A recently released criminal complaint against Peter Stokes, an alleged member of the Scattered Spider cybercrime group, reveals previously unpublicized details about Windows telemetry.
Microsoft has never exactly had a reputation for being privacy-focused, however the complaint reveals the important part played by Microsoft’s Global Device Identifier (GDID), a persistent identifier tied to a Windows installation, in the case.
GDID enabled investigators to correlate the suspect’s Windows installation with ngrok signup activity and other telemetry. But security experts and lawyers tell CSO that GDID was only one piece of evidence in a broader correlation chain involving provider records, IP h...