Your digital security

[Warbird]

http://blogs.techrepublic.com.com/itdojo/?p=1700&tag=nl.e101

Think that hard copy of your personal records is safe?  Better be sure.

[Jeff]

There was a 60 minutes report on this just last week. 

[Jeff]

Here it is

http://www.youtube.com/watch?v=iC38D5am7go

[JohnG28]

That is outrageous, and scary.

[Ernie]

It's like leaving your wallet c/w credit cards ATM cards and pin numbers on a park bench on purpose.  I doubt that many people would do that but what's the difference except that someone else is doing it for you.

[Warbird]

Yes, it is a scary problem.  I had not heard about the 60 Minutes story and have not watched it, yet.  Do they discuss places like doctor's offices who upgrade copy machines, other businesses, etc?  Those are the ones that concern me.

And now for the really scary part...  a lot of the newer copiers/printers are connected to the Internet.  And in my experience, folks do not restrict access to it because, "it's just a copier/printer.  What's to worry about?!"

[Jeff]

Take a look at the video I posted. They obtained 4 random copy machines and reveal what sort of info they got from them, including medical records, payroll records and criminal records. At the end of the video, they also show a container load of used copiers ready to be shipped overseas...

[asy]

OK, that's REALLY scary!

I've sent a link to this to work and will show my boss tomorrow just in case I'm not around when she gets rid of the photocopier. I KNOW it's got all my personal stuff on it coz I've just copied ALL our personal documents to turn them into digital files to bring on the trip with me just in case I lose my passport or whatever...  and ALL our company accounts etc get scanned and/or faxed to the bookkeeper monthly etc. EEK!

Yet ANOTHER great thread on the FF that will seriously help us.

asy :D

[Warbird]

I would search online for the user/service manual for your copier and wipe the stored memory on it.

Jeff, I will watching that vid later this weekend.  Thanks for linking to it.

[Ianab]

I would search online for the user/service manual for your copier and wipe the stored memory on it.

Wont help. You can clear everything from the memory and disk, but it's like a computer hard disk. The system doesn't actually erase the data, it just marks the sectors of disk as "free" so they can be re-used. Take the disk out and slave it to a PC and you can examine the sectors and recover data that hasn't yet been overwritten. It's random what files you will recover as the older ones are more likely to be overwritten.

What needs to happen is that the disk is actually wiped, that means every sector is re-written with some random data. Then there is nothing to be recovered, just white noise. The problem is that the copiers system has no method of doing this, just like a PC wont do a secure wipe, even if you re-format it.

The issue with PC hard disks has been known for years, and the normal procedure with a used PC is to boot if off a floppy or CD and run a "sanitise" program to actually overwrite the data. Thats probably what needs to be done with any copier from a sensitive organisation.

Or just take then out and hit them with big hammer, new hard disk = $50?

Ian

[woodsteach]

WOW!!  After having some medical problems and going from DR to DR to hospital to hospital to who knows where and at each stop they photocopy my Drivers License and insurance card.  Usually on the same paper so at least 6 machines have my info on it right now.  Then they return it to the leasing co. and then off to "hacks r us".

thanks for the heads up! 

woodsteach

[Warbird]

Ian is absolutely correct.  My comment to asy to wipe the memory on the active copier was to remove her data on a still used machine.  Odds are very good that in the course of the machines remaining life at her office, her personal data would be overwritten.  If you want to be absolutely sure, take Ian's advice.

When I was doing systems security, I ran this program frequently.  It's free and it's good:  http://www.dban.org/

[asy]

I showed this to Sue (my boss) and she was similarly horrified...

She said "I've scanned all my personal stuff through that machine" and I said "Yeah, so have I"

I guess one good thing is that we own the machine, it's not leased, so when/if we ever get rid of it, I'm taking the hard drive out and using the hammer-erase method of data protection.

Can't thank you guys enough for this info, I am horrified of the thought of my data ending up being sold for misuse. I mean we may as well just let the nigerian-scammer-dudes straight into our bank accounts!

asy

[Ianab]

I was setting up a new Fuji-Xerox for a customer yesterday and reading the manual to figure out how to change the network address.

Buried in the back were the instructions for doing a decure wipe of the hard drive, not just a delete of files, and actual full overwrite that would be impossible to recover anything from.

So the manufacturers are now aware of the problem. Now users need to be, to make sure that machines are sanitised before the are returned. But older machines never had that option.

Ian

[easymoney]

why would you want a copier to save your copies to a hard disc? do the copier makers feel that you might want another copy of something you copied weeks ago?

[Ianab]

Any modern copier is actually a scanner, computer and laser printer all loosly bolted together. Everything it scans goes via the computer and then gets printed. The "computer" part deletes the file from it's disk after it's finished, but it leaves an image that might be able to be recovered if you get to the disk before that area of the disk is re-used by another file.

Sorta like looking for old school carbon paper in the trash bin and holding it up to the light to read what was being typed.

Personally I think the risk is pretty small, but I bet someone, somewhere, is going to try it.

Ian

[Warbird]

Sorta like looking for old school carbon paper in the trash bin and holding it up to the light to read what was being typed.

Speaking from experience there, Ian?  ;D ;)  The younger crowd probably has probably never seen an actual sheet of carbon paper.