Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

4/25/2019
11:15 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Sensitive Data Lingers on Used Storage Drives Sold Online

Four in 10 used hard drives sold on eBay found to contain sensitive information.

A startling number of used hard drives sold on eBay expose sensitive information from their previous owners, a new study shows. The information disclosed by these drives includes everything from scanned passports and information from workers with a high level of government clearance to detailed logistics records and internal memos from private companies.

The study, conducted by data erasure company Blancco Technology Group and data recovery company Ontrack, examined some 159 drives sold on eBay's secondary markets in the US, UK, Germany, and Finland. Researchers purchased used hard drives from leading brands including Samsung, Dell, Seagate, HP, and Hitatchi at random. As a part of the study, they asked the sellers whether they had performed proper data sanitization to ensure no data was left behind. Though every seller said they had erased everything, the results told a different story. 

"This demonstrates that sellers are attempting to permanently wipe data and see the importance of this process," the report explained. "However, many are failing to use a fully effective solution."

Using its proprietary data recovery tools, Ontrack was able to recover sensitive information from 42% of the drives. More than 15% of them contained personally identifiable information, including Microsoft Word and Excel files, photos, personal documents, and email files.

The report explained that, for the most part, these sellers erased data by formatting the drive, often passing up on a full format in favor of a quick format, which only overwrites the drive's index but leaves everything else in place. In both cases, quick and full, the formatting process will overwrite data with zeros to remove data, but there's no way to verify that the data is truly gone after formatting. That means data can linger undetected. 

The results from this study were actually encouraging compared with another study: Rapid7 senior security consultant John Frantz bought a variety of devices from regional refurbishing and donation businesses in the Wisconsin area to see how much data was left behind. He found a scant 3% of drives were properly wiped.

The wide range of proper erasure rates shows how inconsistent practices are in the data erasure business. For enterprises, the disposal or recycling of old equipment can be a massive problem of scale. In many cases, enterprises outsource the disposal and recycling of their equipment to refurbishing or reseller outfits. The lesson here is buyer beware: These sellers may be using only rudimentary wiping practices or may not attempt to erase data at all.

"When donating or selling your technology, you should be sure to wipe it yourself rather than relying on the seller to do it for you," Frantz wrote in a March blog post.

Related Content:

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
vanphongphamvinacom
50%
50%
vanphongphamvinacom,
User Rank: Apprentice
4/26/2019 | 3:05:43 AM
Re: No surprise
Yeah! Thank you
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
4/25/2019 | 12:10:23 PM
No surprise
Any third party sale of used is always a threat and hard drives are not alone here.  Ages ago I purchased a Lexmark laserjet for a client that had three such printers but one died - new same printer needs only an assigned IP address on the network but ( !! ) no driver modifications needed to about 12 systems.  Easy.  And printers are empty, right?  Nope, as soon as connected it started pumping out saved print jobs, about 40 of them, of data from whoever owned it last.  So not just drives. 
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9405
PUBLISHED: 2020-02-26
IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page.
CVE-2020-9406
PUBLISHED: 2020-02-26
IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service.
CVE-2020-9407
PUBLISHED: 2020-02-26
IBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the IWEBSERVICE_JSONRPC_COOKIE cookie.
CVE-2020-9398
PUBLISHED: 2020-02-25
ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows SQL Injection.
CVE-2015-5201
PUBLISHED: 2020-02-25
VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as packaged in Red Hat Enterprise Virtualization before 3.5.6 when VSDM is run with -spice disable-ticketing and a VM is suspended and then restored, allows r...