A New York computer forensics firm has found that 40 per cent of the hard disk drives it recently purchased in bulk orders on eBay contained personal, private and sensitive information – everything from corporate financial data to the Web-surfing history and downloads of a man with a foot fetish.
Kessler International conducted the study over a six-month period, buying up disk drives ranging in size from 40GB to 300GB from Canada and the U.S.
The firm, which completed its research about two weeks ago, bought a total of 100 relatively modern drives, the vast majority of them Serial ATA.
“With size of the sample, I guess we were surprised with the percentage of disks that we found data on,” said Michael Kessler, CEO of Kessler International.
“We expected most of the drives to be wiped – to find one or two disks with data. But 40 drives out of 100 is a lot.”
Kessler believes the drives were likely from computers sold to third-party resellers who took them apart and sold off the parts.
Kessler’s engineers had to use special forensics software to retrieve data from some of the hard drives, but other drives contained sensitive data in the clear, having never been overwritten or erased.
The data included personal documents, financial information, e-mails, DNS server information and photographs.
“The average person who knows anything about computers could plug in these disks and just go surfing,” Kessler said.
“I know they found a guy’s foot fetish on one disk. He’d been downloading loads and loads of stuff on feet. With what we got on that disk — his name, address and all of his contacts — it would have been extremely embarrassing if we were somebody who wanted to blackmail him.”
Kessler said his company specifically avoided buying drives whose sellers indicated that the drives had been erased.
Kessler International offered this breakdown of the kind of data it retrieved:
- Personal and confidential documents, including financial information, 36 per cent;
- E-mails, 21 per cent;
- Photos, 13 per cent;
- Corporate documents, 11 per cent;
- Web browsing histories, 11 per cent;
- DNS server information, 4 per cent;
- Miscellaneous data, 4 per cent.
“We were more concerned with searching for people’s identification, which is what we found, but we were surprised by all the corporate spreadsheets and business finance records we found,” Kessler said.
The forensics firm even found one company’s “secret” recipe for French fries, Kessler said.
In recent years, hard drives have shown up on eBay that contain all kinds of sensitive data.
Power-ful leaks
In April 2006, Idaho Power Co. learned that drives it thought had been recycled had actually been sold on eBay with the data still intact.
The Boise, Idaho-based utility had used the drives in servers; when bought on eBay, the drives still contained proprietary corporate information such as memos, customer correspondence and confidential employee information.
The utility serves approximately 460,000 customers in the southern part of Idaho and in eastern Oregon.
Data on the drives, which had been used in servers, contained proprietary company information such as memos, correspondence with some customers and confidential employee information, the company said.
Idaho Power had recycled approximately 230 SCSI drives – a year’s worth of updates – through a single salvage vendor, Grant Korth, which then sold 84 of the drives to 12 parties through eBay.
The company recovered 146 of the drives from the vendor. It also got assurances from 10 of the 12 parties that bought them on eBay that the drives would be returned or the data on them would not be saved or distributed.
According to a Gartner survey, organizations use outside companies to dispose of PCs 29 per cent of the time and to get rid of servers 31 per cent of the time.
Other methods included donating hardware, putting it in storage, selling it to employees, returning it to the vendor and selling it to third parties.
Aside from the financial concerns with losing data, organizations that improperly recycle disk drives can run afoul of a number of regulations, depending on their industry.
The problem is widespread. Gartner estimates that through 2009, consumers and businesses will replace more than 800 million PCs worldwide and dispose of an estimated 512 million.
What’s more, a company can get a bad reputation for not taking proper care of personal data. When companies hire an outsourcer — which is a practice that Gartner recommends — it needs to be careful of what the salvage company will do and how they will prove it.
Simson Garfinkel, a post-doctorate fellow at Harvard University’s Center for Research on Computation and Society, researched the issue by buying more than 1,000 hard drives on eBay to see what sort of data could be gleaned from them.
He found disk drives that held information from an automated teller machine, a drive from a medical centre that held 31,000 credit card numbers, a supermarket credit card processor and a travel agency that had discarded data on travel plans, credit card numbers and ticket numbers.
“One of the drives had consumer credit applications on it – names, work histories, Social Security numbers – all the information you need to apply for credit.”
Even though drives may have been wiped of data, someone with the know-how and patience could still retrieve information, Garfinkel said.
Standard tools such as Format and Delete simply remove the reference to the files — the data is still there. Garfinkel himself has written a number of tools to retrieve information such as e-mail addresses and credit card numbers on wiped disks.
Despite his findings, Garfinkel said companies seem to be doing a better job protecting data, and he pointed to the Fair and Accurate Credit Transactions Act as a possible reason. “The percentage of drives out there that have usable data is going down, so companies are more aware of the issue,” he said.
Charles Kolodgy, an analyst with research firm IDC in Framingham, Mass., said drives from PCs are mostly easily protected even after resale by using a full-disk encryption (FDE) product, but he said prior to selling an old machine, users should still format the drive and use overwrite tools just to be sure.
“But if you have FDE you don’t need to be as concerned if something falls through the cracks,” he said. For larger hard drives, disks should be erased using industrial degaussers.
As for the drives Kessler purchased from eBay, the company plans to use a U.S. Department of Defense-grade degausser and erase the data. It will then either throw out the drives or re-use the models with sufficient capacity.
Source: Computerworld.com