Robert Siciliano bought 30 used devices from Craigslist and found that over half still contained recoverable personal data after factory resets, including Social Security numbers and bank statements. Android phones and Windows XP computers are especially vulnerable. He recommends using dedicated data-wiping tools or physically destroying storage media before selling old devices.
Chapters
You may think you're totally clean. Are you really? Well, our next guest is Robert Siciliano. He is McAfee's online security evangelist. I would love to be known as that.
What a title!
No kidding. It seems like the kind of thing you'd write for yourself.
No, I think that title was given to him.
Well, if you've earned it, that is fantastic. Robert, thanks for getting up early for us this morning. We're all totally nervous.
I don't—
I, you know, I actually have, I think, 4 hard drives in my closet. I never even— I never even get up in the morning with the computer because I was unsure whether they could be completely cleaned out. Are these things we have to worry about?
Well, that's a good place for them. The last thing you want to do is put them into circulation. The study that we did, we had purchased over 30 different devices. They were laptops, desktops, netbooks, notebooks. We bought iPhones, iPads, BlackBerrys, Android devices, and on more than half of the devices that were secondhand— now we bought them off a Craigslist, which is all over the country. I went to people's houses and just bought them, you know, from Craigslist, and over half of them had data still on them. And the majority of those devices had been reset, which means that the person selling them either wiped the hard drive by reinstalling the operating system— they thought they deleted all the data. And the same thing with the Android devices, the iPhones and the BlackBerrys. They had reset the operating system on the device, and we were still able to find information on on again more than half of those devices, which scared me because in the past, you know, I'm just as guilty as anybody else of maybe even selling or giving away one of these devices, and you'd be amazed at how much information we found.
Well, and I understand that you actually found a small business's entire employee record, including Social Security numbers?
Yeah, we found employee records, we found bank statements, credit card statements, court documents, child support documents. We found families' entire, you know, names, addresses, phones, socials for all the family members, usernames and passwords. We were able to recover cookies to access people's websites that they had previously logged into. One guy that I bought a laptop from, he even said to me, he said, you know, if I'm still logged into Gmail, would you mind logging me out?
No way! So how can we keep ourselves safe? I mean, we think we're doing the right thing, we're erasing the hard drives. We want to sell it to make a little money, but now I'm worried to even do that. Is there a better way to do it?
Well, with a Windows 7 machine, Windows 7, with a Mac, with an iPhone, with an iPad or a BlackBerry, you're in pretty good shape when you reinstall or reset the operating system. You generally will get rid of everything. Generally. What you really have to worry about is the Android mobile phones, you know, the Droid, Motorola Droid, and then your Windows XP machines. Your older computers, your older Windows operating systems, they have a lot of data still on them. So what I would recommend is that with most devices, you actively do what you're supposed to do to reset, to reinstall, to reformat. There's many programs you can also install that will also additionally wipe that data. But if you don't have to sell it, if you don't have to give it away, I would destroy the device. I would actually drill holes through the device, hit it with a sledgehammer, put it in a bucket of salt water for a year. If you have the little SD or them, or micro devices, the small little disks. I would bend them up and break them up. I wouldn't give them away or sell them with the phone either. You really want to make an effort to destroy the drives if you can.
Wow, I had no idea that we really had to take those extreme measures to make sure that we stay safe.
I think people have wondered too, you know, if you have a hard drive, how can it really be destroyed? But you're saying salt water Oh, looks like we might be losing Robert Siciliano. Hey buddy, thank you. That was, uh, Robert, that was great advice.
Robert, uh, yeah, very good information and good advice. Pretty eye-opening too.
