ID-theft expert Robert Siciliano bought secondhand devices and found that factory resets leave recoverable data like photos, texts, and login credentials. He recommends military-grade wiping or physically destroying phones before resale to prevent identity theft.
Chapters
So we know your phone is your life. It has everything on it from your photos and messages, your passwords. You might think deleting it all before selling or tossing that smartphone could keep you safe. You're dead wrong. A hacker can still recover all your information. Robert Siciliano is an ID theft expert and CEO of bestidtheftcompany.com. Thanks so much for joining us. So when you go in and you clean off your phone, —so that you can recycle it, so that you can sell it or trade it in, it's not really clean. Is that what you're saying?
Yeah, no, not at all. I actually did a study like this myself. I had bought 30 devices within a 30-mile radius of Boston. I bought laptops, desktops, netbooks, notebooks, iPhones, iPads, BlackBerrys, Androids, all from the secondhand market off of Craigslist. And I asked every single person that I bought from, did you reformat the drive? Did you wipe the data? "Did you bring it back to factory reset?" And every single person said they did. And I brought all of the devices to my hacker, 'cause everybody has a hacker, right?
Yeah, I do.
And my hacker, right? And so he was able to use readily available forensics tools that are on the web, like they work as easy as Microsoft Office documents. And he was able to find data on half of the documents. I'm sorry, he was able to find data on half of the devices that could be used to steal identities.
Things like— yeah, let me list some of the things for our viewers. Deleted images and videos, those are still there. You think you've wiped out pictures that you've downloaded to your phone, they're still there. Bank details on your app, on apps, if you've gone in and put your passwords in. Emails, SMS texts, web browsing history, even geopositioning and location. These are some of the things that are on there. So what do you do about it?
Yeah, basically, uh, when you think you've wiped the drive, you haven't. What you've wiped is basically the, the path to the data. The data is still there in a number of different ways, including usernames and passwords, and like you said, videos and pictures and SMS texts and everything else. And the only way to really solve that problem is to, is to use military-grade wiping techniques, which most consumers don't have access to. What I recommend that people do is not to sell the devices in the secondhand market, really to destroy them. Because what you're going to get for an old—
like, with a hammer? I mean, what do you— what do you mean, like, destroy? Run it over with your car?
I mean, like, safety glasses and a hammer. Yes. Otherwise, if you don't destroy that device, once you hand it over to somebody, say for $50, you're selling your identity for $50. That's what you're doing.
Wow. And that's true of your computer, everything else. Every time you think you're reformatting the drive, you're scrubbing it, you're cleaning it, you're not really doing that. What about, um, this— the Blackphone that's coming out that's supposedly NSA-proof, impossible to hack? Have you heard about this?
Do you believe in it? Yes, well, it is a prototype at this point. We haven't seen it. You know, the, the BlackBerry itself isn't the Blackphone, but the BlackBerry does a really good job of, of eliminating data, of, of, of keeping the data, uh, off of the drive on a factory reset. Same thing with the iPhone and the iPad. They do a pretty good job of removing the data as well. It's the Android operating system that we've the most problems with. Mm-hmm. So there's ways to get rid of the data, uh, beyond destroying the device, but consumers need to do their research before they just sell it or give it away in the secondhand market.
