Security researcher Robert Siciliano found that second-hand phones and PCs from Craigslist often retain sensitive data after factory resets or OS reinstalls. Android phones frequently fail to erase files, while iPhones and BlackBerrys reliably wipe them. Recovered data included Social Security numbers, bank details, and corporate records.
Chapters
If you're concerned about identity theft, that's what you should do to your old devices. Robert Siciliano had a hunch valuable data lay dormant in the mountains of cell phones and computers that consumers discard every day. Via Craigslist, Siciliano acquired secondhand phones and PCs from owners who thought they were being careful.
So while the people were doing what they thought they were supposed to do, we still found a tremendous amount of data. That the problem we found is that with the XP operating system, when you go to reinstall the operating system, there are too many options which essentially leave partitions left on the drive that still have your data. And with mobile devices, while the iPhone and the BlackBerry did a really good job of erasing the data, the Android didn't. So even when we did, when someone did a factory reset on an Android, we still found a tremendous amount of information. I found people's entire digital lives. I found their family photos, their family videos. We found a tremendous amount of pornography, pirated videos. Then we found files like PDFs, Word documents, Excel files that had entire families' Social Security numbers on them, bank account information, credit card numbers. We also found an entire company's employee records. I found court documents, child support documents, eviction notices. We found enough data to steal identities by opening up new accounts, taking over existing accounts, or even enough information to damage somebody's reputation.
Did you find any notable patterns in certain brands or types?
Definitely. So with the iDevices, with Apple's products, with the iPad and the iPhone, they did a really good job of factory resetting the information, which means that if you go to your General and then Options menus, you can reset the device back to factory. Both iPhone and iPad, we found little to no data. BlackBerry, same thing. Whereas the Android devices did not. So on 3 out of the 4 Android devices, we found just about everything that was on the device even after, after a factory reset.
Why is this important now? What's going on now that makes this a problem that could just be emerging?
First of all, most people are moving to the Windows 7 operating system and eventually Windows 8. Which means that there are a lot of Windows XP machines, both desktops and laptops, that are available online as secondhand in Craigslist and eBay. Those devices, I would bet as much as half of them, probably still have people's information even if they've reformatted or reinstalled the operating system. And then with the Android devices, people are buying new Android phones and the old Androids are still gonna have people's information on them. That's a really big problem.
So what can consumers do about it?
When it comes to, say, a Windows XP or even a Windows 7 machine, you know, you can go ahead and sell that thing, but you might want to reconsider that. You know, if you're gonna get $50 for it, $75, you may be selling your identity. So I would consider not selling that machine. Maybe recycle the actual device but keep the hard drive and destroy the hard drive. Meaning take that hard drive into your garage, put it into a vise, and drill a bunch of holes through it, and then hit it a bunch of times with a hammer. Really?
Take your aggressions out on the hard drive?
I would beat that thing to death. I would not sell a drive that had your information on it. And then with your mobile devices, you might go ahead and resell that BlackBerry, that iPhone, but with that Android, I'd beat that thing to death as well.
