Slashdot Log In
Unclean Military Hard Drives Sold On eBay
Posted by
CmdrTaco
on Thu May 07, 2009 07:44 AM
from the they-should-know-better dept.
from the they-should-know-better dept.
An anonymous reader writes "The Daily Mail reports, 'Highly sensitive details of a US military missile air defense system were found on a second-hand hard drive bought on eBay.
The test launch procedures were found on a hard disk for the THAAD (Terminal High Altitude Area Defense) ground to air missile defense system, used to shoot down Scud missiles in Iraq.
The disk also contained security policies, blueprints of facilities, and personal information on employees (including social security numbers) belonging to technology company Lockheed Martin — who designed and built the system.'
Scary that they did not wipe it to Department of Defense standards, which I believe is wiping the whole disk and then writing 1010 all over it."
Related Stories
Submission: HD with military connection sold on ebay by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
I have to wonder (Score:4, Insightful)
Later:
Where are the corresponding crimes? If a third of the used hard drives on the market really contain such detailed personal or business information, wouldn't you think that at least one group of criminals would be buying as many of these drives as possible? Granted that there would be capital outlay, but a lot of that is recovered by selling the drives again through the vary same channels, and the risk of getting caught would be extremely low. Quantity of information is lower than with network-based methods (eg, keyloggers, sniffers, etc.) or other information-gathering methods, but I would think the quality of the gathered data would be much, much higher. Good enough to resell for a relatively high amount.
It seems, to me, that there is a bit of hyperbole going on here.
Re:I have to wonder (Score:5, Insightful)
Where are the corresponding crimes? If a third of the used hard drives on the market really contain such detailed personal or business information, wouldn't you think that at least one group of criminals would be buying as many of these drives as possible?
Uh, what makes you think that they aren't? Your comment is utterly devoid of value unless you can prove a negative somehow. Good luck!
Parent
Re:I have to wonder (Score:5, Funny)
Your comment is utterly devoid of value unless you can prove you have something worthwhile to respond with. Good luck!
Parent
Re:I have to wonder (Score:5, Funny)
Parent
Re: (Score:3, Insightful)
Re:I have to wonder (Score:4, Insightful)
"prove a negative"? [google.com]
Follow any of the links and never use that idiotic phrase again.
Parent
Re:I have to wonder (Score:4, Funny)
I'm so sorry I got caught speaking English. Next time I'll try to translate into nerd-speak so that those of you with slide whistles in your assholes will pipe down.
Parent
Re:I have to wonder (Score:5, Insightful)
... wouldn't you think that at least one group of criminals would be buying as many of these drives as possible?
Well the black market is a quite complicated. The only groups with enough funding and enough motive to even try to obtain this information (disregarding the middlemen that you're mentioning) would be other nations. Let's say you're an exceptional nerd with enough skills to extract this data into usable form (I think it would be fair to say that many /.-ers fit or could fit this profile given some time to research). How would you go about selling this information to let's say North Korea? Who would you contact? Better yet, who would they allow you to speak to? I doubt you can just pick up the phone and ask the operator to "hook you up with the illest of Kim Jongs". But let's say you actually do get to speak with him (or anybody of importance really). How's your Korean? Ok final hypothesis, let's say you actually do speak Korean. What are you going to say? It's not like you're calling from AT&T to offer him 5$ less monthly fee if he subscribes to the service for 24 additional months.
Basically I see where you're coming from but I wouldn't take the procedure so lightly. Plus there's possibly a lot more important information floating around somewhere that never "got in the wrong hands" as well.
Parent
Re:I have to wonder (Score:4, Interesting)
After reading the book 'spies among us' I've learned that making contact for selling information is just as simple as walking
to an embassy/consulate from the specific country and asking to speak with someone about information..
Parent
Unclean? (Score:5, Informative)
Re:Unclean? (Score:5, Informative)
Parent
Re:Unclean? (Score:4, Insightful)
Most DoD member units approve DBAN already. Especially when it's set to the platter-melting 35-pass Guttman Wipe.
The problem is when someone DOESN'T follow proper procedures. Rules are great and all, but someone is always going to break them in some way
Parent
Re:Unclean? (Score:4, Informative)
Since you apparently don't know what you're talking about: the 35-pass wipe is bullshit, and even the author says so.
http://en.wikipedia.org/wiki/Gutmann_method#Criticism [wikipedia.org]
Essentially some of those patterns are specifically for obsolete MFM drives, and others are specifically for equally obsolete RLL drives. Nowadays you should just use random patterns, and even the DoD is fine with 7 passes.
