In this interview, identity‑theft specialist Robert Siciliano discusses a forensic study of about 30 second‑hand computers and mobile devices purchased on Craigslist. The analysis uncovered sensitive personal information—including Social Security numbers, bank and credit‑card details, family photos, videos, legal documents, and even porn—on many of the devices. Windows XP machines and Android phones were found to retain data even after a factory reset, while iPhones, BlackBerrys, and Macs performed better at wiping data but could still be compromised by skilled forensics tools. Siciliano recommends physically destroying hard drives (drilling holes or hammering) for Windows‑based PCs and Android phones, and advises sellers to remove and destroy drives before resale. Buyers are urged to install antivirus/anti‑spyware tools and be wary of potential malware on older devices. The overall message is that the financial and identity‑theft risks of reselling inadequately wiped devices far outweigh any resale profit.
Chapters
The best way to protect yourself from identity theft? My next guest says take a hammer to your old device. No kidding. Robert Siciliano is an identity theft expert and a consultant for the computer security company McAfee. Thanks for coming on the show. I really— listen, I am shocked by this. I have heard that you're supposed to spend all this time erasing stuff, and, and, and now you say no, just get a hammer out. Tell me why.
We bought, uh, 30 devices. We bought laptops, desktops, netbooks, notebooks, iPads, iPhones, BlackBerrys, and Android mobile phones off of Craigslist. So I drove all over Massachusetts in people's living rooms, in their home business offices, and so forth, you know, buying for $20, $50, $100. And I took all the devices, I sent them off to a forensics expert who actually just used tools that are readily available off the internet.
Wow. And what'd you find?
And he was able to— we found people's Social Security numbers, bank account numbers, credit card numbers, their family photos, family videos. We found court documents, child support documents, eviction notices, and a lot of porn. Holy crap.
Well— Yeah. A lot of porn. So how am I supposed to resell this stuff if people picking it up can get all my personal data?
Well, we also found viruses too, by the way. And, um— My fear is, is that all the Windows XP machines that are out there right now, if you were to buy one off the internet, that you'd probably get a virus. If you were to sell one on the internet, you'd probably have your identity stolen. And the same thing with the Android mobile phones. They're a really big problem as well. We found data on them, and even when you reset the device, we also found information as well.
All right, let's talk about Apple, the iPhone, and, uh, RIM, BlackBerry. Is that better or worse?
So both of those phones did a really good job of, of removing the information when the, uh, owner reset the device. So really it was the Windows XP and the, um, Android phones, whereas, uh, BlackBerry and Apple performed very well.
So the takeaway here, and let's be crystal clear here because I, I've never heard this before and I think it's really valuable information, is that if you have a laptop and it's a it uses a Windows interface, right? You're in trouble. You do not want to sell that. You don't want to resell that because you're not going to get it clean. Go after it with a hammer, right?
Same thing with an Android phone. Now you can sell the laptop, you can sell the desktop, but remove the hard drive.
Oh, okay.
Okay, and then take that hard drive and drill a bunch of holes in it or beat it to death with a hammer.
This sounds like a lot of fun. I gotta tell you, Robert, Robert, I have 3 laptops at home sitting that are old that I don't use. They're all Apple. Should I just get out a big hammer?
So with the Apple, uh, Macs fared better. But here's the thing, the, the forensics people that understand how to extract this data off there, the professionals, even the non-professionals, even the guys that are just on the web and they understand how to use these different software programs, they got a way of working their way around and finding the information. So, for the $50 you might get for it, the $100 you might get for it, is it worth risking your identity?
No. No, because the losses there could be so much greater. If somebody gets your Social Security, if they start taking out credit in your name, I mean, the losses there could be hundreds of thousands of dollars.
Right. So, I would destroy the devices, I would destroy the hard drives, I would destroy Android phones. Go ahead and sell your iPhone, go ahead and sell your BlackBerry, but destroy everything else. Uh, and if you're buying secondhand devices, you want to also install antivirus, anti-spyware, anti-phishing as well, because like I said, with the XP machines we bought, we found viruses.
Wow. Okay, I'm gonna get a lot of frustrations out this weekend, let me tell you. Robert, thanks for coming in tonight. Appreciate your time. Great advice.
