Ensure Proper Data Management with Discarded IT Assets

Simson L. Garfinkel
Center for Research on Computation and Society
Harvard University
Thursday, November 3, 9:45am

1Ten used computers were purchased in August 1998.

This is computer #1.
2

Computer #1 was a file server for a 15-attorney law firm.
Contents:• client documents• billing records• correspondence
Computers #2 through #10 had:
• Mental health records• Home finances• Draft of a novel
Was this a chance accident or common occurrence?
3This talk explores the problem of data on discarded
computers and presents real, practical solutions.
2, 500

Megabytes

2, 000• Scale of the problem

1, 500No Data (blocks cleared)
Data not in the file system (level 2 and 3)
Data in the file system (level 0)

1, 0005000• The Traceback Study• Applicable Legislation• Answers and Technology Choices

4Data confidentiality is an important business goal.

Data can be:• In flight• Stored

Data spends most of its life in storage.
Therefore, stored data must be protected.
5There are three techniques for assuring data confidentiality.

1. Physical security.
2. Logical access controls. (operating system)

3. Cryptography (disk & link)

6

When a disk is retired, techniques #1 and #2 don’t work.

1. /Physical//////////////////////////security.
//////////////////////
2. /Logical///////////////////////access//////////////////////controls.////////////////////////////(operating///////////////////////////////system)//////////////////////

3. Cryptography (disk & link)

Most organizations don’t encrypt their stored data.
7

Hard drives pose special problem for computer security.

Do not forget data when power is removed.
Contain data that is not immediately visible.
Today’s computers can read hard drives thatare 15 years old!
• Electrically compatible (IDE/ATA)• Logically compatible(FAT16/32 file systems)• Very different from tape systems

8

The problem: 210 million drives will be retired this year.
400M
350M

Drives Shipped
Drives Retired

300M
250M
200M
150M
100M
50M
1996

1998

2000

2002

2004

2006

This is a staggering amount of data!
9

“Retire?”

Deckard (Harrison Ford) retiring a replicant.
“Blade Runner” (1982)10

Many “retired” hard drives are actually resold orrepurposed.

Retired drives are:• Re-used withinorganizations• Given to charities• Sold at auction

About 1000 used drives/day sold on eBay.
11

Bad news:
FORMAT C: doesn’t erase the hard drive.

FORMAT just writes a new root directory.

12

More bad news:
DEL doesn’t delete files.

DEL simply removes the file’s name from the directory.
13

Between January 1999 and April 2002,
I acquired 236 hard drives on the secondary market.

14

Drives arrived by UPS

15

Data on drives “imaged” using FreeBSD

dd if=/dev/ad0 of=file.img bs=65536 conv=noerror,sync 16

Images stored on a RAID

17

Example: Disk #70: IBM-DALA-3540/81B70E32
Purchased for $5 from a Mass retail store on eBay
Copied the data off: 541MB
Initial analysis:
Total disk sectors: 1,057,392
Sectors with data:
989,514
Sectors all zero:
67,878
Total files:
3
The files:
drwxrwxrwx-r-xr-xr-x-r-xr-xr-x-rwxrwxrwx

0 root0 root0 root0 root0 Dec 31222390 May 11
9 May 1193880 May 11

1979 ./
1998 IO.SYS
1998 MSDOS.SYS
1998 COMMAND.COM
18

Clearly, this disk had been FORMATed...

Windows FORMAT doesn’t erase the disk...
FORMAT just writes a new root directory.

19

UNIX “strings” reveals the disk’s previous contents...

Insert diskette for drive
and press any key when readyYour program caused a divide overflow error.
If the problem persists, contact your program vendor.
Windows has disabled direct disk access to protect your lo
To override this protection, see the LOCK /? command for m
The system has been halted. Press Ctrl+Alt+Del to restart
You started your computer with a version of MS-DOS incompa
version of Windows. Insert a Startup diskette matching thi

OEMString = "NCR 14 inch Analog Color Display Enchanced SV
Graphics Mode: 640 x 480 at 72Hz vertical refresh.
XResolution= 640
YResolution= 480
VerticalRefresh= 722070.img con’t...

ling the Trial Edition---------------------------IBM AntiVirus Trial Edition is a full-function but time-lievaluation version of the IBM AntiVirus Desktop Edition pr
may have received the Trial Edition on a promotional CD-RO
single-file installation program over a network. The Tria
is available in seven national languages, and each languag
provided on a separate CC-ROM or as a separa
EAS.STCm
EET.STC
ELR.STCq
ELS.STC21

70.img con’t...
MAB-DEDUCTIBLE
MAB-MOOP
MAB-MOOP-DED
METHIMAZOLEINSULIN (HUMAN)
COUMARIN ANTICOAGULANTSCARBAMATE DERIVATIVESAMANTADINEMANNITOL
MAPROTILINECARBAMAZEPINECHLORPHENESIN CARBAMATEETHINAMATEFORMALDEHYDE
MAFENIDE ACETATE22

[Garfinkel & Shelat 03] established the scale of the problem.

