It's Scary How Much Personal Data People Leave on Used Laptops and Phones, Researcher Finds (gizmodo.com) 116
A recent experiment by Josh Frantz, a senior security consultant at Rapid7, suggests that users are taking few if any steps to protect their private information before releasing their used devices back out into the wild. From a report: For around six months, he collected used desktop, hard disks, cellphones and more from pawn shops near his home in Wisconsin. It turned out they contain a wealth of private data belonging to their former owners, including a ton of personally identifiable information (PII) -- the bread and butter of identity theft. Frantz amassed a respectable stockpile of refurbished, donated, and used hardware: 41 desktops and laptops, 27 pieces of removable media (memory cards and flash drives), 11 hard disks, and six cellphones. The total cost of the experiment was a lot less than you'd imagine. "I visited a total of 31 businesses and bought whatever I could get my hands on for a grand total of around $600," he said.
Frantz used a Python-based optical character recognition (OCR) tool to scan for Social Security numbers, dates of birth, credit card information, and other sensitive data. And the result was, as you might expect, not good. The pile of junk turned out to contain 41 Social Security numbers, 50 dates of birth, 611 email accounts, 19 credit card numbers, two passport numbers, and six driver's license numbers. Additionally, more than 200,000 images were contained on the devices and over 3,400 documents. He also extracted nearly 150,000 emails.
Frantz used a Python-based optical character recognition (OCR) tool to scan for Social Security numbers, dates of birth, credit card information, and other sensitive data. And the result was, as you might expect, not good. The pile of junk turned out to contain 41 Social Security numbers, 50 dates of birth, 611 email accounts, 19 credit card numbers, two passport numbers, and six driver's license numbers. Additionally, more than 200,000 images were contained on the devices and over 3,400 documents. He also extracted nearly 150,000 emails.
I bought a used laptop on eBay once (Score:4, Interesting)
Used to belong to a tax accounting firm.
Fully functioning. Over 100k tax return forms still on the system.
*Everything*, was still there. Names, SSNs, tax id records, addresses, everything.
It's a damn good thing I was honest and DBAN'd that drive immediately.
I contacted the seller and told him this.
Never heard back...
Re:I bought a used laptop on eBay once (Score:5, Insightful)
Re: (Score:2)
It's the sort of thing that the FBI should want to investigate, given the amount of harm that identity theft can cause - and given the data elements you comment were
Re: (Score:2)
While it is stupid to leave personal info, especially THIS much on a laptop or other piece of electronic gear to be sold used.....what crime exactly was committed?
I mean, if there is no crime to be investigated and charged with, then there is no reason to call the FBI or other law enforcement agencies.
And no
remembering Aaron Swartz (Score:2)
There are Federal and State laws that cover notifications of a data breach (Federal doesn't have generic breach rules that I know of, but some laws such as HIPPA have such requirements). Reporting it to the FBI allows them to inform the affected company that there has been a data breach and provide assistance, which they do.
Sure, the first reaction is to want to be a good citizen and report crimes. Then there's remembering just why you shouldn't talk to cops. [youtube.com]
Trusting law enforcement and the legal system to treat you fairly and honestly is for optimists.
Re: (Score:1)
Not American, so I don't know about the FBI angle. Being a Britbong however, reporting it sounds like the type of caper that would result in *all* of your computing hardware being confiscated by law enforcement until it's so obsolete as to be unsaleable.
Not just the items bought second-hand to prove a point, but everything you use. At least this side of the pond, police have a bit of history in being a bit, shall we say, 'indiscriminate' with regard to what they see as evidence-gathering.
Although I do fee
Re:I bought a used laptop on eBay once (Score:5, Insightful)
If it was on E-Bay, consider the possibility the laptop was stolen.
People steal shit like this all the time from desks, vehicles, etc. which is why all of our corporate laptops have full drive encryption.
Links Back to Earlier Article (Score:5, Interesting)
If I can open a slot on the bottom of my laptop and easily replace the internal storage drive (on my PS/3 and PS/4 doing this requires removal of one screw), then I can be 100% certain that I am not leaking data if I sell on my old device. Yes, OK, I still have to buy a new drive and maybe re-install the OS on it, but these are simple enough tasks these days.
With the advent of devices with integrated storage, often soldered on to motherboards, this becomes impossible. What this now means is that the original manufacturer would have to come up with a way to *guarantee* you that all data on embedded storage had been securely wiped. Otherwise, their failure to do that, coupled with negligent design or negligent security implementations, could result in the loss of your personal data.
I wonder how many smartphone/tablet/similar device manufacturers would be willing to step up and own that liability in return for being able to prevent you from upgrading or repairing your device. I'm betting not that many.
Re: (Score:2)
Even if the manufacturer thinks they did a wipe, it might not actually be done. My recommendation is to always use FDE. This way, when the drive is reformatted, there is no way to access the data, especially if the machine uses a TPM, and the TPM is reset.
