Robert Siciliano bought used electronics from Craigslist and found that half still contained sensitive personal and financial information. He recommends properly wiping drives before selling or buying secondhand devices to protect against identity theft.
Chapters
Everyone's looking for a little extra cash around the holidays, and one way to do that is to unload things you don't use anymore. But when it comes to selling used computers and smartphones, we have an important warning.
Yeah, that device could come back to haunt you. Here's Fox 25's Ted Daniel with the results of a pretty eye-opening investigation.
Question: What private data is on your smartphone or computer?
I have everything on my computer.
All my credit card numbers. That's the biggie. Keep all of my banking records.
Um, unfortunately my budget.
That's not the type of info you'd want to sell to the highest bidder. Or at least it shouldn't be.
Hi, Jim. I am looking at your Craigslist ad for your Dell Latitude.
Identity theft expert and McAfee security consultant Robert Siciliano conducted a 2-month experiment. With funding from McAfee, Robert went on the website Craigslist and purchased used electronics from people all over Massachusetts and New Hampshire.
Laptops, desktops, netbooks, notebooks, iPhones, iPads, hard drives. Just like this.
Robert sent the used devices he bought to a data recovery company to see just how much information could be retrieved. A computer forensic expert spent a week scanning the drives and phones. Of the 20 devices examined, 10, or half, were filled with people's personal and private information.
So this one was bank account information and pornography.
People's entire digital lives for the taking. Pirated movies, passwords, bills, tax returns. Check out the imaging from this disk. Family pictures, an eviction notice, a child support support demand letter, a MassHealth acceptance form. One computer belonged to a business owner. It contains private information about employees, business plans, and legal contracts. And here are some more pictures along with the Social Security numbers and birth dates for an entire family. This type of raw data is a gold mine for an identity thief. It's almost like handing them a credit card.
If a bad guy had bought these machines, and extracted this data, they could take over their existing accounts or they could open up new accounts. They could get new credit cards, new bank loans. In some situations, they could get a passport under somebody's name, a driver's license under their name, even tap into their medical records.
And this is interesting. Robert Siciliano says half of the devices that still had personal information came from people who had thought they'd wiped them clean. Sometimes manually deleting files is not enough. If you really want to remove all trace of ownership, experts recommend 3 steps. First, wipe the drive clean. Format it, and then reinstall the operating system. It's also a good idea to run a wipeout program just to be safe.
Um, I keep some of my passwords. Um, I have all my links to, like, my different bills that I pay.
Yeah, getting a couple hundred dollars for a used computer or phone, it's nice. But it's not worth the aggravation or cost of a stranger getting your personal information and having a field day.
One guy even said to me, he said, "If I'm still logged into my Gmail, could you please log me out?" I'm Ted Daniel.
Fox 25 News.
And Robert Siciliano telling Ted that all that private data that was recovered from those computers, that has all been destroyed.
Now, if you're purchasing a used device, Robert recommends immediately installing a protection program that will remove viruses and will help keep the hackers away too.
