undefined

points

[-]

> Exactly how does Microsoft's device identifier get associated with the ngrok session

The article has a link to "39-page criminal complaint" PDF, and I'd summarize the prosecution's claims (from sections 21.e, 22, 26) as:

1. The ngrok client was downloaded onto hardware owned by the victims and used by the attacker.

2. The client was later discovered along with an ngrok auth token. (2x0b1363KPV35LCUuZCkJag0G84_2btDjSM5oY82TQuiLZvaz)

3. The ngrok auth data was linked to an ngrok account. (ac_2x0b16MSTJk4PvjLZMoqt4vOvZM)

4. Although a VPN was used by whomever created the ngrok account, the creation-time of the account correlates to Microsoft's telemetry, which indicates that the accused's computer was visiting ngrok sign-up pages.

by dlenski7 hours ago|

parent|

[-]

Thanks. (4) is the critical piece here.

by srichard161 days ago|

prev|

[-]

I work at ngrok, and this is not how our freemium plan works. Free plans limit based on usage alone, not on machine IDs.

by dlenski1 days ago|

parent|

[-]

> I work at ngrok, and this is not how our freemium plan works. Free plans limit based on usage alone, not on machine IDs.

Thank you! This is not only good to know as an ngrok user myself, but it's also more informative than what's in the article.

Sounds like we can rule that out as the avenue of detection.

by srichard161 days ago|

parent|

[-]

For what its worth, this has been swiriling around on socials and i saw someone noted that the guy had been busted for something at age 17, maybe he was on some list?

by nailer5 hours ago|

parent|

prev|

[-]

Sure but you still know which connection belongs to which licensed customer which seems to be how this person was identified.

by felooboolooomba1 days ago|

parent|

prev|

[-]

I think the defendant might want to see this. Looks like an expert witness lied in court.

by specproc1 days ago|

prev|

[-]

I'm not even clear if it requires Windows. Say if one had a Surface running Arch, would that still be traceable?

Asking for a friend.

by nickphx1 days ago|

prev|

[-]

from the microsoft store. the ngrok app was downloaded via microsoft store...

by dlenski1 days ago|

parent|

[-]

And then what?

Does the Microsoft store imprint an identifier into the network traffic of all the binaries downloaded from it?

And if so, how?

All of ngrok's traffic is TLS encrypted which means that only the client software and the server/peer should be able to decrypt or modify it.

by ankit_mishra1 days ago|

parent|

[-]

They don't need the encrypted payload just domain is the basis here as far as I can tell.