Conversation

Oh, brilliant.

So Windows 10 now has the ability for any application to get system-unique tracking identifiers that persist across reinstalls by storing them in the TPM or UEFI firmware variables...

Look at these APIs: https://docs.microsoft.com/en-us/uwp/api/Windows.System.Profile.SystemIdentification

To add insult to injury, the APIs lead into clipc!GetOfflineDeviceUniqueID, which calls into a licensing-related service which would be obfuscated by Warbird...

#infosec #tracking