installation from the start

Tell that to the schools and universities, also! M$ and Apple know exactly why they heavily "sponsor" educational bodies.

I wonder how long it will take for hackers to start spoofing someone else's GDID, so authorities end up with a 96 year suspect who only uses Facebook to see her grandchildren.

Do real hackers use Windows? I wouldn't, if I were in their shoes. I was quite amused to read of above mentioned "hacker" that he actually used Windows while doing his dirty work. If you want to get caught at some point of level of dirtyness, use Windows. Safe bet. LOL, that's why I recommend using Windows to cybercriminals...


Windows and privacy has long ago become and is a contradiction in itself. I would also go so far to say, that with cloud^{by major players} usage you throw privacy out of the window. If not by content (rare cases of end-to-end encryption), then by usage metadata.

The basics are fairly easy: boot from USB, install Linux. The installer will wipe the disk for you.

I won't be surprised if something like this GDID telemetry will be buried in UEFI firmware and Intel ME blackbox which is mostly beyond control anyway. ME has such an independent and low-level control of the device where any OS basically can't do anything about it (unless you remove ME, but that has implications we're told are bad). And it's not that AMD hasn't something similar to Intel ME...

[LoyceV]

If you have kids, do them a favor and give them a Linux installation from the start

Tell that to the schools and universities, also! M$ and Apple know exactly why they heavily "sponsor" educational bodies.

Here's it's all Google at schools, because Chromebooks are cheap and easy to maintain. Privacy is just a nuisance to them.

I won't be surprised if something like this GDID telemetry will be buried in UEFI firmware and Intel ME blackbox which is mostly beyond control anyway. ME has such an independent and low-level control of the device where any OS basically can't do anything about it (unless you remove ME, but that has implications we're told are bad). And it's not that AMD hasn't something similar to Intel ME...

I already find the "Secure Boot" very annoying. It often makes it difficult and sometimes even impossible to install the Linux distribution I want. I don't want hardware level "protection" because Microsoft software can't survive without it.

[Lucius]

I don't doubt for a moment that the most powerful intelligence agencies don't have the tools to identify practically anyone online, regardless of what device or OS they use. Of course those who use Windows OS are by all accounts easy targets and as things stand it's pointless for them to use Tor or VPN (or both at the same time) if their OS is spying on their every move and sending it back to Big Brother.

I did a little research on whether it is even possible to somehow disable this spy and I found an article with a possible solution. If anyone tries it, please share your experiences.

Code:

https://korben.info/en/gdid-windows-cut-tracker-vpn.html

[Italian Panic]

~snip

I think I have reasons to believe most of these. I saw a story online too of how a guy was busted just because he was using windows and according to the video clip I saw they were able to track him with only the GDID even if he was actually using a VPN and his IP wasn't really consistent.

The only thing I didn't really understand is how they were able to get the GDID of the device if that's shared publicly every time too then windows is just a total trash honestly.

The hacker Peter Stokes was operating from a country within the European Community, the european GDPR is not aligned with US regulations. For this reason, in the absence of a formal agreement between the US and the EU to harmonise their respective regulations, Microsoft is not obliged to comply with the GDPR if a request for personal data comes from the US federal authorities (who act in accordance with US law).
So, over time, the Windows system log constantly transmitted Peter Stokes pc characteristics, functions, actions, IP addresses, timestamps, everything, to Microsoft servers, classifying him using the GDID and assigning him a first name and surname. It was then very simple for the federal authorities to cross reference this data provided by Microsoft and come knocking on his door.

I can confirm that Windows is a terrible operating system, from its architecture, through the resources required to run it, right down to significant privacy issues.

[LoyceV]

The hacker Peter Stokes was operating from a country within the European Community, the european GDPR is not aligned with US regulations. For this reason, in the absence of a formal agreement between the US and the EU to harmonise their respective regulations, Microsoft is not obliged to comply with the GDPR if a request for personal data comes from the US federal authorities (who act in accordance with US law).

You're skipping a step: as far as I can tell, Microsoft is not even allowed to collect this data in countries within the EU. So it may be legal (and required) to share the data they have with US authorities, but if they were not allowed to collect the data in the first place, they may be breaking privacy laws.

[Italian Panic]

The hacker Peter Stokes was operating from a country within the European Community, the european GDPR is not aligned with US regulations. For this reason, in the absence of a formal agreement between the US and the EU to harmonise their respective regulations, Microsoft is not obliged to comply with the GDPR if a request for personal data comes from the US federal authorities (who act in accordance with US law).

You're skipping a step: as far as I can tell, Microsoft is not even allowed to collect this data in countries within the EU. So it may be legal (and required) to share the data they have with US authorities, but if they were not allowed to collect the data in the first place, they may be breaking privacy laws.

You are absolutely right as far as I’m concerned, but in the last days I did some research because I’m well versed in regulations, though not as much as I am in IT.

It all comes down to the terms of the contract that the user accepts when installing software. At that moment, we forfeit our rights.

It turns out that the problem lies precisely in the regulatory hole between the US and Europe. The key point is that under the Cloud Act, the US government can force american companies to hand over data stored in their databases, even if those companies are based in Europe.

Just imagine the implications of this for AWS, Google, Apple, Microsoft… basically, most of the world’s servers. I find it absurd.

The problem is: if you do not accept the terms of contract, you cannot install the software, this is scandalous, the user have no choice.

[LoyceV]

It all comes down to the terms of the contract that the user accepts when installing software. At that moment, we forfeit our rights.

How can something nobody even knew existed be part of a "contract" (EULA)? I'd say EU left a huge loophole when they created this privacy law. It shouldn't be allowed to overload consumers with terms and conditions, but it's completely accepted. On a regular basis, I receive emails from various companies (Paypal, insurances, banks and more) about an update to their Terms. These Terms fill hundreds of pages, making it completely impossible for anyone to read (let alone fully understand).

[Italian Panic]

It all comes down to the terms of the contract that the user accepts when installing software. At that moment, we forfeit our rights.

How can something nobody even knew existed be part of a "contract" (EULA)? I'd say EU left a huge loophole when they created this privacy law. It shouldn't be allowed to overload consumers with terms and conditions, but it's completely accepted. On a regular basis, I receive emails from various companies (Paypal, insurances, banks and more) about an update to their Terms. These Terms fill hundreds of pages, making it completely impossible for anyone to read (let alone fully understand).

100% agree with you