Security Corner » Data sanitization

Extremely Robust Security, the Google Way

Ken Harthun — Tue, 26 Apr 2011 23:25:22 +0000

Google recently released a video shows the extremely robust physical, data protection and operations security of its data centers. Google does not allow tours of its facilities and limits physical access to only necessary employees. Access is controlled by special badges and in some cases retinal scanners. Wait until you see how they dispose of hard drives. Fascinating stuff that serves as a shining example of security done right.

[kml_flashembed movie="http://www.youtube.com/v/1SCZzgfdTBo" width="600" height="390" wmode="transparent" /]

Security Risk of Digital Copiers

Ken Harthun — Mon, 26 Apr 2010 20:03:24 +0000

As if we don’t already have enough to deal with, now we must add digital copiers to our list of security risks. Seems that most modern copiers (those manufactured 2002 or later) including Ricoh, Canon, Sharp and others, are loaded with secrets about the organization where they reside, the people who have used them, customers and competitors, even the fanny of that cute temp who got drunk at the office party. The reason? Nearly every digital copier built since 2002 contains a hard drive and that hard drive stores an image of every document copied, scanned, or emailed by the machine.

Ten days ago, CBS ran a segment on the Evening News entitled “Copy Machines, A Security Risk?” Watch the video here.

This past February, CBS News went with [John] Juntunen [of Digital Copier Security] to a warehouse in New Jersey, one of 25 across the country, to see how hard it would be to buy a used copier loaded with documents. It turns out … it’s pretty easy.

After buying four copiers, they started to examine them. One of the copiers had documents still on the copier glass, from the Buffalo, N.Y., Police Sex Crimes Division. Another machine from the Buffalo Police Narcotics Unit revealed the targets of a narcotics raid. The third machine contained copies of pay stubs that revealed names, addresses and social security numbers. On the fourth machine from a New York insurance company, they found 300 pages of medical records that included prescriptions, blood test results and the like.

It’s not that the manufacturers of these products are negligent; all of them offer options to either encrypt or erase the documents. The problem is that the people who lease the copiers either don’t understand or don’t want to pay for the protection the options provide.

Ignorance is no excuse; failing to implement suitable security is negligence and a serious breach of federal privacy laws. Besides that, once a used copier leaves the warehouse, there’s no telling where it might end up. The CBS reporter gave this summary:

The day we visited the New Jersey warehouse, two shipping containers packed with used copiers were headed overseas – loaded with secrets on their way to unknown buyers in Argentina and Singapore.

How we lookin’? Not good.

Brute Force Data Destruction

Ken Harthun — Sat, 24 Apr 2010 01:16:52 +0000

What do you do when a long-time client, a non-profit organization subject to HIPPA regulations, has been stockpiling old hard drives until they can afford the cost of shredding them? Professional data destruction services charge anywhere from $10 to $25 or more per hard drive in addition to the pick-up fee. Here’s a video that shows a hard drive shredder (scroll down to the middle of the page). My client was looking at almost $1200 and just couldn’t seem to find room in the budget. They needed a viable–and cheap–solution.

The least expensive option would have been to train a staff member on how to use an old PC to hook up the drives and run the HDDerase utility. (See How to Quickly & Securely Erase a Hard Drive.) For various reasons, the client wasn’t in favor of this; they wanted someone “in the know” to do it.

After determining that there was little likelihood of any truly sensitive data sitting on those hard drives, I suggested a brute force approach: Physically damage the drives, then take them to a community recycling center and dispose of them. The total cost of this approach would be around $100. The client agreed.

The photo above shows the result of 3-4 sharp blows with the root-cutter end of a cutter mattock applied to the platter end of the hard drive case. The photo below shows the resulting damage to the platters.

You could argue that this isn’t enough destruction to meet regulatory security standards and you would be right. My rebuttal would be this: 1. There probably isn’t anything of value on those drives; 2. The cost of trying to recover anything on those drives would be prohibitive; and, 3. Where they’re going tomorrow, no one will know who owned those drives and wouldn’t care anyway if they did. Bottom line: The drives will be shredded and recycled as originally planned at a fraction of the cost.