Parent
Re:Unclean? (Score:4, Funny)
Parent
Re:Unclean? (Score:5, Funny)
When you said The American Security Service (acronym to be determined) I thought for sure, you were going to start a wiping service!
Parent
Re:Unclean? (Score:4, Funny)
Fire is best and most useful but other methods are possible.
Nuke it from orbit. It's the only way to be sure.
Parent
Scary that they sold the disk at all (Score:5, Insightful)
You can wipe a disk with "dd if=/dev/zero of=/dev/sda" and nobody will get anything from it after that, but the problem isn't the technical feasibility of securely wiping a hard disk: It's a problem of procedure. If hard disks are sold, there's always going to be a mishap where disks which were supposed to be wiped are not and sold with the data intact. Also, why was this data not encrypted? Anyway, hard disks are just not worth enough to take these risks. Destroy the disks and do it in-house.
Re:Scary that they sold the disk at all (Score:5, Interesting)
There are much quicker ways then that. In fact, at my old office, we had NSA approved degaussing equipment for hard drives, that destroyed the data permanently (no amount of forensics will be able to retrieve it), but left the drive itself intact for reuse or resale.
The fun part of course is that when you turn it on.. 2 or 3 floors of lights all dimmed at the same time for a few seconds while it powered up and it hummed.. loudly... Thats a powerful magnet :)
Parent
Re:Scary that they sold the disk at all (Score:5, Informative)
Modern drives have "servo tracks" on them - used for setting the head position. If you use an eraser powerful enough to wipe the drive, then the servo track is most likely also wiped - rendering the drive totally useless to most folk.
Parent
Re: (Score:3, Informative)
Re:Scary that they sold the disk at all (Score:4, Informative)
Parent
Re: (Score:3, Informative)
Re: (Score:3, Informative)
If you have access to dd, you probably have access to shred. It makes several passes using different patterns (25 by default), and has the option of zeroing the drive on the last pass. I believe it meets DOD standards. I'm not sure how effective it is with slack space, which often holds recoverable data even after running utilities that are supposed to wipe data off drives, but dd wouldn't be any better.
please... (Score:5, Interesting)
Before people start discussing if drives should be overwritten 32 or 2^32 times, please show me ONE proven example of a regularly zeroed drive being recovered.
This challenge has stood for more than a year.
http://16systems.com/zero.php [16systems.com]
Re:please... (Score:5, Insightful)
It is possible that the people most likely to have the resources and expertise to do this (i.e. govt. security depts.) don't want to announce that they have this capability ...
Parent
Re:please... (Score:5, Funny)
In the UK, the government uses magnetic fields generated by train seats to erase sensitive data.
Parent
Re:please... (Score:4, Insightful)
Why would any company enter a challenge like that? What data recovery company would comply to this: "You also must publicly disclose in a reproducible manner the method(s) used to win the challenge."?
Regardless of wheter it is possible or not, it is definately not worth the trouble for anyone.
Parent
Re:please... (Score:5, Insightful)
Parent
DoD wiping standards (Score:5, Informative)
"which I believe is wiping the whole disk and then writing 1010 all over it."
Taken from DoD 5220.22-M Wipe Standard:
"[...]DoD requires overwriting with a pattern, then its complement, and finally with another pattern; e.g., overwrite first with 0011 0101 [35h], followed by 1100 1010 [CBh], then 1001 0111 [97h]. The number of times an overwrite must be accomplished depends on the storage media, sometimes on its sensitivity, and sometimes on differing DoD component requirements. In any case, a purge is not complete until a final overwrite is made using unclassified data."
Re:DoD wiping standards (Score:5, Interesting)
Certain 3 letter facilities in the US do that.. in fact, any electronic equipment going in.. never leaves. I have seen the destruction of a thumb drive that accidentally made it into the facility (many people arrived for a meeting there), but was caught on the way out and destroyed.
Same facility provides all electronic equipment needed for various press events and what not.
Parent
Re:DoD wiping standards (Score:5, Funny)
What if you had memory issues with your brain and thus have a prosthetic memory installed to help you?
What if the aliens came, and took you back to your home planet?
Parent
Financial Firms Do the Same (Score:5, Informative)
So while this example is no better, I believe it highlights an ongoing problem that involves better user education and disk encryption helps solve.
Re: (Score:3, Funny)
Little OT Anecdote (Score:5, Informative)
What's the point of such strict policy towards your supplier if some dumbass from within will just pawn it off on Ebay?? It's not the first time this happens.
