Welcome to Katz - Pinoy Underground Forum

[nikaro101]

Summary:

Public Disclosure: The identifier was first publicly documented in an unsealed federal complaint against Peter Stokes, an alleged member of the Scattered Spider hacking group, regarding a May 2025 jewelry retailer breach.

Mechanism: Microsoft defines GDID as a persistent, device-level identifier that uniquely tags a Windows installation across services, surviving OS updates and network changes but only changing upon a full Windows reinstall.


Privacy Impact: The identifier has no off switch for consumers and is transmitted in default diagnostic data, effectively nullifying VPN privacy shields by linking activity from different locations (such as Estonia, the US, and Thailand) back to a single physical device.

nvestigation Use: FBI records showed the specific GDID g:6755467234350028 accessed the ngrok signup page at the exact time the attack tool was configured, enabling investigators to correlate the device with Stokes' personal accounts and travel history.

Source:

To view the content, you need to Sign In or Register.

Video link

To view the content, you need to Sign In or Register.

 

[OtakuCoderPH]

Damn, that’s crazy! So basically, even with a VPN, they can still trace you back through that GDID? Any ideas on how to really mask that?

 

[nikaro101]

Damn, that’s crazy! So basically, even with a VPN, they can still trace you back through that GDID? Any ideas on how to really mask that?

Use Linux operating system....

 

[AstigPhoenix143]

Yeah, that's wild! I'm curious too—any good tools or methods you'd recommend for better masking on Windows?

 

[nikaro101]

Why VPNs Fail Against GDID​

A VPN (Virtual Private Network) only masks your IP address and encrypts the path your traffic takes to the internet. It does not stop the Windows operating system itself from generating and sending telemetry data.​

Persistent Tracking: The GDID remains constant across different IP addresses, locations, and network changes. In Stokes' case, investigators used the GDID to link his device to specific activities across Estonia, New York, and Thailand, despite his use of VPNs and proxies.

No User Control: There is no consumer-facing setting to disable the GDID. It survives standard Windows updates and persists as long as the OS installation remains. The only known method to generate a new GDID is a complete reinstallation of Windows, though even this may not guarantee anonymity if you log in with the same Microsoft account.

OS-Level Visibility: Because the identifier originates from the operating system, it is transmitted before or alongside your encrypted VPN tunnel, allowing Microsoft to associate the device's unique ID with your online activity timestamps and service usage.