Sometimes, it just takes a little common sense to deal with these issues.

Another Little Known Tool to Securely Delete Files, Folders, and Volumes

Ken Harthun — Fri, 20 Mar 2009 01:35:57 +0000

Why, all of a sudden, is everyone concerned about secure file deletion? I hesitate to say it’s a sign of the poor economy, but perhaps people consider it even more important to protect their personal information when the idea of losing control of their assets—and their lives–through the incompetence of corporate “managers” and well-intentioned but clueless politicians is more abhorrent than losing control through the outright thievery of Internet gangs. It’s weird. I harped on people about securing their data all along and mostly, my advice fell on deaf ears. Now people are worried. And it’s not because they see more spam email phishing attempts, it’s because they feel they can’t trust anyone anymore, not their formerly respected captains of industry, and certainly not their elected officials.

But, I digress. This post is about security tools, not politics, so I’m now officially off of my soapbox.

I recently posted an article about SDelete, a tool that can be used to securely delete files and folders on a hard drive. There’s another little known, useful tool that has been built into the OS since Windows 2000: cipher.exe. Microsoft provides the following in Knowledge Base article 315672:

How to Use the Cipher Security Tool to Overwrite Deleted Data

To overwrite deleted data on a volume by using Cipher.exe, use the /w switch with the cipher command. Use the following steps:

Quit all programs.

Click Start, click Run, type cmd, and then press ENTER.

Type cipher /w:driveletter:\foldername, and then press ENTER. Specify the drive and the folder that identifies the volume that contains the deleted data that you want to overwrite. Data that is not allocated to files or folders will be overwritten. This permanently removes the data. This can take a long time if you are overwriting a large space.

One more tool you can use to mollify your paranoid clients.

Use This Little Known Tool to Securely Delete Files and Folders on Your Hard Drive

Ken Harthun — Sat, 28 Feb 2009 16:11:20 +0000

For those who grew up with the graphical user interface, command line tools are often seen as arcane remnants from the dawn of PC history, a time when badly-dressed nerds sporting horn-rimmed glasses and pocket protectors ruled the universe (well, maybe just the computer lab). For them, nearly all of the command line tools are little known; for us dinosaurs who were typing on terminals well before the PC arrived, there are few of these older tools we haven’t seen. However, as the GUI gradually replaced the command line and we command line geeks began to point and click more and more, some useful tools escaped our notice. One of these is the ten-year-old SDelete by Mark Russinovich of Sysinternals fame. Microsoft acquired Sysinternals in July, 2006 and made all of the excellent tools available free.

Using SDelete

SDelete is a command line utility that takes a number of options. In any given use, it allows you to delete one or more files and/or directories, or to cleanse the free space on a logical disk. SDelete accepts wild card characters as part of the directory or file specifier.

Usage: sdelete [-p passes] [-s] [-q]
sdelete [-p passes] [-z|-c] [drive letter]

-c     Zero free space (good for virtual disk optimization).

-p passes     Specifies number of overwrite passes.

-s     Recurse subdirectories.

-q     Don’t print errors (quiet).

-z     Cleanse free space.

SDelete implements the Department of Defense clearing and sanitizing standard DOD 5220.22-M, which is overkill (see The Great Drive Wiping Controversy Settled at Last), but ensures your data is deleted forever. There is one caveat: SDelete securely deletes file data, but not file names located in free disk space. If you want to be completely sure that all traces of a file are gone, be sure to use the –c or –z option.

#####

Want to see even more useful, little known tools? Check out Sysinternals Live:

Sysinternals Live is a service that enables you to execute Sysinternals tools directly from the Web without hunting for and manually downloading them. Simply enter a tool’s Sysinternals Live path into Windows Explorer or a command prompt as http://live.sysinternals.com/ or \\live.sysinternals.com\tools\.