Re:Little OT Anecdote (Score:4, Interesting)
The problem is not necessarily from a gov branch, but most likely a supporting contractor, in this case Lockheed martin.
Same reason why those same contractors are forbidden from using VPN from gov facilities (DOD and Federal atleast) to their home offices. In the past, a certain contractor from a certain company at a certain 5 pointed facility introduced some lovely malware that spread like wildfire fromthe contractors company to the gov facility.
However, like I said, while policy says what not to do, deadlines and management looking the other way sometimes to meet those deadlines and whatnot go against those policies, sometimes nothing happens, sometimes bad things happen.
Parent
In other news.. (Score:5, Funny)
Fine Print: THERE IS NO WARRANTY FOR THE SYSTEM, TO THE EXTENT PERMITTED BY APPLICABLE LAW
Why not just destroy these disks? (Score:3, Insightful)
Re:Why not just destroy these disks? (Score:5, Interesting)
Sometimes it's easier to detect a security problem by letting some information leak.
Parent
Nearly right... (Score:5, Funny)
scary that they did not wipe it to Department of Defense standards which I believe is wiping the whole disk and then writing 1010 all over it.
That's nearly right. The actual procedure is to wipe it to DoD standards, and then load it up with fake documents.
-Loyal
Re:Nearly right... (Score:4, Funny)
scary that they did not wipe it to Department of Defense standards which I believe is wiping the whole disk and then writing 1010 all over it.
That's nearly right. The actual procedure is to wipe it to DoD standards, and then load it up with fake documents.
-Loyal
So you're saying this Area 51 map and Build-Your-Own Nuke instructions I have here might be bogus?
Parent
Who is really to blame? (Score:5, Insightful)
Probably illegally sold (Score:5, Interesting)
The drives were probably illegally sold. DoD requires the destruction of classified drives, and contractors are supposed to follow the same rules. If the drive(s) in question held classified data (which they apparently did), they should have been wiped, then physically destroyed. Sounds like someone bypassed the last step, and tried to make a little profit on the side, by selling the "destroyed" drive.
Disclaimer: I work for a contractor on a US Government contract, working with classified data. (at the five-sided building)
Is it just me... (Score:5, Funny)
Just think of all those people now bidding on old hard drives now... Probably won't be able to pick one up for under £99 by the end of the week
That reminds me... Got a few old ones to sell myself...
For Highly Classified Data, it's more than a wipe (Score:4, Informative)
I worked in a highly classified facility once. The wipe "standard" was to hire a lowly intern (such as myself), remove the platters from the case, take them out back, and sandblast them. The agencies scientists had decided degaussing wasn't good enough.
SirWired
Re:For Highly Classified Data, it's more than a wi (Score:5, Funny)
Parent
Say what? (Score:3, Funny)
wiping the whole disk and then writing 1010 all over it.
Did exactly that. Removed it from a computer. Wiped all over the disk. Then took a marker and wrote all over it. For additional security, wiped it *again* to remove the marker. And you nuts are still claiming there's secrets on it...
</fiction>
A+++++ Vendor! (Score:5, Funny)
Does the IRS do it better or worse? (Score:3, Informative)
I work for the IRS and we supposedly use the DOD standard. Our wiping software actually has a "/DOD" switch. However, unlike the standard quoted in another post, our software just reinitializes the MBR and then does 7 random overwrites. Is that better or worse than writing patterns? I dunno.
I do know, however, that we never let a drive out of our inventory without a wipe. If the drive has failed completely, we have a big magnetic blanker we use. (Local option - in my office, we then take those drives apart, abuse the platters, and one of our techs makes sculptures from them. Neat stuff.)
As an aside, we never RMA drives, either. If a drive in our possession fails, we call for a warranty replacement and send back in the return box a signed statement swearing that we destroyed the old drive. If a laptop has a failure that requires a contractor tech to replace parts, we make them come on-site then have someone stand over them the whole time to make sure they don't try to actually read anything off the drive.
I would expect the military to do at least as well. Am I wrong?
Perhaps we should find new ways to motivate them (Score:3, Insightful)
My guess is that most of this stuff happens through employee laziness, and contractor unaccountability. If you have lobbyists lairing in government to ensure that you keep the contracts no matter what and are able to hide anything under the "national security" red herring then why bother enforcing rules like wiping stuff properly? The idea of being held PERSONALLY responsible, with potential jail time will make people stop and think, specially if the command level have no loophole to blame their underlings for anything the press find out about.
Re: (Score:3, Interesting)