Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

4/25/2019
11:15 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Sensitive Data Lingers on Used Storage Drives Sold Online

Four in 10 used hard drives sold on eBay found to contain sensitive information.

A startling number of used hard drives sold on eBay expose sensitive information from their previous owners, a new study shows. The information disclosed by these drives includes everything from scanned passports and information from workers with a high level of government clearance to detailed logistics records and internal memos from private companies.

The study, conducted by data erasure company Blancco Technology Group and data recovery company Ontrack, examined some 159 drives sold on eBay's secondary markets in the US, UK, Germany, and Finland. Researchers purchased used hard drives from leading brands including Samsung, Dell, Seagate, HP, and Hitatchi at random. As a part of the study, they asked the sellers whether they had performed proper data sanitization to ensure no data was left behind. Though every seller said they had erased everything, the results told a different story. 

"This demonstrates that sellers are attempting to permanently wipe data and see the importance of this process," the report explained. "However, many are failing to use a fully effective solution."

Using its proprietary data recovery tools, Ontrack was able to recover sensitive information from 42% of the drives. More than 15% of them contained personally identifiable information, including Microsoft Word and Excel files, photos, personal documents, and email files.

The report explained that, for the most part, these sellers erased data by formatting the drive, often passing up on a full format in favor of a quick format, which only overwrites the drive's index but leaves everything else in place. In both cases, quick and full, the formatting process will overwrite data with zeros to remove data, but there's no way to verify that the data is truly gone after formatting. That means data can linger undetected. 

The results from this study were actually encouraging compared with another study: Rapid7 senior security consultant John Frantz bought a variety of devices from regional refurbishing and donation businesses in the Wisconsin area to see how much data was left behind. He found a scant 3% of drives were properly wiped.

The wide range of proper erasure rates shows how inconsistent practices are in the data erasure business. For enterprises, the disposal or recycling of old equipment can be a massive problem of scale. In many cases, enterprises outsource the disposal and recycling of their equipment to refurbishing or reseller outfits. The lesson here is buyer beware: These sellers may be using only rudimentary wiping practices or may not attempt to erase data at all.

"When donating or selling your technology, you should be sure to wipe it yourself rather than relying on the seller to do it for you," Frantz wrote in a March blog post.

Related Content:

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
vanphongphamvinacom
50%
50%
vanphongphamvinacom,
User Rank: Apprentice
4/26/2019 | 3:05:43 AM
Re: No surprise
Yeah! Thank you
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
4/25/2019 | 12:10:23 PM
No surprise
Any third party sale of used is always a threat and hard drives are not alone here.  Ages ago I purchased a Lexmark laserjet for a client that had three such printers but one died - new same printer needs only an assigned IP address on the network but ( !! ) no driver modifications needed to about 12 systems.  Easy.  And printers are empty, right?  Nope, as soon as connected it started pumping out saved print jobs, about 40 of them, of data from whoever owned it last.  So not just drives. 
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19551
PUBLISHED: 2019-12-06
In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site. An attacker with access to the User Control Panel application can submit malicious values in some of the time/date formatting and time-zone fields. These fields are not b...
CVE-2019-19552
PUBLISHED: 2019-12-06
In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the user management screen of the Administrator web site, i.e., the/admin/config.php?display=userman URI. An attacker with sufficient privileges can edit the Display Name of a user and embed malicious XSS code. When another user...
CVE-2019-19620
PUBLISHED: 2019-12-06
In SecureWorks Red Cloak Windows Agent before 2.0.7.9, a local user can bypass the generation of telemetry alerts by removing NT AUTHORITY\SYSTEM permissions from a malicious file.
CVE-2019-19625
PUBLISHED: 2019-12-06
SROS 2 0.8.1 (which provides the tools that generate and distribute keys for Robot Operating System 2 and uses the underlying security plugins of DDS from ROS 2) leaks node information due to a leaky default configuration as indicated in the policy/defaults/dds/governance.xml document.
CVE-2019-19627
PUBLISHED: 2019-12-06
SROS 2 0.8.1 (after CVE-2019-19625 is mitigated) leaks ROS 2 node-related information regardless of the rtps_protection_kind configuration. (SROS2 provides the tools to generate and distribute keys for Robot Operating System 2 and uses the underlying security plugins of DDS from ROS 2.)