You can view the entire Sysinternals Live tools directory in a browser at http://live.sysinternals.com.

The Great Drive Wiping Controversy Settled at Last

Ken Harthun — Sun, 18 Jan 2009 01:34:41 +0000

How many times do you have to overwrite a hard drive in order to securely wipe it? This question has been at the center of an ongoing controversy for a long time. On the one hand, we’ve had Peter Gutmann saying it takes 35 passes (Gutmann, P. (1996) “Secure Deletion of Data from Magnetic and Solid-State Memory”); on the other hand, we’ve had the NIST saying one pass is enough (http://csrc.nist.gov/publications/nistpubs/800-88/NISTSP800-88_rev1.pdf). So, which is it, one, 35, or something in between?

NIST gets the prize: One pass is enough to delete data such that it can not be recovered. A paper published in December last year; “Overwriting Hard Drive Data: The Great Wiping Controversy” by Craig Wright, Dave Kleiman and Shyaam Sundhar R.S. as presented at ICISS2008 and published in the Springer Verlag Lecture Notes in Computer Science (LNCS) series, proves beyond doubt that data can’t be recovered from a wiped drive even if one uses an electron microscope. As Craig Wright puts it in a post on the SANS Computer Forensics blog:

Although there is a good chance of recovery for any individual bit from a drive, the chances of recovery of any amount of data from a drive using an electron microscope are negligible. Even speculating on the possible recovery of an old drive, there is no likelihood that any data would be recoverable from the drive. The forensic recovery of data using electron microscopy is infeasible… The fallacy that data can be forensically recovered using an electron microscope or related means needs to be put to rest.

That sure makes life easier for those of us who have to deal with secure deletion of sensitive data. I’ll use my copy of Darik’s Boot and Nuke (DBan) with one pass from now on and get those retired hard drives wiped in no time.

How to Quickly & Securely Erase a Hard Drive

Ken Harthun — Fri, 21 Nov 2008 02:02:54 +0000

Over at Ask the Geek, I often receive questions about how to properly erase a PC hard drive so personal data can’t be recovered. Clients also ask similar questions, particularly those involved in medical, dental, or financial practices. I’ve posted on this subject before, of course. “Paranoid About Hard Drive Security? Try This” outlined a two-step approach that works well, but is probably overkill for most, including those under regulatory scrutiny. The Center for Magnetic Recording Research (CMRR) points out that completely secure erasure doesn’t exist: erasure security is relative and is “a tradeoff between the erasure security level and the erasure time required. A high security protocol requiring custom software or days to accomplish will be avoided by most users, making it little used and therefore of limited practical value.” Enter Secure Erase (SE).

According to CMRR, “The Secure Erase (SE) command was added to the open ANSI standards that control disk drives, at the request of CMRR… The SE command is implemented in all ATA interface drives manufactured after 2001 (drives with capacities greater than 15 GB)….

“Secure erase does a single on-track erasure of the data on the disk drive. The U.S. National Security Agency published an Information Assurance Approval of single pass overwrite, after technical testing at CMRR showed that multiple on-track overwrite passes gave no additional erasure.”

Secure Erase is a DOS-based program, so you need to make a bootable floppy, CD, or flash drive that boots DOS, FreeDOS, or a Windows 95/98/ME rescue disk. Download the freeware HDDerase, extract HDDerase.exe to your bootable media, boot the computer to a command prompt, and execute HDDerase.exe (HDDerase.exe must be run from an actual DOS environment and not a Window based DOS command shell).

In about an hour or two, depending on the size of the hard disk, you’ll have a drive that can be safely disposed of or re-deployed without fear. If you plan to re-deploy the disk, you’ll have to create a new partition and format the disk before you’ll be able to use it again.

I’ve used this handy utility many times to sanitize disks that contained data subject to the Health Insurance Portability and Accountability Act (HIPAA). All normal attempts to discover any trace of identifiable data on my test drives failed to reveal anything usable.