I recommend FDE on everything, if possible. This way, making sure a complete zeroing isn't as big an issue.
Re: (Score:2)
The other fun part is once the integrated battery is toast, you may have no way to even power up the device to wipe it anymore. I guess you could argue that the device at that point is junk and destroy it to keep the data safe, but that would preclude you from selling it/giving it away for parts.
Expect the same with defunct web sites (Score:1)
Expect someone to mass purchase defunct store web sites to get equivalent data.
Used Laptops (Score:2, Interesting)
I buy a lot of used laptops from people to refurbish and give to local schools that don't have the money to buy them.
I am appalled at what I find on them.
One time I got (they were donated) 10 used IBM Thinkpads from a criminal law firm in town. They did absolutely nothing to purge the hard drives of sensitive client information. All of their files were intact, unencrypted, just sitting in My Documents.
I called them to tell them what they had done and they didn't care one iota. Unbelievable. I could probably
Re: (Score:2, Informative)
OEM licenses follow the machine, retail stay with the original owner.
I used to refurbish computers for a major retailer (Score:2)
What? (Score:2)
I want to know where I can get 41 desktops and laptops, 27 pieces of removable media (memory cards and flash drives), 11 hard disks, and six cellphones for around $600.
Re: (Score:2)
Re: (Score:2)
Oftentimes the person trying to pawn the stuff is likely not the person whose stuff is on the device. Pawn shops do try to check serials and databases to check if something is stolen, but stuff does get through.
Re: (Score:2)
Re: (Score:2)
Depending on how old and outdated it is, you can even get paid to take stuff like that.
One thing he missed (Score:5, Funny)
Always look for crypto-currency wallets/numbers/keys/passwords.
I once found a used laptop with a dogecoin wallet on it, there was still 15 coins in it!
Needless to say, I still went to work the next day.
Re: (Score:2)
Re: (Score:2)
Drill for spinning disks, shredder for SSD (Score:3)
For spinning platters, yeah drill a couple holes. Then it can't be spun without vibrating far more than the width of a track. If you can't spin it, you can read the data from it.*
SSDs have a bunch of little memory chips, of course - and each chip can be read with nothing more than a Raspberry Pi. They really need to go into a shredder, or a fire (not ecological).
Wiping an SSD by writing zeroes to each sector may do nothing but add the sector the "zeroes" list. Writing random data to all sectors will wipe m
Re: (Score:2)
If you have a drive with glass platters -- 95% of laptop drives, just throw it against a concrete floor or sidewalk repeatedly. The glass will shatter, making the drive irrecoverable by all but government actors with billions to spend. You'll hear the bits of broken glass rattling around inside when you shake the drive once it's destroyed.
Laptop 2.5" drives are also very thin. Put it between two bricks like a bridge, hit it with a hammer. The drive will actually bend, bending or shattering the disks and
Re: (Score:2)
I have long handle groove-joint pliers for dealing with 2.5" drives. Not only is it effective and easy for destroying the control board and the drive platters, the crunching noise is actually very satisfying and stress relieving.
3.5" drives go to the drill press.
Re: (Score:1)
Take them apart anyway, the magnets are great!
Re: (Score:2)
But be careful, some are metal covered glass. One of my friends took one apart and started slinging the platters around like a ninja. One hit a wall and absolutely SHATTERED, spraying glass bits everywhere.
Re: (Score:2)
Re: (Score:2)
Most Linux distros come with "shred" installed. Shred was designed to work with older file systems, but can certainly wipe a whole drive as easy as:
shred -z -n 5 /dev/sda
Dumpster diving for laptops (Score:1)
As someone who has dumpster dived for electronics before, it's amazing the shape people throw away hardware in. They crack a screen and don't think about he data on the system, let alone the fact that the laptop still works. I've found tax records, bank passwords, etc on systems I've come across. I'm always a proponent of DBAN and when I find that stuff I'm quick to wipe the system, but I imagine a lot of people's data gets stolen due to carelessness.
How many were stolen? (Score:2)
If he got them all at pawn shops, then many of them could have been stolen. A lot of stolen goods go to pawn shops. The same is true of flea markets.
Re: (Score:2)
Whether they were stolen or not, it doesn't change the fact that the previous owners should have encrypted and/or secure wiped everything on the drives.
*blink*
*blink*
It's a common user problem (Score:2)
without a common user solution.
Pretty much everyone on here knows how to properly wipe a device / drive / whatever.
This crowd, however, doesn't really represent the common user.
To be used effectively by those who don't speak IT fluently, the process of wiping / clearing any
given device needs to be simplified imo.
After educating these people on WHY they need to wipe a device, make sure they have an
easy method to make it happen.
For phones, a built in App wipes the entire phone when the user initiates it. ( T
My solution (Score:5, Funny)
I typically overwrite all sectors on a HD for a month with random crap, and drill holes in the platters.
