Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

4/25/2019
11:15 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Sensitive Data Lingers on Used Storage Drives Sold Online

Four in 10 used hard drives sold on eBay found to contain sensitive information.

A startling number of used hard drives sold on eBay expose sensitive information from their previous owners, a new study shows. The information disclosed by these drives includes everything from scanned passports and information from workers with a high level of government clearance to detailed logistics records and internal memos from private companies.

The study, conducted by data erasure company Blancco Technology Group and data recovery company Ontrack, examined some 159 drives sold on eBay's secondary markets in the US, UK, Germany, and Finland. Researchers purchased used hard drives from leading brands including Samsung, Dell, Seagate, HP, and Hitatchi at random. As a part of the study, they asked the sellers whether they had performed proper data sanitization to ensure no data was left behind. Though every seller said they had erased everything, the results told a different story. 

"This demonstrates that sellers are attempting to permanently wipe data and see the importance of this process," the report explained. "However, many are failing to use a fully effective solution."

Using its proprietary data recovery tools, Ontrack was able to recover sensitive information from 42% of the drives. More than 15% of them contained personally identifiable information, including Microsoft Word and Excel files, photos, personal documents, and email files.

The report explained that, for the most part, these sellers erased data by formatting the drive, often passing up on a full format in favor of a quick format, which only overwrites the drive's index but leaves everything else in place. In both cases, quick and full, the formatting process will overwrite data with zeros to remove data, but there's no way to verify that the data is truly gone after formatting. That means data can linger undetected. 

The results from this study were actually encouraging compared with another study: Rapid7 senior security consultant John Frantz bought a variety of devices from regional refurbishing and donation businesses in the Wisconsin area to see how much data was left behind. He found a scant 3% of drives were properly wiped.

The wide range of proper erasure rates shows how inconsistent practices are in the data erasure business. For enterprises, the disposal or recycling of old equipment can be a massive problem of scale. In many cases, enterprises outsource the disposal and recycling of their equipment to refurbishing or reseller outfits. The lesson here is buyer beware: These sellers may be using only rudimentary wiping practices or may not attempt to erase data at all.

"When donating or selling your technology, you should be sure to wipe it yourself rather than relying on the seller to do it for you," Frantz wrote in a March blog post.

Related Content:

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
vanphongphamvinacom
50%
50%
vanphongphamvinacom,
User Rank: Apprentice
4/26/2019 | 3:05:43 AM
Re: No surprise
Yeah! Thank you
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
4/25/2019 | 12:10:23 PM
No surprise
Any third party sale of used is always a threat and hard drives are not alone here.  Ages ago I purchased a Lexmark laserjet for a client that had three such printers but one died - new same printer needs only an assigned IP address on the network but ( !! ) no driver modifications needed to about 12 systems.  Easy.  And printers are empty, right?  Nope, as soon as connected it started pumping out saved print jobs, about 40 of them, of data from whoever owned it last.  So not just drives. 
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
New Attack Campaigns Suggest Emotet Threat Is Far From Over
Jai Vijayan, Contributing Writer,  1/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20391
PUBLISHED: 2020-01-22
An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.
CVE-2019-20392
PUBLISHED: 2020-01-22
An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash.
CVE-2019-20393
PUBLISHED: 2020-01-22
A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.
CVE-2019-20394
PUBLISHED: 2020-01-22
A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.
CVE-2019-20395
PUBLISHED: 2020-01-22
A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.