4 ms·

The interesting part is not really the existence of a machine identifier. Almost every modern OS has some equivalent. The bigger question is the boundary: which

The interesting part is not really the existence of a machine identifier. Almost every modern OS has some equivalent. The bigger question is the boundary: which components can access it, and when does a local identifier become a remote tracking identifier? A machine-id sitting on disk is very different from an OS vendor correlating it with network activity.

llm_nerd 3mo ago
This is the part that isn't clear and is by far the most interesting. At what stage and what point did the GDID get correlated with a tool/web request. As is it almost sounds like Microsoft "telemetry" gathers everything and they did a bulk search for certain activity, pulling the GDID and correlating it with a user.
- mysteria 3mo ago
  From reading the official criminal complaint [1] it looks like Microsoft literally logs all web requests along with the GDID and sends it over as "telemetry". It basically associates the URL, the client's IP, and the GDID together. Or I suppose it's possible that it only sends the domain and not the full URL, but that's enough for the police to go to the hoster and demand logs containing the full URL for said IP. 1. https://www.justice.gov/usao-ndil/media/1450651/dl?inline https://www.justice.gov/usao-ndil/media/1450651/dl?inline
  - nailer 3mo ago
    > Microsoft literally logs all web requests Nope. That would be unbelievable but also very well known. It was a Windows software licensing matter, see my post above.
    - Sophira 3mo ago
      Can you link the specific post you're referring to? It's not "above" at this point in time.
    - nostrademons 3mo ago
      It's not unbelievable at all, and it is well-known. It's been publicized that Microsoft sends every URL you visit in Edge back to Microsoft servers, tied with all the IDs on the device: https://www.itpro.com/security/privacy/355029/microsoft-edge-branded-as-worrisome-for-user-privacy https://www.itpro.com/security/privacy/355029/microsoft-edge...
      - nailer 3mo ago
        > Microsoft literally logs all web requests > Microsoft sends every URL you visit in Edge back to Microsoft servers, Not the same thing.
        nostrademons 3mo ago
        Explain how they differ, in a practical way that's relevant to this discussion?
        nailer 3mo ago
        Request bodies and headers. You should be aware of this before you participate.
    - mysteria 3mo ago
      Are you talking about this post [1]? I don't see anything in the complaint alluding to a VPN license (for all we know he could have used an open source OpenVPN or Wireguard client to connect to the VPN), and the police seem to have gotten everything directly from Microsoft rather than from the VPN provider. While this is Google and not Microsoft it's worth noting that Chrome literally has a telemetry option which sends URLs to Google [2]. 1. https://news.ycombinator.com/item?id=48818984 https://news.ycombinator.com/item?id=48818984 2. https://ibb.co/k61WKSSB https://ibb.co/k61WKSSB
  - llm_nerd 3mo ago
    Clearly a bunch of defensive Microsoft employees are hitting these threads. The official complaint directly cites Microsoft as the source of these logs. They refer to Microsoft as the source of the records for web requests, app usage, and so on.
- nailer 3mo ago
  Good question. My understand is that it was licensing: Hackers cloaked IP address -> VPN license -> Windows GDID -> Hacker's name.