After that it gets spun around inside a 15 Tesla magnet for 2 hours. Then I use thermite to melt it into a pool of slag, grind up the slag into a fine powder and divide that into 5 equal portions.
I feed one of those portions to my dogs and then set half of their waste on fire and put the other half into the garbage. I use honey to stick another portion to the bird seed I have in a feeder. The third portion I take to a metal recycling place. The fourth portion gets flushed down the toilet. The fifth portion is in a safe deposit box, just in case I need to recover anything.
If I'm being extra careful, I encrypt the drive with ROT13, twice, before the random writes.
Re: (Score:2)
I typically overwrite all sectors on a HD for a month with random crap, and drill holes in the platters.
How well does that work on a small device with a soldered on SSD that just had the screen break and is still under warranty?
Re: (Score:2, Funny)
Same, only you do it to the whole device. Return the firth portion under warranty.
Secrets? (Score:4, Insightful)
>Social Security numbers, dates of birth, credit card information
None of these things is a secret and should not be used as such.
Re: Secrets? (Score:2)
Really? Then provide yours.
Re: (Score:2)
Really? Then provide yours.
I will when they make it illegal to use them as authentication tokens.
Re: (Score:2)
So they are de facto secrets.
Re: (Score:2)
So they are de facto secrets.
Bullshit.
Lots of people know my birthdate - It's been entered on numerous forms.
Lots of people know my SS number - It's been passed around government departments for a long time.
Lots of people have access to my credit card number - Pretty much every time I use it.
That means we live in a de-facto vulnerable state. I don't plan to make myself more vulnerable.
Re: (Score:2)
So you do see how it is a problem that such information is left on sold devices You just pretend not to see it to make a snarky post on /.
Re: (Score:2)
So you do see how it is a problem that such information is left on sold devices You just pretend not to see it to make a snarky post on /.
I see that it is the practice of companies and the government using them as authentication tokens that makes it a problem when they are left on devices.
Re: (Score:1)
Really? Then provide yours.
Okay. 3. I'm really old.
Re: (Score:2)
People USUALLY intend to redeem things they pawn (Score:2)
If you're planning on getting something you use back, and are desperate enough to use a pawn shop to get money, you probably aren't thinking, "Hey, I should invest money I don't have right now in backup media so that I can wipe the contents of this machine I'm planning to get back after I get my paycheck next week."
If you wipe the drive properly, the machine becomes useless to you, even if you get it back.
Of course, if a thief is pawning it, they probably didn't think to wipe the contents. Heck, they may ha
Re: (Score:2)
Re: (Score:2)
Exactly, usually the interest is far better than a payday loan, but they have the collateral.
A payday loan (in my area) costs $75.00 for $500.00 0 interest loan with a 2 week payback. They take a bank account for the deposit and pull the $75.00 to renew your loan if you don't pay it back in 2 weeks. Effectively you're paying $1950/year in fees for a $500 until you pay the principal.
With a pawn shop you use property as collateral, and typically get a loan amounting to 25%-50% of your collateral's thrift/used
Re: (Score:2)
And you can't touch the principal unless you can pay the whole $500.
So you can't even chip away at the loan.
First thing... (Score:1)
Donated machines (Score:1)
I hate to say it....users don't care about privacy (Score:2)
Case in point: People who are concerned about their privacy wouldn't tell 20 million anonymous people that they're going on vacation and, by extension, leaving their house gener
Reputable Recyclers (Score:2)
I would recommend if you're discarding a device, you donate it to a reputable recycler in your area.
I know in my case, as a recycler, we destroy all data on all devices we receive before repurposing them.
You should pick a recycler whom is committed to customer privacy and has certifications for data destruction practices.
Ask your recycler about how they handle data on received devices. Probe deeper if you want, ask to see the procedures taken.
Not every consumer is savvy enough to properly erase devices. S
Device Encryption (Score:2)
This is a great use-case for casual device encryption.
Phone, tablet, desktop PC, on all of these you should consider full device encryption for your storage.
Once an encrypted device is no longer needed, you can discard it safely without worry if was encrypted all along to begin with.
This also helps mitigate the consequences of device theft.
crypto wallets (Score:3)
Every computer I resell I've started checking for cryptocurrency.
Back when BTC was going for a couple bucks, college kids would set up miners on school PCs that I would later buy at surplus sales.
That $5 Core Duo with the massively outdated GPU might be worth its weight in gold.
Re: (Score:2)
Not me! (Score:2)
Re: (Score:2)
Back in the mid-90s, I ended up with a random broken 4x CD-ROM drive that was headed to the trash. It had a Rise of the Triad CD stuck inside. The drive only needed the eject belt put back on.
My discard box (Score:1)
Windows 10 Home (Score:2)
I can't help feeling that Microsoft could significantly improve this situation by including Bitlocker into Windows 10 Home edition.
They could make it even better if was one of the recommended actions in "Action Center" - meaning that Windows would occasionally nag you to set it up.