Slashdot Mirror
Two-Thirds of Second-Hand Memory Cards Contain Data From Previous Owners (bleepingcomputer.com)
Catalin Cimpanu, writing for BleepingComputer: A recent study conducted by academics from the University of Hertfordshire in the UK has revealed that almost two-thirds of second-hand memory cards still contain remnants of personal data from previous owners. For their study, researchers analyzed 100 second-hand SD and micro SD memory cards purchased from eBay, conventional auctions, second-hand shops, and other sources over a four-month period. All in all, researchers say the memory cards they recovered were previously used in smartphones and tablets, but some cards were also used cameras, SatNav systems, and even drones. The research team says the analysis process consisted of creating a bit-by-bit image of the card and then using freely available software to see if they could recover any data from the card. Their efforts were successful and worrisome at the same time, as the team says it managed to recover data from the memory cards, including intimate photos, selfies, passport copies, contact lists, navigation files, pornography, resumes, browsing history, identification numbers, and other personal documents.
...that it's ONLY 2/3rds. Who remembers / bothers to erase that data, anyway? For my cameras and GPSs, I doubt that I'd bother. Info available is immensely non-useful to anyone else. A PC memory I would erase, and spend time writing 1's, 0's, and then random #'s to it, but the other hardware I really wouldn't care about.
And who is SELLING these memory cards, anyway? That's not how you get rid of 'em. You get rid of 'em by losing them. Everybody knows that.
If you weren't a lazy bastard you'd click on the relevant link to see that this study was commissioned by a company.
But you are, so you waste a lot of bandwidth just to be a POS.
That's the first damn thing on my mind whenever such a device is leaving my control.
WTF is wrong with you people? Bell curve, that's what.
Who the heck sells a memory card? They are as cheap as a McDonald's burger, and by the time you exit the store there are already larger ones on sale.
My first program:
Hell Segmentation fault
The only problem is that taxpayers are funding it.
There should be a separation of Education and State.
My secret past-time is buying up old memory cards, finding the goodies, and then blackmailing the former owners, committing industrial espionage, and generally being amused. Now you all have gone and ruined it by warning everyone!
Oh, wait, people are still lazy? Don't care about security? Wouldn't know how to wipe a card even if they did care? Well, then, I guess I'm all set.
disclaimer: this post is in jest
Who proposes such a study and then who approves it?
According to TFA, a company, Comparitech.com, commissioned the study.
Are these the kind of studies Universities should be pursuing?
This wasn't a vast team of world-class researchers. It was likely one undergrad on academic probation working for class credit, sitting at a desk with a small pile of cards, plugging each one into the slot and pushing a button. Total cost: about $200 to buy the cards.
They're on the card, you just need PhotoRec.
Summation 2
I could not find the link to the actual report in the summary or the linked article (unless I missed it). But some googling located it.
https://cdn.comparitech.com/static/docs/survey-data-remaining-second-hand-memory-cards-uk.pdf
It is linked in the story of the company that commissioned the research in the first place: https://www.comparitech.com/blog/vpn-privacy/secondhand-memory-card-study/
I can find that undergrad something better to do, like updating APK's HOST FILES list.
You are all cows. Cows say moo. MOOOOOOO! MOOOOOOO! Moo cows MOOOOOO! Moo say the cows. YOU DBAN-NEEDING COWS!!
Remember that academics have to establish themselves with peer reviewed papers. So they need to study something to get started. Once they get tenured at a university, they can study something serious like basket weaving from 10,000 years ago.
Goodbye, Slashdot!
but alas SD cards don't seem to support it.
Why is it shocking that you can recover unsecured data from a used memory card again? Especially when you're using recovery software to do the job? This one falls into the "no duh," category.
This signature has Super Cow Powers
Two of your questions were answered. You asked, "Who proposes such a study and then who approves it?" The previous comment explains that the study was commissioned by a company. More specifically, the company was Comparitech.com, which is in the article. And since the University of Hertfordshire conducted the study, I'd say there's a good chance they approved it. If you're looking for the name of a specific individual or group who signed off on it, I'd recommend getting in touch with the university directly. With respect to whether these are the kinds of studies that universities should be pursuing, I believe that the pervasive and growing scourge of data and identity theft suggests that they are certainly not without merit. Studies such as these can bolster public education campaigns, make business cases for new approaches to data security and secure deletion, inform private sector and governmental policy decisions related to storage media disposal, and so on. But these points aside, the term "snowflake" is sufficiently charged that I feel it's rather safe to assume that you're on the side of the political divide that believes in the absolute infallibility of the free market, in which case the very fact that this study was commissioned by a private company should justify it. Now, if that assumption is incorrect, and you're just concerned that this study in some way starved a more deserving study on climate change mitigation, for example, then you have my apologies.
