http://www.computerworld.com/securitytopics/security
/story/0,10801,111148,00.html
By Sharon Fisher
MAY 04, 2006
COMPUTERWORLD
Anybody with five bucks and a little patience may be able to
score
sensitive corporate or customer data on eBay.
If your organization has engaged in the common practice of
disk drive
recycling -- selling unneeded disk drives directly or
through a
service -- company data might wind up for sale on eBay
Inc.'s auction
site, even if the drives have been wiped first.
Idaho Power Co. discovered that possibility last week as it
scrambled
to track down company disk drives that had been sold on eBay
without
having been scrubbed first. The Boise, Idaho-based utility
serves
approximately 460,000 customers in the southern part of
Idaho and in
eastern Oregon.
Data on the drives, which had been used in servers,
contained
proprietary company information such as memos,
correspondence with
some customers and confidential employee information, the
company
said.
Idaho Power had recycled approximately 230 SCSI drives -- a
year's
worth of updates -- through a single salvage vendor, Grant
Korth,
which then sold 84 of the drives to 12 parties through eBay.
The
company recovered 146 of the drives from the vendor. It also
got
assurances from 10 of the 12 parties that bought them on
eBay that the
drives would be returned or the data on them would not be
saved or
distributed. The other two drives are still being tracked
down; an
Idaho Power spokesman did not know what information was on
them.
Nampa, Idaho-based Grant Korth refused to comment. In the
meantime,
Idaho Power has launched an independent investigation
through Blank
Law & Technology PS in Seattle into why its policy on
scrubbing drives
was not followed. Typically, Idaho Power was to have either
physically
destroyed the drives or scrubbed them to U.S. Department of
Defense
standards -- which involves degaussing them or overwriting
the data
with a minimum of three specified patterns -- and the
salvage vendor
was to have done the same, the Idaho Power spokesman said.
The
company's probe could take several months, depending on
what data was
on the drives, he said. Similarly, Idaho Power will not know
what
regulatory penalties might apply until its investigation is
completed.
Idaho Power is not alone, said Frances O'Brien, a research
vice
president for asset management at Gartner Inc. "It
happens all the
time," she said. Typically, a user either doesn't
know to clean the
drives or doesn't do it correctly, she said.
According to a Gartner survey, organizations use outside
companies to
dispose of PCs 29% of the time and to get rid of servers 31%
of the
time. Other methods included donating hardware, putting it
in storage,
selling it to employees, returning it to the vendor and
selling it to
third parties.
Aside from the financial concerns with losing data,
organizations that
improperly recycle disk drives can run afoul of a number of
regulations, depending on their industry: the Health
Insurance
Portability and Accountability Act, the Sarbanes-Oxley Act,
the
Gramm-Leach-Bliley for the banking industry, the Family
Educational
Rights and Privacy Act for educational institutions and the
Fair and
Accurate Credit Transactions Act. In addition, several
states,
including California and New York, have broad-based privacy
regulations, said Robert Houghton, president of Redemtech
Inc., a
Columbus, Ohio-based outsourcer.
The problem is widespread. Gartner estimates that through
2009,
consumers and businesses will replace more than 800 million
PCs
worldwide and dispose of an estimated 512 million.
What's more, a company can get a bad reputation for not
taking proper
care of personal data, O'Brien said. When companies hire an
outsourcer
-- which is a practice that Gartner recommends -- it needs
to be
careful of what the salvage company will do and how they
will prove
it. "If everyone else is charging $20, and someone
says they'll do it
for $2, you've got to wonder why," she said.
Simson Garfinkel, a postdoctorate fellow at Harvard
University's
Center for Research on Computation and Society, researched
the issue
by buying more than 1,000 hard drives on eBay to see what
sort of data
could be gleaned from them. He found disk drives that held
information
from an automated teller machine, a drive from a medical
center that
held 31,000 credit card numbers, a supermarket credit card
processor
and a travel agency that had discarded data on travel plans,
credit
card numbers and ticket numbers. "One of the drives
had consumer
credit applications on it -- names, work histories, Social
Security
numbers -- all the information you need to apply for
credit."
Even though drives may have been wiped of data, someone with
the
know-how and patience could still retrieve information,
Garfinkel
said. Standard tools such as Format and Delete simply remove
the
reference to the files -- the data is still there. Garfinkel
himself
has written a number of tools to retrieve information such
as e-mail
addresses and credit card numbers on wiped disks.
Despite his findings, Garfinkel said companies seem to be
doing a
better job protecting data, and he pointed to the Fair and
Accurate
Credit Transactions Act as a possible reason. "The
percentage of
drives out there that have usable data is going down, so
companies are
more aware of the issue," he said.
Similarly, when Houghton's company has done an audit on
clients'
supposedly wiped disk drives, 25% to 30% of them still had
readable
data, he said.
Idaho Power said that in the future, it will destroy drives
rather
than sell them for salvage -- a policy Garfinkel backs.
"The resale
value of a hard drive is really minuscule, and it's easy to
verify
it's been destroyed," he said. "These things
are worth $5 to $20 each.
I don't think anyone's buying them on the secondary market
for
extortion, but you never know."
_________________________________
Attend the Black Hat Briefings and
Training, Las Vegas July 29 - August 3
2,500+ international security experts from 40 nations,
10 tracks, no vendor pitches.
www.blackhat.com
|