How easy is it for a GUID you generate to identify you?

Question

I hear that the creator of the melissa worm was convicted based on the fact that the GUIDs generated could be linked back to a MAC Address of a computer he used.

How hard is it to do this? And what data do they need other than the GUID? Like the MAC Address itself or the time it was created?

Answer 1

That relates to a specific version 1 UUID included in the office document that contained the macro virus, this was becuse it came from UuidCreate/Sequential which did contain MAC info;

For security reasons, UuidCreate was modified so that it no longer uses a machine's MAC address to generate UUIDs. UuidCreateSequential was introduced to allow creation of UUIDs using the MAC address of a machine's Ethernet card.

Answer 2

It depends on how and by what OS/library that GUID was generated. As of Windows and its standard UuidCreate() function:

The UuidCreate function generates a UUID that cannot be traced to the ethernet address of the computer on which it was generated. It also cannot be associated with other UUIDs created on the same computer.

Here: http://msdn.microsoft.com/en-us/library/aa379205(v=vs.85).aspx