We found:• Thousands of credit card
numbers (many disks)• Financial records• Medical information• Trade secrets• Highly personalinformation

We did not determine why the data had been left behind.
23

There are roughly a dozen documented cases of people
purchasing old PCs and finding sensitive data.

• A woman in Pahrump, NV bought aused PC with pharmacy records[Markoff 97]• Pennsylvania sold PCs with“thousands of files” on state
employees [Villano 02]• Paul McCartney’s bank records soldby his bank [Leyden 04]• O&O Software GmbH – 200drives.[O&O 05]

24

Information is even left behind on USB drives...

A “new” drive contained images from a previous owner.

25

Why don’t we hear more stories?
Hypothesis #1: Disclosure of “data passed” is exceedingly
rare because most systems are properlycleared.
Hypothesis #2: Disclosures are so common that they are notnewsworthy.
Hypothesis #3: Systems aren’t properly cleared, but few
people notice the data.

26

How could people not notice the data?

DEL removes the file’s name; doesn’t delete the data.
27

Weird Stuff, Sunnyvale California,January 1999

10GB drive: $19 “tested”
500 MB drive: $3 “as is”
Q: “How do you sanitize them?”
A: “We FDISK them!”

28

FDISK does not sanitize disks
10 GB drive: 20,044,160 sectors

Sectors
Command Written%
FORMAT
21,541 0.11%
FDISK
2,563 0.01%

FORMAT erases the FAT,
complicating the recovery of fragmented files.

29

Data on a hard drive is arranged in sectors.

/atmp

usr

binbslg

lsbethmailjunkcp

The white sectors indicate directories and files that arevisible to the user.

mv

30

Data on a hard drive is arranged in sectors.

x8ax7/

x5tmp

usrx4

binx1x6bslg

lscp

mv

beth

mailjunkx3x2

The brown sectors indicate files that were deleted.
31

Data on a hard drive is arranged in sectors.

x8

ax7/

x5tmp

usrx4

binx1x6bslg

lscp

mv

beth

mail

junkx3x2

The green sectors indicate sectors that were never used (orthat were wiped clean).
32

Stack the disk sectors:

Zero Blocks
x8/

Deleted Filesax7x5tmp

usrx4

binx1x6bslg

lscp

mv

bethmailjunkx3x2

Files.

33

NO DATA: The disk is factory fresh.
.

Zero Blocks

Deleted Files
All Blocks are
ZeroFiles.

time

34

FORMATTED: The disk has an empty file system.

Zero Blocks

Deleted
Files
Blank
AllBlocks
Blocks are
Zero
Files
File System Structures
.

time

35

AFTER OS INSTALL: Temp. files have been deleted.

Zero Blocks

Deleted
Files
Blank
AllBlocks
Blocks are
Free Blocks
ZeroFiles

Deleted temporary files

OS andApplications
File SystemStructures
.

time

36

AFTER A YEAR OF SERVICE.

Blocks never written

Zero Blocks

Deleted files
DeletedFiles
Blank
AllBlocks
Blocksare...
... 1 year
Free Blocks
ZeroFiles

OS, Applications,and user
Deleted temporary
files files

OS and Applications
File System Structures
.

time

37

DISK NEARLY FULL!
.

Blocks never written

Zero Blocks

Deleted files
OS, Apps,
DeletedFiles
Blankuser files,
AllBlocks
Blocksare...
... 1 year
Free Blocks
and lots ofZero
MP3s!
OS, Applications,and user
Files
Deleted temporary
files files
OS andApplications
File SystemStructures
.

time

38

FORMAT C:\ (to sell the computer.).

Blocks never written

Zero Blocks

Deleted files
OS, Apps,
DeletedFiles
Blankuser files,
AllBlocks
Blocksare...
... 1 year
Free Blocks
andlots ofRecoverable
ZeroMP3s!
Data
OS, Applications,and user
Files
Deleted temporary
files files
OS and Applications
File System Structures
.

time

39

We can use forensics to reconstruct motivations:.

OS, Apps,
Usability
user files,failure
andlots ofRecoverable
MP3s!
Data

Training
failure.

time

40The drives are dominated by failed sanitization attempts...
2, 500

Megabytes

2, 0001, 500No Data (blocks cleared)
Data not in the file system (level 2 and 3)
Data in the file system (level 0)

1, 0005000..but training failures are also important.
41

Overall numbers

Drives Acquired:
Drives DOA:
Drives Images:
Drives Zeroed:
Drives “Clean Formatted:”
Total files:
Total data:

236
60
176
1122
168,459
125G

42

Only 33 out of 176 working drives were properly cleared!
• 1 from Driveguys — but 2 others had lots of data.
• 18 from pcjunkyard — but 7 others had data.
• 1 from a VA reseller — 1 DOA; 3 dirty formats.
• 1 from an unknown source — 1 DOA, 1 dirty format.
• 1 from Mr. M. who sold his 2GB drive on eBay.

