Saturday, May 01, 2010

Read this. Now.

Go here. Read this. Now.

Apparently, damned near every digital copy machine made since the early 2000's has an internal hard-drive on board. This hard-drive stores an image of -- according to the video -- at least the last twenty thousand copies made on that machine.

Now this, in and of itself, is worrisome, but what is scary is that most of these machines are leased, and when the lease is up, the copy machine is returned to the company -- hard-drive intact.

In the video embedded in the story at Peter's blog, four machine purchased at random from a supply house turned out to belong to the Buffalo, New York Police Sex Crimes Unit; the Buffalo PD Narcotics Unit; a New York construction company; and last, but certainly not least: a New York health insurance company -- which yielded 300 individual medical records.

These hard-drives and the images contained therein are available to anyone with $300 bucks to buy a used copy machine, a screwdriver, and a free copy of forensic software downloaded from the Internet.

Think about it: every time an employer has scanned a copy of your driver's licence and your Social Security card -- it's stored on that hard-drive.

Every time a secretary has copied your medical file -- it's stored on that hard-drive.

Every memo or report containing your name, every copied cheque, every copied bill, every copied personnel file -- if the people, firm or company doing the copying don't wipe that hard-drive when the lease is up, any Joe Critter with a high-school computer class and some loose dosh can get access to those records.

Bring this to people's attention.

Grateful tip of the Stetson to Peter, over at Bayou Renaissance Man.

LawDog

14 comments:

Borepatch said...

Lawdog, this has been discussed in the Internet Security community for years. I'd add hospitals to the list of organizations who don't have a clue about this, but who may be committing a felony (IANL, but HIPAA is designed to protect patient records) by selling one of these.

You also see this sort of thing when companies sell old computers. Simply reformatting the hard drive typically won't get rid of the data.

I recommend people either remove and destroy the hard drives, or use the NSA recommended "overwrite 100 times with 1's and 0's" approach. There are some good freeware utilities to do this, too.

KBCraig said...

Yes, there are huge security and HIPAA implications.

Along the same lines, I suppose you already know that every time you use a color copier or printer, your document contains details about the machine, its serial number, and possibly the date and time.

http://www.eff.org/wp/investigating-machine-identification-code-technology-color-laser-printers

Old NFO said...

I too thought this was out there... We do the NSA standard overwrite before any copier ever leaves our office.

Deschain said...

http://eraser.heidi.ie/

Eraser is a free privacy tool that not only securely erases stuff, but also does the same thing to your free space. So, if you deleted secure information in the past, you can still get it off your machine.

Des

Tim D said...

It's amusing how people talk about "NSA recommended overwrite or NSA standard overwrite", in all the NSA affiliated places I've worked hard drives don't go anywhere. All hard drives get destroyed, same for CDs, backup tapes and floppys. Think about that when someone starts throwing around "NSA standard".

Tim D

Ronald Pottol said...

A simple overwrite is enough. The only thing recoverable after that is what ever can be recovered from sectors the drive marked as bad, a few 512 character chunks at random, possibly unreadable.

Now if they are willing to spend hundreds of thousands, perhaps they could use a STM micrscope to read hints of overwritten data, and then try to make sense of that. There are much easier ways to steal your data though.

Robert said...

well if you are paranoid enough then there is only one way to solve this

I call it the Bad Wolf Double pull method

1 pull the drive out

2 load it on your skeet launcher and yell PULL

do it right and there shouldn't be enough of the drive left to scan

Anonymous said...

AAAARRRGGGGHHHHH!!!!!!

So much for HIPAA.
Ulises from CA.

Library-Gryffon said...

I'll ask our IT guys about this. Most of the stuff my copier does is not personal info, but the hospital rents all its copiers.

As for HIPAA, the only thing that I've been able to ascertain that it actually does is create more paper work. It certainly doesn't make your health insurance more portable.

And it allows the feds to fine people, so I guess it's a revenue enhancer for gov't.

WV : "dumists".
People who believed HIPAA would actually make their data more secure?

The Freeholder said...

Nothing new here. Our standards, which have been in place for several years, requires either wiping per DoD 5220.22 M (we use the Active@ KillDisk product) or the removal and destruction of the drive.

Don't want to say where I work, but we're a Payment Card Industry-Data Security Standard (PCI-DSS) environment.

For the average home user, any of the freebie erasers/drive wipers is probably good enough. (If you use a Mac, Apple give you a fantastic utility to do the job, but it can take a while.) Face it, the NSA really couldn't give a rat's posterior about most of us, despite our Walter Mitty fantasies to the contrary.

Neutrino Cannon said...

This security hole was exploited to spy on the Soviet Embassy way back in the day. Photocopiers didn't have hard drives in those days, but there was enough empty space to fit a camera that would click every time the documents were copied. Send a maintenance guy around every so often to "service the machine" i.e. retrieve the film, and you had a picture of every document that went through the copier at the Soviet Embassy.

Like Freeholder says, for really tight security you would actually want to physically destroy the hard drive, since it is possible to get previously deleted data off a magnetic hard drive using the right tools. Encryption or deletion would probably suffice in most cases though.

Anonymous said...

as a one time copier repair tech for.... lets just call them brand X, i always wondered why Bond never rolled up to the "enemies" gate and said " I'm here to fix the copier". i entered many secure facilities with no more I.D. than a tool bag and repair manual. the digital copiers not only store all copies but store them once where the customer can find them and also in a secure cache only the techs can access if they have the proper codes which are not standard in the manuals. back to Bond, the digital copiers are also faxes, if connected to a phone line they can be programed to send a copy of every document to any location desired without showing any indication to the user. many can be set to report by phone to the manufacture any problems that are developing and can be remotely reprogramedover the same phone line.
hilljohnny

PeaceableGuy said...

My response to things such as this: opened an "emergency" credit card account with a local bank (credit cards I use as cash, no balances), and then went through the damnable hoops required to permenantly freeze my credit reports at all three credit agencies.

My personal info has been lost so many times already, I figured I'd just go ahead and remove the ID theft prize.

Anything else I have to deal with, I've paid Zander Insurance $70/year to help me deal with (crook using my info as identification, medical fraud, etc.) so I won't have to waste the time to mess with it by myself.

Anonymous said...

Danger Zone - Kenny Loggins