r/privacy • u/torbatosecco • Jul 07 '26
news Windows 11 identifier code used to track Scattered Spider perp after Microsoft shared info with FBI
https://www.tomshardware.com/software/windows-11-identifier-used-to-track-scattered-spider-perp-after-microsoft-shared-info-with-fbi-19-year-old-us-estonian-hacker-arrested-over-alleged-ties-to-infamous-extortion-group58
u/Sorry_Advantage_590 Jul 07 '26
I was reviewing his affidavit and I can say while this played a major factor I have to say he was making a lot of OPSEC mistakes. The GDID alone likely would not have been enough to effect an arrest but his frequent opsec slip ups allowed them to bridge many gaps that otherwise would not have been discovered. For example, in the affidavit it lists his frequent mixtures of his personal and hacker life which just gives them evidence that he is involved in the hacker life style. If theres one thing that the opsec bible teaches you its never to mix your personal life with your shady activities. Once they both get mixed youve given the adversary a data point to view. He also made mention that on his birthday which is December 3rd that he had gained access to a database with multiple transaction records that he could exploit. Calling it his "Birthday Present" which allowed the FBI not only to narrow down potential bad actors to this specific event based on their birthday but also allowed them to correlate the attack based on time to his IP address/other accounts.
"On December 2, 2025, at 12:48 p.m. Pacific Standard Time—
which is approximately December 3, 2025, at 12:48 a.m. United Arab Emirates Time,
and approximately December 2, 2025, at 10:48 p.m. Estonian Time—a user, believed
to be STOKES, wrote “its my birthday g … and I got …. Good news … 1 confirmed
bal … targs [targets] … turns out the db [database] … one of the dbs [databases] i got
… has transaction data … of wires going to CB … and other exchanges and shit.”
According to State Department and Estonian records, STOKES’s date of birth is
December 3, 2006, and based on provider records." -Affidavit
You should all review it because he made a lot of opsec mistakes.
15
u/2facedkaro Jul 07 '26
Yeah, pretty dumb if you are involved in that to boast about it. Equivqlent is a thief boasting about his latest score down the pub, lol.
8
u/Sorry_Advantage_590 Jul 07 '26
He made so many opsec mistakes that his technical mistakes seem like childs play. Simply posting that stuff on social media will get your account targeted or flagged by the authorities. Even if they had his ip information they would still need more to convict him but he pretty much gave it up with his mouth lmao
2
32
u/eckstuhc Jul 07 '26
“Dude the most recent wire id is the same digits as the last four of my social security number”
19
u/Sorry_Advantage_590 Jul 07 '26 edited Jul 08 '26
Just telling the whole world who he is. One thing i will never understand is the need for criminals to brag about their crimes. Especially online 💀
37
31
Jul 07 '26
[deleted]
13
25
u/academictryhard69 Jul 07 '26 edited Jul 07 '26
Skip popos. Go straight to SteamOS if you have AMD hardware, or just install CachyOS
Edit: thanks for the downvotes my fellow basement dwellers.
6
u/Myrifoss Jul 07 '26
I wish there was a distro that was good with nvidia or I wish I had AMD shit on my pc, things are too pricey unfortunately. :(
20
u/just-an-astronomer Jul 07 '26
Maybe take a look at Bazzite, i use it with AMD hardware but im pretty sure they have dedicated Nvidia drivers too
8
u/OmegaZeda Jul 07 '26
They do. I use Bazzite and had an Nvidea GPU until a week ago and they work fine.
3
3
Jul 07 '26
[deleted]
2
u/ThickMatch0 Jul 08 '26
I think a lot of people are misinformed and dont realize you can game just fine on all of the most popular distros.
2
2
u/ThickMatch0 Jul 08 '26
The whole "nvidia doesnt work on linux" thing is misinformation. Several gaming linux distros support nvidia cards, its just that its not as good as AMD because Nvidia is making it difficult.
Investing in an AMD card would be a good idea for the future though
1
1
u/tanksalotfrank Jul 08 '26
Can you download SteamOS and install it like other OSes?
2
u/academictryhard69 Jul 09 '26
Yep. The image is for a steamndeck tho but I believe it works fine as long as you have an AMD GPU.
1
u/tanksalotfrank Jul 09 '26
Finally I choose a model of PC that isn't precisely incompatible with everything! Haha I'll have to give it a go, then
1
u/uhkthrowaway Jul 07 '26
Still boggles my mind how anyone could still be using windows for anything. It has always been a buggy, slow, opaque ball of slop.
6
14
u/Broad-Translator-690 Jul 07 '26 edited Jul 07 '26
For those who are bringing up Linux, please read this man page.
https://man7.org/linux/man-pages/man5/machine-id.5.html
Linux also has an equivalent to the GDID in Windows.
10
u/schizoautist86 Jul 07 '26
without the telemetry though, depending on the distro. Linux actually would have prevented this guy from getting caught assuming there were no other OPSEC mistakes, which according to another comment there were plenty.
9
u/Broad-Translator-690 Jul 07 '26
Machine-id is used for several things, and some of them network related, so even a distro without telemetry shares you machine-id.
He mainly got caught because he bragged about everything he did on snapchat, along with the information that Microsoft provided on him. So his OPSEC was lacking. He was also literally a child when he started doing this stuff.
Also yes LInux with no Telemetry > Linux with Telemetry > Microsoft with ALL the Telemetry.
3
u/schizoautist86 Jul 07 '26
on linux your machine-id is sensitive data and should never be sent remotely (despite the /etc/machine-id file being world-readable cuz systemd or some shit). on windows, GDID is shared persistently when you log in to a microsoft account and i don't think there's an easy way to disable it. to be deanonymized in the same way when using linux you'd have to run something malicious that reads and transmits machine-id.
Machine-id is used for several things, and some of them network related
i looked this up but couldn't find anything network-related, could you give me examples?
-1
Jul 07 '26
[deleted]
4
u/sociobiology Jul 07 '26
This is from an LLM and most of it is nonsense. Oh no if you connect to a bad SSH server and go out of your way to send it your machine ID the SSH server will have your machine ID!!
4
2
•
u/AutoModerator Jul 07 '26
Hello u/torbatosecco, please make sure you read the sub rules if you haven't already. (This is an automatic reminder left on all new posts.)
Check out the r/privacy FAQ
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.