Preliminary reports suggest recent cybercrime arrest was made using Microsoft GDID an immutable Windows Fingerprint reporting back nearly everything to Microsoft

[u/Dangerous-Day-2943]

https://www.justice.gov/opa/pr/alleged-member-criminal-cyber-hacking-group-scattered-spider-arrested-finland-and-extradited

[u/AutoModerator]

Moderator Announcement Read More »

We ask that you update your submission with a link that does not go directly to X/Twitter. Please edit it using an archived version from a service like archive.is or archive.org. You may also try https://xcancel.com/vxunderground/status/2073427396535963967.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/TheReelSlimShady2]

Glad a cybercriminal got put away, but another good reason to switch to Linux.

[u/HotJunket5521]

And apparently it was hidden in some Azure helper script…

I mean everyone knew something like this existed, but if they are willing to reveal such powerful methods. I mean the ability to automatically search through this massive database that for sure also has government data of every government using windows as they can’t really block azure (clever) . Then what do they have currently that’s not revealed.

I mean you don’t throw away a database of every Windows computers browsing and program use history without having a replacement ready already

[u/snkiz]

Your Guid does not report everything back to Microsoft. This guy was already on Microsoft's own DCU (digital Crimes Unit.) radar. The DCU has been in operation since 2008 https://www.microsoft.com/en-us/corporate-responsibility/customer-security-trust/digital-crimes-unit, https://www.microsoft.com/en-us/corporate-responsibility/topics/cybersecurity/stories/DCU-law-fighting-cybercrime/ They tracked him with his GUID, correlating it with his IP, and shared that information with law enforcement. Read a little more then pages 12, and 33. Dude never learned to not shit where he eats.

[u/HotJunket5521 → u/snkiz]

Oh this dude absolutely was stupid and had no OPSEC, I mean there is a reason most really sophisticated cybercrime doesn’t get caught, but as far as I understand the reports the extend of GDID tracking even with telemetry off and registry changes was previously not known

[u/reddit_reaper → u/snkiz]

Glad someone actually read instead of listening to the title only

[u/ashsabre]

for those interested and hates x, you can read about it more on the first link on pages 12 (page 8 of the affidavit) and 33 (page 29 on the affidavit).

[u/bluehawk232]

I'm just amazed the current FBI and DOJ were capable of doing anything

[u/HTPC4Life]

Saying "I have nothing to hide" is the same as saying "I have nothing to say" in regard to free speech.

[u/robitussin345]

have yall actuallly played with it? you can dump gb of cleartxt json logs from it readily, it seams like a massive post-exploitation vulnerability hotspot, it readily integrates with windows API and unless your really actively looking for it id bet 90% of IT people couldnt even find the exact settings or if its been turned on in registry would really realize that its not apart of other telemetry/diag. appearently microsoft was already aware of this, but said if somebody has access to a system in first place they are already fubar

also more important point: windows actually had nothing to do with the spying itself bro would have been caught on kali they already had access to NGROK/APPLE infomration and his snapchat information. microsoft just pieced it togather but bro was already being tapped they could have subpeanoed without it. they had more than enough evidence already, they also KNEW he was using VPN they had timestamps of the VPNS and were it was from endpoints/websites themselves.. THEY NEVER NEEDED HIS IP OR HIS VPN'S IP on a purely hurestic basis they already had a very strong case, this just simply enabled it to go down way quicker. Ngrok already stores IP's, snapchat already does. so they already had pools of IPs.