Blog (.dll / bezoodaog)
/find

 · 992 words · 5 min read · by  ·

Windows Privacy, Microsoft and GDID

There is a sacred realm of privacy for every man and woman where he makes his choices and decisions-a realm of his own essential rights and liberties into which the law must not intrude.

Recently I have started reading more papers and reports from CISA, the Department of Justice and MITRE ATT&CK. The main push for this was a post by vx-underground about Peter Stokes, an alleged member of Scattered Spider, and the court documents released by the Department of Justice.

What caught my attention was not really Scattered Spider itself, but how much information could be correlated through Windows and Microsoft's infrastructure.

One of the identifiers mentioned in the court papers was GDID - Global Device Identifier. According to the filing, Microsoft records associated a particular GDID with IP addresses, web activity and other information which became useful during the investigation.

What surprised me even more is how little public documentation from Microsoft exists around GDID.

While searching for more information, I found gdid-reversal by @SmtimesIWndr, his follow-up project We-running-GDID-back, and the ZeroTrace Lab research GDID: The Windows Global Device Identifier. I would strongly recommend reading them if you are interested in this topic, as they go much deeper into how the identifier works and also correct some assumptions that appeared after the court papers became public.

In simple terms, GDID should not be thought of as just one registry value. It is part of Microsoft's device identity infrastructure. One representation of the device PUID can be found locally under:

HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties\LID

The value can be read and changed locally, but changing it does not necessarily make the computer a completely new device to Microsoft's backend. The research also shows that multiple device identities may exist in different security contexts, while other credentials and hardware-related information can be involved as well.

And this is where the whole thing becomes much more interesting.

A machine ID by itself is not particularly interesting. Neither is an IP address, a timestamp, an account identifier or a request to some website. But once you start correlating enough of these things, they can describe a surprisingly large amount of activity.

The court documents give a good real-world example of that. The GDID was one part of a much larger chain of evidence, together with IP records, accounts, timestamps and other provider information.

This does not mean that Microsoft employees are personally sitting there watching everyone's computer. There are also completely legitimate reasons for collecting certain information, especially for malware detection, account security, fraud prevention and maintaining services used by millions of devices.

But for me the interesting question is not whether every piece of telemetry has a legitimate explanation.

It is about trust and control.

Modern Windows is not simply an operating system running locally anymore. A normal installation can interact with Windows Update, Defender, Microsoft accounts, Store, Edge, push notifications, Connected Devices Platform, diagnostics, Widgets, cloud services and increasingly AI-related components.

Some of these are useful. Some are necessary. Some are optional. Some are incredibly difficult for the average user to even know exist.

I do not expect Windows to make zero network requests. That would be unrealistic. Updates, certificates, security services and many other normal parts of an operating system need network connectivity.

What I expect is to have control over my own machine.

I want to know what is enabled, what information is being collected, what services are communicating externally and what can actually be disabled without destroying the operating system in the process.

There is also a bigger problem with undocumented behaviour. If the only reason users discover an identifier such as GDID is because it appears in court papers or somebody decides to reverse engineer Windows components, then it becomes difficult to make an informed decision about privacy in the first place.

And GDID is obviously not the only identifier inside Windows. There are machine identifiers, account identifiers, telemetry identifiers, certificates, service-specific IDs and hardware information used throughout the operating system.

Again, individually these things may be completely ordinary.

The interesting part is correlation.

This is also why I think discussions around privacy often go wrong. Calling every network request "spying" makes the argument easy to dismiss, but pretending telemetry is meaningless because it has a legitimate technical purpose is not much better.

The important question is what data exists, how long it exists, what it can be associated with and how much visibility and control the user has over it.

Personally, I would like the relationship with my computer to be fairly simple:

me -> my computer

rather than having every feature slowly become:

me -> my computer -> vendor account -> cloud service -> telemetry -> more services

unless I actually choose to use those services.

The Peter Stokes case is obviously an unusual criminal investigation and involved many different sources of evidence. It would be wrong to suggest that a normal Windows user is being investigated in the same manner.

But the case is still useful because it gives us a rare public look at how a device-level identifier can become useful once it is combined with other information.

That is what got me interested in researching this further.

The computer sitting on my desk should primarily belong to me. I should be able to understand what it is doing, remove things I do not want, disable things I do not need and make my own decision about how much information leaves the machine.

As a small side project from all of this research, I have also been working on ms-private, a collection of Windows privacy and configuration tooling I personally use. It is still very much a work in progress, and the goal is not to claim that a script can magically make Windows anonymous. I mainly want it to make privacy-related changes easier to inspect, apply and reverse while I continue researching how Windows actually behaves.

Because when it comes to privacy, "trust me" is not a particularly good security model.

Sources

Read next

Simplification