Đang tải bảng tin…
Security Boulevard0 Hot0 bình luận4 phút đọc
Windows Device ID in Hacking Case Raises Questions About Enterprise Telemetry
A federal case against an alleged Scattered Spider member reveals how a Microsoft Global Device Identifier (GDID) helped FBI investigators link a Windows installation to a 2025 breach at a luxury jewelry retailer. The persistent identifier was tied to an ngrok account signup and correlated with IP addresses, online accounts, and travel data — demonstrating how endpoint telemetry can serve as a forensic anchor even when suspects use VPNs and aliases. The case raises governance questions for enterprises about what Windows telemetry collects and what can be disabled. The breach itself followed the classic Scattered Spider playbook: help desk impersonation to reset MFA-linked accounts, followed by lateral movement via ngrok and Teleport, 77GB of data exfiltration, a blocked ransomware attempt, and an $8M extortion demand. The key takeaway for security teams is that phishing-resistant MFA alone cannot protect against social engineering of help desk staff — account recovery workflows must be treated as high-risk processes requiring strict verification.
Nguồn: https://securityboulevard.com/2026/07/windows-device-id-in-hacking-case-raises-questions-about-enterprise-telemetry. 8sync News chỉ tóm tắt và dẫn link; bản quyền nội dung thuộc tác giả và nguồn gốc.
Đề xuất cho bạn
PHP31 Hot1 phútAI
PHP: PHP 8.4.23 Release Announcement
Nhóm phát triển PHP vừa tung ra phiên bản 8.4.23, một bản cập nhật bảo mật quan trọng cho …