43

But what really happened?

?
I needed to contact the original drive owners.
44

The Remembrance of Data Passed Traceback Study.
[Garfinkel 05]
1. Find data on hard drive
2. Determine the owner
3. Get contact informationfor organization
4. Find the right person
inside the organization
5. Set up interviews

06/19/1999 /:dir216/Four H Resume.doc
03/31/1999 /:dir216/U.M. Markets & Society.doc
08/27/1999 /:dir270/Resume-Deb.doc03/31/1999 /:dir270/Deb-Marymount Letter.doc
03/31/1999 /:dir270/Links App. Ltr..doc
08/27/1999 /:dir270/Resume=Marymount U..doc
03/31/1999 /:dir270/NCR App. Ltr..doc
03/31/1999 /:dir270/Admissions counselor, NCR.doc
08/27/1999 /:dir270/Resume, Deb.doc
03/31/1999 /:dir270/UMUC App. Ltr..doc
03/31/1999 /:dir270/Ed. Coordinator Ltr..doc
03/31/1999 /:dir270/American College ...doc
04/01/1999 /:dir270/Am. U. Admin. Dir..doc
04/05/1999 /:dir270/IR Unknown Lab.doc
04/06/1999 /:dir270/Admit Slip for Modernism.doc
04/07/1999 /:dir270/Your Honor.doc

6. Follow guidelines forhuman subjects work

This was a lot harder than I thought it would be.
45

Ultimately, I contacted 20 organizations between April 2003
and April 2005.

46

The leading cause: betrayed trust.
Trust Failure: 5 cases
4 Home computer; woman’s son took to “PC Recycle”
4 Community college; no procedures in place
4 Church in South Dakota; administrator “kind of crazy”
4 Auto dealership; consultant sold drives he “upgraded”
4 Home computer, financial records; same consultant

This specific failure wasn’t considered in [GS 03];
it was the most common failure.

47

Second leading cause: Poor training and supervision
Trust Failure: 5 cases
Lack of Training: 3 cases
4 California electronic manufacturer
4 Supermarket credit-card processing terminal
4 ATM machine from a Chicago bank

Alignment between the interface and the underlying
representation would overcome this problem.

48

Sometimes the data custodians just don’t care.
Trust Failure: 5 cases
Lack of Training: 3 cases
Lack of Concern: 2 cases
4 Bankrupt Internet software developer
4 Layoffs at a computer magazine

Regulation on resellers might have prevented these cases.

49

In seven cases, no cause could be determined.
Trust Failure: 5 cases
Lack of Training: 3 cases
Lack of Concern: 2 cases
Unknown Reason: 7 cases
8 Bankrupt biotech startup
8 Another major electronics manufacturer
8 Primary school principal’s office
8 Mail order pharmacy
8 Major telecommunications provider
8 Minnesota food company
8 State Corporation Commission

Regulation might have helped here, too.
50

Legislative reactions to this research:“Fair and Accurate Credit Transactions Act of 2003” (US)• Introduced in July 2003. Signed December
2003.
• Regulations adopted in 2004, effective
June 2005.
• Amends the FCRA to standardize
consumer reports.
• Requires destruction of paper or electronic“consumer records.”

The adopted rules specifically exempt resellers.
51

There are three options for solving this problem.

1. Encrypt stored data.

2. Clear drives before discarding them.

3. Physically destroy drives when discarding.
Of these options, encryption is the best alternative.
52

Encryption protects protects data against anyone who
doesn’t have the keyOptions:• Record-level encryption• Database encryption• Encrypted file systems
Apple’s File Vault is aneasy-to-use encrypted filesystem.
53

Drives can be individually “cleared” before they arerepurposed or retired.
Commercial Software• Wipe Drive, White Canyon Software.
http://www.whitecanyon.com/• Blancco Data Cleaner
http://www.blancco.com/
Free Software:DBAN• DBAN
http://www.dban.sourceforget.net
Wiping an entire drive is easy.
Selectively wiping is hard.
54

Features to look for in a wiping program:x8• Cost: Free? Per copy? Per use?
• Bootable disk?

ax7/x5tmpusrx4binx1x6bslg

ls

cp

mv

beth

mailjunkx3

x2• Wipe whole drive?

/• Wipe slack space?
atmp

usr

binbslg

ls

beth

mailjunkcp

mv

Program that wipe slack space can be installed on every
desktop.
55

Physical destruction offers the most security.

Destruction is the only technique approved for use withclassified information.

56

Summary
Information left on hard drives:• is a serious problem.
• is invisible• violates Federal law• is easily addressThis is largely the fault of Microsoft, Apple, and Linux.
Destroying this information is your organization’s legal and moral
obligation.
Questions?
57