Slashdot Mirror
Not-So-Clean Hard Drives For Sale
Saeed al-Sahaf writes "The Register is running a story about a security consulting company that as part of a study bought hard drives and laptops on eBay, and then was able to recover highly sensitive data including customer databases, financial information, payroll records, personnel details, login codes, and admin passwords for their secure Intranet site. This is a bit scary considering all of these drives were supposedly formatted and sold for surplus by major companies (although few of us actually use the multiple formatting standards of the DoD). Looks like it's hardly necessary for crooks to get at your private information, although I sure industrial espionage spooks have probably done this for awhile." Shades of the recent post about recovering sensitive contents from swap partitions.
To whoever bought my old hard drive on eBay, those pictures were all for research purposes only.
Sincerely
Peter Townshend
Perhaps more useful than yet another pointless scaremongering exercise would be for the company that now owns the drives to go back to the companies that they bought them off to find out how they were erased so we could find out how not to do it, and where they were not successful in recovering info to go back to those companies to find out how they did wipe that info properly.
The point is to learn something from it.
If you're really paranoid about your data then don't sell your hard drives, even if you have used US DoD-levels of formatting. Duh.
Rather than make a few tens of dollars selling an old drive, take it apart, and burn the platters until they're nothing more than dust. Problem solved.
"Accept that some days you are the pigeon, and some days you are the statue." - David Brent, Wernham Hogg
This reminds me a lot of this story.
Simplified summary of both: buy some hard drives on eBay and you could end up with some cool data!
Stop, timothy... we've heard this joke before. In fact, you seem to post this same story every nine months or so.
Circa September 2003... nine months ago.
Circa January 2003... eighteen months ago.
Then again, we've been talking about this problem for a year and a half, yet there still are people stupid enough to be selling HDs with readable data that should be kept secret on them without doing DOD-level formatting.
- Get a Torx screwdriver set from your local hardware store.
- Open the hd. Save the cool looking screws.
- Turn the platters into coasters.
- Just make sure you don't hurt yourself when playing with the magnets.
Maybe someone bought the old hard drives from a /. server, grabbed the admin passwords for the site, and keeps posting the old articles they recover!
It makes perfect sense. Surely the admins can't keep making these mistakes over and over...
err, nebbermind.
kM
-- You can't drink all day. (Unless you start in the morning...)
That is only gratis software, so you really don't know how well it works, if at all.
A better choice is Eraser, it is GPLed.
http://sourceforge.net/projects/eraser/
You can also make a nuke boot disk with this program that automatically starts erasing everything upon start up. Don't forget to clearly label it ;).
3dinfo@maficstudios.com
Why destroy something that is perfectly reusable? We waste enough resources as it is. If anything, give them away to low-budget institutions in need. I'm sure the cost of low-level formatting a bunch of drives really isn't all that high.
Waste = bad.
-- n
No, because these days you're not supposed to do the low-level formatting yourself. That's done by the manufacturer.
- remove drive from machine,
- remove screws from drive,
- split HD case open,
- smash to bits.
No data leaks. Really! Kind of brings a tear to the eye of the guy with the screwdriver and hammer though.Well that depends on what you mean by 'low level format'.
Re-formatting ata hard drives at a truly low level can mess the disk organisation in ways that seriously degrade performance.
If your referring to a 'full' format with does more than the 'quick' format that mearly marks the drive as empty, well it's easy, and of very little use in this case.
Simply writing zeros to every location on the hard drive that stores data doesn't completely erase the data. That is the magnetic field of the bits are not set at exactly '0'. Slight variations in the magnetic material, write head field strength, and positioning all contribute to increase the odds of data being recoverable.
One way to improve your odds is to repeatedly write a series of 1's and 0's to a location to help average out these variables as well as use the hysteresis(sp?) effect to 'degause' the location, this is what 'shredder' programs do (the ones that aren't crap).
Some programs even go so far as to not simply write 11111111 then 00000000 over and over to the same byte, but to use other patterns so that the fields of niegboring bits add to the deguas effect in destroying the data.
At one time (and probably to this day) the US DOD specs used to require a certain number of passes of 0 and 1 bits followed by the writing of a specific bit pattern before a hard drive was considered to have been properly erased.
And yes each pass does put a little wear and tear on the drive, not enough to worry about unless your 'shredding' the drive quite a few times, but still worth noting.
The number of passes used and what if any special patterns are used determine the amount of effort it would take to recover the data, kind of like key length in cryptography. Adjust paranoi settings apropriately. (note: the anology is imperfect as hell, 1024 might be a mediocre key length, but thats enough shred passes to noticeably shorten drive lifespan.)
Mycroft
https://signup.leagueoflegends.com/?ref=4c3ed6600b6ea
Well, that's BS. Nothing even remotely important gets put into a PowerPoint presentation.
I know, I've been to meetings. God, have I been to meetings...
Show me on the doll where his noodly appendage touched you.
There is a good program called DBAN available from dban.sourceforge.net which is linux-based boot disk that does a good job overwriting to at least one of the DoD specs.
It'd figure other industries would do the same. Heck it's your business, your data, your life (well, only of part of it hopefully!) you have on these disk. Why bother with selling them? To get 20$ 50$? The way i see it, selling hard drives is equal to selling random filing cabinet without making sure they're empty.
slightly off-topic side note: :-D
/slightly off-topic side note
Some officers here are so tight about security: One of out tech went out to replace a fried power supply. When walking out with the roasted one, one guy asked: "Hey couldn't there be data on there?" the tech answered a polite "no" with a smile. The guy handed him a pair of cutter and said:"Well why don't you cut-off those wires just to make sure" !!
