Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

4/25/2019
11:15 AM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Sensitive Data Lingers on Used Storage Drives Sold Online

Four in 10 used hard drives sold on eBay found to contain sensitive information.

A startling number of used hard drives sold on eBay expose sensitive information from their previous owners, a new study shows. The information disclosed by these drives includes everything from scanned passports and information from workers with a high level of government clearance to detailed logistics records and internal memos from private companies.

The study, conducted by data erasure company Blancco Technology Group and data recovery company Ontrack, examined some 159 drives sold on eBay's secondary markets in the US, UK, Germany, and Finland. Researchers purchased used hard drives from leading brands including Samsung, Dell, Seagate, HP, and Hitatchi at random. As a part of the study, they asked the sellers whether they had performed proper data sanitization to ensure no data was left behind. Though every seller said they had erased everything, the results told a different story. 

"This demonstrates that sellers are attempting to permanently wipe data and see the importance of this process," the report explained. "However, many are failing to use a fully effective solution."

Using its proprietary data recovery tools, Ontrack was able to recover sensitive information from 42% of the drives. More than 15% of them contained personally identifiable information, including Microsoft Word and Excel files, photos, personal documents, and email files.

The report explained that, for the most part, these sellers erased data by formatting the drive, often passing up on a full format in favor of a quick format, which only overwrites the drive's index but leaves everything else in place. In both cases, quick and full, the formatting process will overwrite data with zeros to remove data, but there's no way to verify that the data is truly gone after formatting. That means data can linger undetected. 

The results from this study were actually encouraging compared with another study: Rapid7 senior security consultant John Frantz bought a variety of devices from regional refurbishing and donation businesses in the Wisconsin area to see how much data was left behind. He found a scant 3% of drives were properly wiped.

The wide range of proper erasure rates shows how inconsistent practices are in the data erasure business. For enterprises, the disposal or recycling of old equipment can be a massive problem of scale. In many cases, enterprises outsource the disposal and recycling of their equipment to refurbishing or reseller outfits. The lesson here is buyer beware: These sellers may be using only rudimentary wiping practices or may not attempt to erase data at all.

"When donating or selling your technology, you should be sure to wipe it yourself rather than relying on the seller to do it for you," Frantz wrote in a March blog post.

Related Content:

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
vanphongphamvinacom
50%
50%
vanphongphamvinacom,
User Rank: Apprentice
4/26/2019 | 3:05:43 AM
Re: No surprise
Yeah! Thank you
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
4/25/2019 | 12:10:23 PM
No surprise
Any third party sale of used is always a threat and hard drives are not alone here.  Ages ago I purchased a Lexmark laserjet for a client that had three such printers but one died - new same printer needs only an assigned IP address on the network but ( !! ) no driver modifications needed to about 12 systems.  Easy.  And printers are empty, right?  Nope, as soon as connected it started pumping out saved print jobs, about 40 of them, of data from whoever owned it last.  So not just drives. 
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
How a Manufacturing Firm Recovered from a Devastating Ransomware Attack
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-7201
PUBLISHED: 2019-05-22
CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel.
CVE-2018-7803
PUBLISHED: 2019-05-22
A CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex TriStation Emulator V1.2.0, which could cause the emulator to crash when sending a specially crafted packet. The emulator is used infrequently for application logic testing. It is susceptible to an attack...
CVE-2018-7844
PUBLISHED: 2019-05-22
A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading memory blocks from the controller over Modbus.
CVE-2018-7853
PUBLISHED: 2019-05-22
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when reading invalid physical memory blocks in the controller over Modbus
CVE-2018-7854
PUBLISHED: 2019-05-22
A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a denial of Service when sending invalid debug parameters to the controller over Modbus.