A 19-year-old hacker used VPNs, tunneling tools, and rotated IPs across 3 countries. The FBI still caught him. Here's the Windows feature that made it possible and why it should concern everyone.
Peter Stokes, an alleged member of Scattered Spider (the group behind $100M+ in ransomware extortion), was arrested at Helsinki Airport this April. Court documents revealed a key piece of evidence: Microsoft's GDID.
What is a GDID?
GDID = Global Device Identifier. It's a unique code baked into every Windows installation. Microsoft uses it for telemetry, crash reports, feature usage, and license verification (it's why swapping your CPU can break your Windows activation).
What Microsoft gave the FBI:
→ Web activity with timestamps
→ Gaming history
→ IP addresses used over time
→ Tool usage (including Ngrok, a tunneling app)
→ Azure account activity
All tied to one persistent device fingerprint. Even though the VPN masked his IP, it didn't affect the GDID.
How they connected the dots:
Every time Stokes logged in to Snapchat, Apple, or Facebook from a new IP address, the GDID was there too. Investigators matched timestamps across platforms and countries: Tallinn, New York, Thailand, Germany. Different IPs. Same machine. Same person.
Microsoft had already identified him in October 2024 and filed a criminal referral. He was still 17. So they waited till He turned 18. Then they moved.
Yes, Stokes is accused of serious crimes. But the GDID data exists on every Windows machine, including yours. The infrastructure that handed his entire digital life to the FBI is the same infrastructure running on your laptop right now.
The unanswered questions:
- There's no public policy on when Microsoft shares GDID data
- No known opt-out mechanism
- No transparency report specifically covering GDID disclosures
- What other criminal referrals has Microsoft quietly filed?
@Schubirds @ChrisPirillo Lucky you then, I've ordered many magnets from AliExpress, all were sent back to sellers from their shipping centers, except for only 1.
@golddeath@SnailMonitor I keep telling myself this: when this crypto mining fever settles down, we will see many used VGA cards for insane low prices... When? Doubt anyone knows, but that day is approaching. Prices can't stay high for too long. Supply always follows demand, up and down.
Flying under the radar screen (and especially so when compared to the last big move up), #Bitcoins are up again this morning, trading at $14,429.
#markets#investing#investors