Robert Siciliano bought used phones, tablets, and computers on Craigslist and recovered sensitive personal data from most of them despite sellers' attempts to wipe them clean. BlackBerry and Apple devices were harder to crack, while Android and Windows XP often left recoverable data. The segment warns that used devices can also come with preinstalled malware.
Chapters
I buy and sell things on Craigslist, and so does everybody else.
Thinking about selling it, recycling it, or giving it away?
Maybe you should take a cue from Herb and destroy it. You're about to find out why. Digital devices can spill your secrets even after those devices have been wiped clean.
Consumer Problem Solver Herb Weissbaum is here with more on what to do and what not to do with your used gadgets.
And I was surprised that I found people's entire digital lives.
Robert Siciliano is an identity theft expert with McAfee, the digital security software company. And like many of us, he would sell his old digital devices when he upgraded to new ones. Not anymore.
I will never, ever sell a device that has storage in it ever again.
Here's why. Robert Siciliano did a little experiment. He went on Craigslist and bought a bunch of digital devices.
I bought iPhones, iPads, laptops, desktops, netbooks, notebooks. I wanted to see what type of information I could find on them.
Of the 30 devices you bought, how many were you able to retrieve data from?
I was able to retrieve data on over half of them.
And here's the really scary part. In most cases, the person selling the device thought they'd purged the data by following the manufacturer's instructions. But for someone who knows computers, it wasn't hard to retrieve.
I bought this from a student. It had all of his personal information, banking information. It had photos and videos, videos of him at a concert, and a lot of pornography. Way too much information for me. This was from a consumer desktop. This had the family's entire personal information, their banking information, their Social Security numbers, enough data to steal their identities or take over existing accounts. This hard drive came off of a laptop from a business. This had all kinds of business documents, employee records. This device right here would be considered a data breach with the amount of information that was on there.
Siciliano says equipment manufacturers and software developers need to do a better job so people can effectively erase and delete the data stored on their devices.
The problem with a lot of the digital devices that we have today is when you reset the operating system, when you reinstall or reformat, it doesn't often do the job in which it says it does. So you're leaving a lot of breadcrumbs that can be all spliced back together, which allows a bad guy to basically steal your identity.
Siciliano says BlackBerrys were the best at completely scrubbing deleted data. Apple products also did a good job. He says Android devices were the worst. Even when people did a factory reset, he could still find a tremendous amount of data. Siciliano also found that it's hard to completely scrub devices that run on Windows XP. Based on what you now know, will this change your behavior when you have an old device you no longer want?
This study scared me so much because I'm just as guilty as anyone else for selling, you know, used devices on Craigslist. I will never ever sell a device that has storage in it ever again. I will take it and put it in a vice and I will drill holes through it. I will smash it with a sledgehammer. Or I'll put it in a bucket of salt water for a year. But you're not gonna see me selling it on Craigslist.
Asked to respond to this little experiment, Microsoft tells me its new software has considerably better security and privacy. Google did not respond. Now, one more thing you should know: many of the used smartphones and computers Siciliano bought came with viruses or other malicious software already in them. If he had used them, his personal information could have been compromised. Something to think about before you buy someone else's digital device. The money you save may not be worth the potential risk. Dan.
