Stories
Slash Boxes
Comments

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Computer With UK Bank Customer Data Sold On eBay

Posted by kdawson on Tue Aug 26, 2008 08:23 PM
from the fingers-pointing-in-a-circle dept.
Walpurgiss tips a BBC News story about a man in Oxford who paid $140 for a computer on eBay, and was shocked to find on it bank records of several million customers of the Royal Bank of Scotland, its subsidiary Natwest, and one other bank. "Mr. Chapman said anyone with a basic knowledge of computer software would have been able to find the data fairly simply. 'The information was in back-up CDs and in ISO files so it would have been possibly quite easy to find...,' he said."
+ -
story

Related Stories

This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • Honesty (Score:5, Insightful)

    by Enderandrew (866215) <enderandrew AT gmail DOT com> on Tuesday August 26 2008, @08:25PM (#24759149) Homepage Journal

    Kudos for him for speaking up rather than trying to abuse the situation.

    • Re:Honesty (Score:5, Insightful)

      by PunkOfLinux (870955) <mewshi@mewshi.com> on Tuesday August 26 2008, @08:30PM (#24759195) Homepage

      Agreed, although we shouldn't be forced to think that doing the right thing is so rare that we must laud it.

      Still, good job.

      • Re:Honesty (Score:5, Interesting)

        by Anonymous Coward on Tuesday August 26 2008, @09:11PM (#24759561)

        "Always do good. It will gratify some and astonish the rest." ~Mark Twain

        • Re:Honesty (Score:4, Insightful)

          by Jimbob The Mighty (1282418) on Tuesday August 26 2008, @10:55PM (#24760503)
          No, given that the computer will be seized by the police as evidence in some sort of criminal case, somebody owes him a computer, as well as their thanks and a pat on the back.
    • Re: (Score:3, Insightful)

      Yeah I'm sure he'll be thanked for his trouble.. with a pair of handcuffs and a hood..
      • Yeah I'm sure he'll be thanked for his trouble.. with a pair of handcuffs and a hood..

        Yeah, with the current level of collusion between the corporate world, the government and judicial system, there is very little incentive to do the right thing. He should be give 10% of what ever appropriately large fine should be placed on the Banks and companies involved.

    • Indeed. Naturally however, he will now be sued by BoS for his trouble.

      • Re: (Score:3, Informative)

        Doubt it. BoS (I assume you mean Bank Of Scotland) won't as it was information from RBS (Royal Bank of Scotland Group) which was lost. As far as I've heard, there hasn't been any sueing going on anyway.

        The worst part is that RBS didn't atually have a breach, it was a 3rd party. That, of course, could well lead to someone getting sued.

    • Re:Honesty (Score:5, Funny)

      by Dekortage (697532) on Tuesday August 26 2008, @10:00PM (#24759963) Homepage

      Man: "Look, I found eight million customer records on here!"

      Bank tech: "That's weird, we always stored ten million records in those databases..."

      Man: "Huh, no idea what happened to those other two million." (hides batch of CDs) "I can't believe you guys sold 8 million customer records on eBay!"

      • Re:Honesty (Score:5, Funny)

        by The Great Pretender (975978) on Wednesday August 27 2008, @01:12AM (#24761461)
        Man: "Look, I found eight million customer records on here!"

        Bank tech: "That's weird, we always stored 7 million records in those databases..."

        Bank tech2: "Funny I thought it was 12 million..."

        Bank tech3: "What are records?"

        Bank tech4: "Hey, didn't I just decommission that laptop using that online eBay-thingy service?"

  • by volxdragon (1297215) on Tuesday August 26 2008, @08:26PM (#24759161)

    ...Really Bad Security instead of Royal Bank of Scotland.

    • by jtcedinburgh (626412) on Wednesday August 27 2008, @02:21AM (#24761821)

      OK, I have to pipe up on this one.

      I've previously worked a few freelance tech gigs at RBS and the one thing I can say with certainty is that their internal security is extremely tight. Tighter than anywhere else I've worked in my time. The fact that anything gets done, EVER, is a minor miracle in the face of the mountain of red-tape, security, bureaucracy and general faffing with sign-offs and corporate governance that is needed to do pretty much anything.

      So, I'm going to pipe up on behalf of RBS, your honour... :-)

      Thing is, one thing I categorically don't believe is that the responsibility for handling customer data like this would fall to one individual without direct accountability. Knowing RBS, there would be forms to fill in, checks made, audits done and any handling of customer data would need to be signed off at a high level, and would be entirely traceable. Which is to say that if there's a breach, I don't think it's likely to be a break-down in procedure.