-- If you actually say LOL instead of laughing, maybe it's time to go outside! --
For this reason, I believe the DOD reccomends writing random data to the disk 7 times, to guarentee that it is destroyed.
Remember, however, that any overwriting makes it impossible to recover data except by special means far beyond that of a normal file recovery program. Tools that recover data after it has been overwritten are not easy to make, and I'm not even sure that they would run on computer hardware. It's possible that such recovery would require special ATA firmware, or even replacing the hard disk firmware.
I'm not an expert, but that is what I've been able to grok from casual reading on the subjectt.
The Cheese Stands Alone.
Horses don't normally wear clothes, you know.
... had this problem with military laptops. What to do if they get invaded and need to dump their data before getting captured lest their tactical data fall into enemy hands?
They tried hotkey combinations, which would trigger a script to delete the hard drive, but they were either too complex to remember, or too easy to accidentally hit.
In the end, they painted a big red 'X' on the underside of the laptop right where the hard drive sits, and instructed the operator "point gun here".
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
Read the entire paragraph quoted from the article:
Data overwritten once or twice may be recovered by subtracting what is expected to be read from a storage location from what is actually read. Data which is overwritten an arbitrarily large number of times can still be recovered provided that the new data isn't written to the same location as the original data (for magnetic media), or that the recovery attempt is carried out fairly soon after the new data was written (for RAM). For this reason it is effectively impossible to sanitise storage locations by simple overwriting them, no matter how many overwrite passes are made or what data patterns are written. However by using the relatively simple methods presented in this paper the task of an attacker can be made significantly more difficult, if not prohibitively expensive.
So it sounds like if you are overwriting your data in the exact same physical location which it currently exists, it should be possible to make the original copy unrecoverable given enough overwrites.
Ah, but with modern disk drives it's basically impossible to be sure that you are writing to the same physical location. The magnetic domains are so small with GMR that temperature fluctuations of just a few degrees can throw off the alignment enough to ensure that complete erasure is not possible.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
A few years ago, DoD spec for erasing info classifed "Confidential" was a minimum of seven passes with varying strings of 1's and 0's. DoD "erasure" for a drive that has held "Secret" data involved opening the case and applying a power sander to each surface until ALL the magnetic media has been sanded off, or in a combat situation where the destroying authority was prepared to sign that time was absolutely critical, thermite or white phosporous grenades. I don't remember offhand what the spec was for Top-Secret, as I never had to know that one.
Who is John Cabal?
*excuse the pun, but it's kind of fitting. but please note the sarcasm.
This is my Sig, this is my Gun. One is for Slashdot and one is for Fun.
Yeah, back about 20 years ago I got so much stuff doing the same thing. My friend and I had a large moving box full of floppies we recoverd, stacks of drives, old backup tapes, credit card numbers, SSNs, vendor statements and account numbers, complete and functional PCs, etc.
For others who plan on trying this out: Don't worry, dumpsters for your average company is clean with no gross shit in it. Oh, and regarding the police.. Wear nasty looking clothes.. I mean, really look like a dirt bag. If you go looking like geekboy from a middle income family, you'll get a trespassing charge against you. If you look like a rat, they will leave you alone. We only had a couple of run-ins with the cops and tenants. They all went pretty well, as we said we were looking for things to sell at the pawn shop.
The key, I have found, when performing a social hack is to always pretend like you recognize authority. Cops will quit caring about pointing out your trespass, real fast, when they manage to get a self-esteem boost by picking on a poor person. The little guilty voice in the back of their head will say "Leave the poor slob alone.. AlooOoone!"
Warning: This will not work if you park your new Volvo next to the dumpster. Park around other cars, if there are any, and be prepared to abandon your vehicle a few hours if you are told to leave by the cops. Oh, and get some strong fabric laundry bags to carry your loot.
This guy who does research on hard drive technology gives away a freeware Secure Erase HDDerase utility that just calls the HARDWARE-BASED Secure Erase capability that is ALREADY BUILT INTO all recent ATA-type hard drives!
We just need to figure out how to get Linux/*BSD/*NIX/Apple/Microsoft to make this an option at the OS or fdisk/format/Disk Utility/Volume Manager utility level so we can all use it easily.
... fell on its face on this count. After the German reunification the Bundesnachrichtendienst, (German Intelligence sercvice, BND for short) combed East Germany for hard drives because the STASI used to pass used ones on to state businesses and institutions. Apparently they were able to recover a fair amount of documentation this way. But the real score was that they found a set of tapes (the famous SIRA tapes) with backups of among other things an index linking agents to the STASI's library of coded agent activity reports which somebody had forgotten to flag for deletion. The problem was of course that the CIA had stolen the directory containing the codename key ie. directory of codename=agents-real-name (aka. "Rosenholz" files) before the BND got to it. So now the CIA knew who all the agents were but no more and the Germans knew how to find out what they were upto. Of course the CIA insisted that the BND hand over the database but refused to trade it for the codename key. Last I knew that request was flatly denied they have now settled on some sort of tit for tat exchange.
So the lesson is, after you whipe your disk, DON'T FORGET THE BACKUP MEDIA!
Only to idiots, are orders laws.
-- Henning von Tresckow