  - llm_nerd 3mo ago
    From the reading of the document, I really don't think that's it. The suspects used phishing to get access to one company's servers, then used those servers to push software to other servers. It 100% reads that they enlisted Microsoft to correlate telemetry data with some known activities, backtracking from that. Barring specific additional data, this should be extraordinarily concerning. Repeatedly the documents cite "Microsoft's records" for the activity - installing ngrok, accessing certain sites, RDP connections, etc.
    - baranul 3mo ago
      But it has long been known that Microsoft actively collaborates with and provides user data to legal entities. It is more a matter of the general public not being aware of this, the kind of data collected, and to what extent will users continue to tolerate Microsoft's behavior.
    - nailer 3mo ago
      Ngrok license not VPN license but yes, it’s correct as other posters have mentioned
J-Kuhn 3mo ago
Systemd (part of many major linux distributions) has for example machine-id[1], readable by anyone on the machine under /etc/machine-id. [1]: https://www.freedesktop.org/software/systemd/man/latest/machine-id.html https://www.freedesktop.org/software/systemd/man/latest/mach...
- drnick1 3mo ago
  Unlike the Microsoft equivalent (?), nothing prevents you from scrambling it or outright chmodding to 700 to protect it from prying eyes. I go further and bubblewrap software that I don't fully trust like Steam on my gaming machine. I simply don't expose /etc at all in most cases. The Linux security model is actually quite weak against potentially invasive software running in a main user account. For example /home is also completely exposed to programs such as games and anti-cheat software.
- felooboolooomba 3mo ago
  Yep, and firefox ships it to it's servers.
dlenski 3mo ago
Yeah, this is what's glaringly missing from the article. Exactly how does Microsoft's device identifier get associated with the ngrok session (normally initiated via its closed-source CLI)? I can't tell from the article whether Microsoft is doing something underhanded to inject its device identifiers into network traffic, or whether the ngrok client software (again, closed-source!) grabbed the device identifier… and might well do the same on any other OS, using /etc/machine-id on Linux for example. Since ngrok uses a "freemium" model, it wouldn't surprise me at all if its clients send machine IDs to try to catch users trying to get around its free limits.
- nickphx 3mo ago
  from the microsoft store. the ngrok app was downloaded via microsoft store...
  - dlenski 3mo ago
    And then what? Does the Microsoft store imprint an identifier into the network traffic of all the binaries downloaded from it? And if so, how? All of ngrok's traffic is TLS encrypted which means that only the client software and the server/peer should be able to decrypt or modify it.
    - ankit_mishra 3mo ago
      They don't need the encrypted payload just domain is the basis here as far as I can tell.
- srichard16 3mo ago
  I work at ngrok, and this is not how our freemium plan works. Free plans limit based on usage alone, not on machine IDs.
  - felooboolooomba 3mo ago
    I think the defendant might want to see this. Looks like an expert witness lied in court.
Bender 3mo ago
Adding another example of this is the NetworkID in about:networking#networkid in Firefox. There was a point in time that cause some controversy. Every AI has the wrong information about it's origin and use.

