You can read about it yourself here on page 12 (or page 8 of affidavit), then page 33 and down (page 29 of affidavit)

First one to notice this: Security researcher, VX-Underground.

  • x00z@lemmy.world
    7·
    2 months ago

    Did you actually read it?

    Company F server logs show that on or about May 12, 2025, threat actors downloaded, installed, and executed an ngrok agent—the program that creates a secure tunnel—on the Company F server. According to Company F, the ngrok agent had the authentication token17 2x0b1363KPV35LCUuZCkJag0G84_2btDjSM5oY82TQuiLZvaz (the “ngrok authentication token”).

    According to Microsoft records, the ngrok account was set up through Global Device Identifier g:6755467234350028 (“the GDID”). According to a Microsoft representative, a Global Device Identifier in the Windows ecosystem is a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device, either a physical device (e.g., a mobile phone or laptop) or virtual machine, across certain Microsoft services and scenarios. A GDID is a globally unique identifier tied to the installation of Windows on a device. A GDID remains consistent across Windows operating system updates on a device, but a reinstall of Windows, either on the same device or on a different device, will be tied to a new unique GDID.

    Somehow the FBI got this GDID from ngrok logs made using a VPN, which they then were able to link to their original IPs on Microsoft services.

    • Sir. Haxalot@nord.pubEnglish
      5·
      2 months ago

      The question here is how they were able to tie the GDID to a whole bunch of different domain visits. This is not something that is usually sent with web requests, and is not something that a typical web server config would log or be able to correlate.

      The most plausible explanation I’ve seen is that some telemetry service checked in over the VPN, allowing Microsoft to log GDID<->IP, and correlate the GDID with other check-ins, from his real IP. If the VPN provider maps one IP per customer/session this would create a quite high confidence link.

      Or he did something exceptionally stupid like being signed into a Microsoft account with enabled web history syncing enabled. Which of course would allow them to tie history

      Remember, no matter what the commercial VPN companies want you to believe, a VPN only encrypts content between two points and masks your IP. It does very little for privacy on its own as most tracking is done with cookies and other session tokens.