Which is ironic, given the high percentage of fat programmers.
#DeleteFacebook
This reminds me of this story.
#DeleteFacebook
But look a who funds these "studies". Think about why they are funding them.
That is what they did. Plugging in second hand devices, That is how I got access to their network.
The second resaearch will be "How many random SD cards do you have to put in before your network is infected."
Don't fight for your country, if your country does not fight for you.
I'm just not understanding why this makes you so angry. Maybe the company has an idea for simplifying the task of secure deletion for non-tech-savvy users, and wanted to commission a quick-and-dirty study to see how prevalent the problem of recoverable data on secondhand media is before proceeding? Maybe they just want to use it as propaganda to convince people to only buy new media, as you suggest (which I agree would be unethical). But to get so upset about it suggests that you feel it is materially harming more deserving research? I just don't think that whoever did this work would have been qualified to instead be working on cancer cures or something. Nor would the company who paid for it have been likely to otherwise spend that money on cancer research. So who's getting hurt here, or "taken in?" I don't see an ulterior motive on the surface, unless it is subsequently used to try to convince people that reusing storage media is inherently unsafe. And I don't see how this work being done prevents other, more significant or "real" research being done.
Good point. There isn't any problem with using Universities for corporate propaganda, which like you said, would be unethical. You make excellent points. No reason to be upset actually. Thanks for the responses!
Next question: How many used infected Windows laptops do you have to sell, before your keylogger sends back some "interesting" data? J/K
This is nothing new. Several years ago, a local electronics junk store got in a bunch of Blackberries of various models (probably a company going out of business) and were selling them for something like $5 apiece. Daughter was a major texter at the time, and liked the retro look and superior keyboard, so we bought several different models so she could switch between them as her mood took her.
We discovered that all but one of them had not been wiped. Appointments, phone numbers, baby pictures, still intact. No sexting, fortunately, but probably only because these phones had been corporate owned. (Which isn't a guarantee, now that I think about it. Maybe we got lucky.) [1]
People either don't understand or don't care about wiping their data. Even the ones that do make an effort often don't understand that deleting the files just deletes the directory entries, not the data itself. Utilities that truly wipe the data from cards (and drives and anything else that potentially holds personal data) are known to tech geeks and privacy geeks but not to Fred and Ethyl User.
[1] Thinking further about it, the last time I "participated" in a layoff, a bunch of us were called to a meeting and told to surrender our badges and phones immediately. I have no idea whether whomever was in charge wiped the phones. Or just sold them on ebay.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
I'm not fat, I've got big ntfs!
"That's the way to do it" - Punch
They should do separate analysis of solid state drives and magnetic drives as well to see if they suffer from the same issue.
Why? That is what I would call: settled science
Incidentally that study on harddisks a few years back also got to the number two-thirds. Maybe two-thirds of people don't know basic data security regardless of what they are selling online :-)
It would cost a bit more but maybe it's time for camera-cards, USB sticks, and the like to routinely use strong encryption with a non-secret-by-default key stored on a the medium itself.
To the end user, it would "just work" except there would be a "quick erase" mode that would scramble the key then either do a normal operating-system-level "long" or "quick" format using the new key.
Even a "quick format" by the OS would be good enough since the left-over data would be encrypted with a now-deleted key.
Now, the key itself would need to be stored on a different part of the device than the rest, one that does not have "wear leveling" applied to it.
It would also require a device that had its own intelligence, but that's a very low bar these days.
As an option, manufacturers could have a volatile and non-volatile copy of the key and allow the host device to read and write the volatile copy (with or without write-back to the non-volatile copy), allowing the device to behave both as a "normal" memory stick or camera card or, optionally, as an "encrypted" data stick or camera card where the host device held the key when power was not supplied to the device.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Most filesystems in common use don't delete the file's contents, so what's your point?