llm_nerd 3mo ago

This is the part that isn't clear and is by far the most interesting. At what stage and what point did the GDID get correlated with a tool/web request. As is it almost sounds like Microsoft "telemetry" gathers everything and they did a bulk search for certain activity, pulling the GDID and correlating it with a user.

mysteria 3mo ago
From reading the official criminal complaint [1] it looks like Microsoft literally logs all web requests along with the GDID and sends it over as "telemetry". It basically associates the URL, the client's IP, and the GDID together. Or I suppose it's possible that it only sends the domain and not the full URL, but that's enough for the police to go to the hoster and demand logs containing the full URL for said IP. 1. https://www.justice.gov/usao-ndil/media/1450651/dl?inline https://www.justice.gov/usao-ndil/media/1450651/dl?inline
- nailer 3mo ago
  > Microsoft literally logs all web requests Nope. That would be unbelievable but also very well known. It was a Windows software licensing matter, see my post above.
  - Sophira 3mo ago
    Can you link the specific post you're referring to? It's not "above" at this point in time.
  - nostrademons 3mo ago
    It's not unbelievable at all, and it is well-known. It's been publicized that Microsoft sends every URL you visit in Edge back to Microsoft servers, tied with all the IDs on the device: https://www.itpro.com/security/privacy/355029/microsoft-edge-branded-as-worrisome-for-user-privacy https://www.itpro.com/security/privacy/355029/microsoft-edge...
    - nailer 3mo ago
      > Microsoft literally logs all web requests > Microsoft sends every URL you visit in Edge back to Microsoft servers, Not the same thing.
      - nostrademons 3mo ago
        Explain how they differ, in a practical way that's relevant to this discussion?
        nailer 3mo ago
        Request bodies and headers. You should be aware of this before you participate.
  - mysteria 3mo ago
    Are you talking about this post [1]? I don't see anything in the complaint alluding to a VPN license (for all we know he could have used an open source OpenVPN or Wireguard client to connect to the VPN), and the police seem to have gotten everything directly from Microsoft rather than from the VPN provider. While this is Google and not Microsoft it's worth noting that Chrome literally has a telemetry option which sends URLs to Google [2]. 1. https://news.ycombinator.com/item?id=48818984 https://news.ycombinator.com/item?id=48818984 2. https://ibb.co/k61WKSSB https://ibb.co/k61WKSSB
- llm_nerd 3mo ago
  Clearly a bunch of defensive Microsoft employees are hitting these threads. The official complaint directly cites Microsoft as the source of these logs. They refer to Microsoft as the source of the records for web requests, app usage, and so on.
nailer 3mo ago
Good question. My understand is that it was licensing: Hackers cloaked IP address -> VPN license -> Windows GDID -> Hacker's name.
- llm_nerd 3mo ago
  From the reading of the document, I really don't think that's it. The suspects used phishing to get access to one company's servers, then used those servers to push software to other servers. It 100% reads that they enlisted Microsoft to correlate telemetry data with some known activities, backtracking from that. Barring specific additional data, this should be extraordinarily concerning. Repeatedly the documents cite "Microsoft's records" for the activity - installing ngrok, accessing certain sites, RDP connections, etc.
  - baranul 3mo ago
    But it has long been known that Microsoft actively collaborates with and provides user data to legal entities. It is more a matter of the general public not being aware of this, the kind of data collected, and to what extent will users continue to tolerate Microsoft's behavior.
  - nailer 3mo ago
    Ngrok license not VPN license but yes, it’s correct as other posters have mentioned

J-Kuhn 3mo ago

Systemd (part of many major linux distributions) has for example machine-id[1], readable by anyone on the machine under /etc/machine-id. [1]: https://www.freedesktop.org/software/systemd/man/latest/machine-id.html https://www.freedesktop.org/software/systemd/man/latest/mach...

drnick1 3mo ago
Unlike the Microsoft equivalent (?), nothing prevents you from scrambling it or outright chmodding to 700 to protect it from prying eyes. I go further and bubblewrap software that I don't fully trust like Steam on my gaming machine. I simply don't expose /etc at all in most cases. The Linux security model is actually quite weak against potentially invasive software running in a main user account. For example /home is also completely exposed to programs such as games and anti-cheat software.
felooboolooomba 3mo ago
Yep, and firefox ships it to it's servers.

dlenski 3mo ago

Yeah, this is what's glaringly missing from the article. Exactly how does Microsoft's device identifier get associated with the ngrok session (normally initiated via its closed-source CLI)? I can't tell from the article whether Microsoft is doing something underhanded to inject its device identifiers into network traffic, or whether the ngrok client software (again, closed-source!) grabbed the device identifier… and might well do the same on any other OS, using /etc/machine-id on Linux for example. Since ngrok uses a "freemium" model, it wouldn't surprise me at all if its clients send machine IDs to try to catch users trying to get around its free limits.

nickphx 3mo ago
from the microsoft store. the ngrok app was downloaded via microsoft store...
- dlenski 3mo ago
  And then what? Does the Microsoft store imprint an identifier into the network traffic of all the binaries downloaded from it? And if so, how? All of ngrok's traffic is TLS encrypted which means that only the client software and the server/peer should be able to decrypt or modify it.
  - ankit_mishra 3mo ago
    They don't need the encrypted payload just domain is the basis here as far as I can tell.
srichard16 3mo ago
I work at ngrok, and this is not how our freemium plan works. Free plans limit based on usage alone, not on machine IDs.
- felooboolooomba 3mo ago
  I think the defendant might want to see this. Looks like an expert witness lied in court.

Bender 3mo ago

Adding another example of this is the NetworkID in about:networking#networkid in Firefox. There was a point in time that cause some controversy. Every AI has the wrong information about it's origin and use.