      Now, you might laugh about this, but I know how many hoops I had to jump through to get things like dev rights on a developer box ("so, let me get this straight, sir, why do you need to be able to write to the C: drive?" - that sort of dumb thing) so I really doubt that a half-wit in marketing or HR or whatever would be entrusted with such data. It is kept under lock and key and it would certainly be VERY UNUSUAL to be allowed to make a cd copy of customer data. To do so would require sign off from Very Senior Management (at Director level), and hence visibility at EVERY STAGE and accountability for EVERY ACTION would be enforced with *GREAT RIGOUR*...

      So my money is that this isn't what it at first appears to be - it could be the case that this is something else and the press have got the wrong end of the stick.

      Or maybe I'm wrong. Often am, you know... ;-)

      • by rapiddescent (572442) on Wednesday August 27 2008, @03:41AM (#24762145) Homepage

        as another tech contractor who has worked in the past at 113DS, FR and GF - I know what you mean about getting dev access or access to one of the gigantic machine rooms. I would say that RBS core systems and its brands (natwest, coutts, Ulster(s)) are extremely secure to the point of not being able to do any work. Even the due process to make a change to a production system is amazing with full-time boards spending all day evaluating every change.

        from what I read on finextra.com, it looks like this box was owned by a supplier firm and subsequently was stolen by an employee of the supplier firm and sold on ebay. Also, the box had not been used since 2005 - perhaps an old server in the cupboard (of the supplier Graphic data) that an employee thought they could sell on ebay. I am struggling to see how this would have happened as a badged RBS server at one of the EDI datacentres. They run a tight ship.

        one thing for sure, Graphic Data can kiss goodbye to their contract with RBS - one thing I know abut RBS is that they are very worried about security breaches - especially public ones like this.

    • Re: (Score:3, Interesting)

      Except it wasn't them who lost the data, although what a 3rd party was doing with all those records I'm not sure.
  • by jkinney3 (535278) on Tuesday August 26 2008, @08:27PM (#24759165)
    I bought a pair of SGI Origin 200 machines that contained names, credit cards, and enough data to be a real problem for many thousands of people. The labels on the machines listed them as from @home which had closed their doors. I did the dd if=/dev/zero dance and reinstalled IRIX.
    • by ScrewMaster (602015) on Tuesday August 26 2008, @09:24PM (#24759673)
      Some twenty years ago, back when those orange plasma displays were popular, a girl I used to work with said she'd gotten hold of some Compaq portables, and would I want to buy one? She was only asking a couple hundred bucks (I believe they cost several thousand new at the time.) So I stopped by to take a look, thinking I could really use a machine like that. That line of thought lasted right up until the system finished booting and a custom menu appeared with legend of a major national bank across the top. Given the price and the data on them, I figured they were hot (I asked what truck they'd fallen out of) and declined to buy one.

      That was then, now we're in the Age of the World Wide Web, and there's just no excuse whatsoever for loading down a portable (read: easily stolen) computer system with vast quantities of confidential data. In fact, that really ought to be a law with few exceptions: customer and personal data must be stored on a server that is both physically and electronically protected. Period.
      • In fact, that really ought to be a law with few exceptions: customer and personal data must be stored on a server that is both physically and electronically protected. Period.

        Servers get decommissioned, too. All that protection isn't going to help if they screw up and leave unencrypted data on their drives. Decommissioned hardware may certainly get used again, depending on how it was disposed of. I'm aware of one company that disposes of hardware--they recycle some parts and sell others. (I believe they require their customers to scrub the data before they throw it out.)

        For instance, I have a customer in an industry where that would be bad (which doesn't narrow things down, I

        • Destroying the data should be a simple as encrypting the harddrives with a 100 characters of randomnes followed by a reformat and a shutdown.

          Yes, if someone was truly interested, it's possible they could recover it but it is rather unlikely. Most of the data breaches appear to happen by accident, where encryption would have kept the data safe.

          So,

          1 - erase the data
          2 - encrypt the drive with a near impossible key
          3 - reformat
          4 - no profit for next owner

            • by zappepcs (820751) on Tuesday August 26 2008, @10:34PM (#24760277) Journal

              Yes, you could do that, but I think that erasure and encrypting the whole drive will also accomplish this. I believe that there is still a possibility of recovering the data even if wiped over several times. You can find lots of information about this on 'the Google' if you like. Here is a link to a zdnet blog about it: http://blogs.zdnet.com/storage/?p=129 [zdnet.com]

              If you can simply smelt the drives, that is complete destruction. Anything else depends on the level of 'it's not there anymore' you need. Far too many people don't care or believe their data can be used from an old disk. They also don't understand that a format will not necessarily overwrite anything on the drive. sigh.

              Encrypting the whole drive will scramble the bits fairly well. Follow up with low level formatting and it should be difficult enough to recover anything from the drive without the encryption password, never mind that the file system has been rewritten.

              • Re: (Score:3, Interesting)

                Why would you encrypt when you could just write randomness?

                10 write zeros.
                20 write randomness.
                30 GOTO 10 (as many times as you like)

  • by flaming error (1041742) on Tuesday August 26 2008, @08:30PM (#24759199) Journal

    Somebody should have set a much higher reserve price.

  • by ILuvRamen (1026668) on Tuesday August 26 2008, @08:36PM (#24759247)
    If you're dumb enough to make a backup CD and then save the ISO onto the hard drive just in case the hard drive crashes, you're dumb enough to sell it on ebay without wiping it. I suppose this could have been some sort of backup storage server and not the computer that actually contained the data to be backed up but for that price it's a little unlikely.
    • by BLAG-blast (302533) on Tuesday August 26 2008, @08:47PM (#24759341)

      Dummy says dummy...

      They made an ISO, made 3 CDs of each ISO (one for the filing cabinet, one for off site back up, one for the on site safe), then didn't both deleting the ISOs...

      It's dumb, but not as dumb as your ideas.

      • A deleted file including an ISO can live on the hard drive forever in recoverable or partially recoverable form. Criminals routinely buy PCs from surplus and then re-sell the uninteresting ones in hopes of garnering some profit from deleted data - in many cases turning a profit just on the turnaround process. Security researchers do it also, to gain fame and credibility from pointing the finger of shame which leads to step 3: consulting profit! A PC that's been "quick formatted" and then had an OS install

  • Should I have not done that?
  • Hand it back? (Score:5, Interesting)

    by Mishotaki (957104) on Tuesday August 26 2008, @08:46PM (#24759329)

    So in the article, they say that they expect him to hand "it" back.. does that means that the poor guy who paid 77£ to give back the computer for free?

    Personally i'd charge a hefty sum to make them get back that computer, just to make them remember that he paid and he was nice enough to tell them.

    • Re:Hand it back? (Score:4, Interesting)

      by timmarhy (659436) on Tuesday August 26 2008, @09:08PM (#24759539)
      i'd charge the pricks a consulting fee for my time. a few grand should cover it. i certainly wouldn't be handing back what is entirely his property, since he purchased it fair and square they have no recourse.

      mind you in his day and age i wouldn't be suprised if he ends up in jail for his honesty, if it was me i wouldn't be saying anything. if i was a more desperate man i might even have sold those details online for a princely sum....

      • Re:Hand it back? (Score:5, Insightful)

        by MichaelSmith (789609) on Tuesday August 26 2008, @09:20PM (#24759635) Homepage Journal

        i'd charge the pricks a consulting fee for my time. a few grand should cover it. i certainly wouldn't be handing back what is entirely his property, since he purchased it fair and square they have no recourse.

        Do that and you go straight to jail, don't pass go, don't collect $200. Your consulting fee will be seen as extortion.

        • Re:Hand it back? (Score:5, Insightful)

          by timmarhy (659436) on Tuesday August 26 2008, @10:23PM (#24760159)
          it's my property, how can i extort someone when they WANT to purchase something i own? by that logic every service fee ever paid on new car sales is extortion.

          now if i went to them and said "pay me or i'll tell the media what retards your IT security guys are" that's extortion. but since it's already all over the news sites it's not possible to call it extortion.

          it's also pretty damn cheeky (and just the thing i'd expect from a bank) to expect him to just hand back his purchase.

          this would in fact be an interesting case to test in court as to who owns data when you purchase a pc. no doubt IP lawyers would be foaming at the mouth saying your buying hardware not software (that might shoot some of their, but then this isn't software but plain data which they didn't license so he'd have a reasonable expectation that it came with the sale.

    • Re: (Score:2, Insightful)

      I was going to say the same thing. You'd think he would get a premium to encourage people to come forward in the future. If people are worried they'll be under suspicion or have their equipment taken away, why would they do the right thing? The honest ones will trash the data. If other systems were sold off in the lot it may be discovered too late.
  • Taking bets! (Score:5, Insightful)

    by RyoShin (610051) <tukaro@gmail . c om> on Tuesday August 26 2008, @08:54PM (#24759401) Homepage Journal

    How many days do you think it will be before the government tries to charge him with something or the bank in question tries to sue him? I'd be pleasantly surprised if neither happened.

    Also, the summary leaves out something that might affect those of us on the other side of the pond:

    A spokeswoman for the third company reported to be involved, American Express, said it took the security of its card members' data "extremely seriously".

    Bold mine. I know they have different branches for countries and such, but I wonder if any of this data crossed international bounds.

    • How many days do you think it will be before the government tries to charge him with something or the bank in question tries to sue him? I'd be pleasantly surprised if neither happened.

      I dunno ... it would be seriously bad PR to do that now that the story is all over the place. You can get away with screwing somebody like that if they report it to you privately: call in the gendarmes and have the Good Samaritan hauled off to the slammer. That happens more often than you might think (too many CIO/admin ty
  • Goodwill (Score:5, Interesting)

    by gnu-sucks (561404) on Tuesday August 26 2008, @09:09PM (#24759547) Homepage Journal

    I bought a sun box at goodwill once and besides an intact customer database for several large companies, it also had the admin's personal backup files, including his "My Documents" folder, his Palm cell phone, and 1200 dpi scans of his passport. Oh, and some file called "passwords.doc". No idea what is in there...

    More details here:
    http://lfnet.net/blog/?p=41 [lfnet.net]

    But yeah... wipe it before you get rid of it.

    • Re: (Score:2, Insightful)

      Never mind wiping it, this stuff should never be stored unencrypted in the first place.

  • Bugger.... (Score:5, Funny)

    by s0litaire (1205168) * on Tuesday August 26 2008, @09:16PM (#24759599)
    I was just going to pick up a cheep 1U server for a Mod Project! Now i've no chance! Everyone will be buying up every server hoping for Disks full of Banking details now!! :(:(
  • by PPH (736903) on Tuesday August 26 2008, @09:52PM (#24759909)

    Its tough to sell a machine with no O/S on it. Most buyers will take one look at the retail price of XP (for example) and subtract that from their eBay bid. Most sellers are unwilling to risk a complete disk scrub and reinstall. Even if they are, its doubtful that they still have (or ever had) media to do an install on a clean system. The most that the non-tech savvy will attempt is to drag the contents of 'My Documents' to the trash can icon.

    This is an opportunity for a Linux distro. Include an easy-to-use boot/nuke/install mode and offer them to people who put systems up for sale on various web sites.

  • DBAN (Score:3, Informative)

    by GodfatherofSoul (174979) on Wednesday August 27 2008, @12:27AM (#24761207)
    Learn it, know it [dban.org]. A very simple utility for wiping drives that you can run as a boot disk.
    • Re: (Score:2, Insightful)

      The thief who stole it?

    • Re: (Score:3, Insightful)

      Once again I am reminded of the boundlessness of human stupidity.

      2 or more departments in the chain, that don't talk to each other.

      IT, who removes it from the desk or floor. They are 'supposed' to wipe it. They don't, for whatever reason.
      Disposal dept, gets a stack of random PC's to dispose of. "IT", according to policy, was supposed to have sanitized them, so Disposal never powers them up to check (doesn't have the time or resources).
      Result - PC with sensitive CD still in the drive gets sold.
      • Re:Wait... what!? (Score:5, Insightful)

        by Zaiff Urgulbunger (591514) on Tuesday August 26 2008, @09:46PM (#24759849)
        You might not have seen the video clip with the article [I don't know if it's visible outside the UK] but the guy said he bought two servers, one booted and had been wiped, the other didn't boot. It didn't boot because it was missing it's ram (or the chip was unseated), so anyway, he sorted that out, booted it up and found the data.

        Soooo... one wonders if the machine didn't get wiped simply because the various techs could boot it and decided it was too much effort to move the drives to another machine?
        • Re: (Score:3, Interesting)

          If the machine came in contact with this data, why the drives were even sold is beyond me. The drives should have been removed and run through a shredder / grinder.

          Any machine that contained data or could have contained such as this should have been through a more... robust... decomissioning process.

    • Re: (Score:3, Insightful)

      "You could have walked into a local branch and asked to speak to the manager, carrying the drive"

      thats a really really stupid idea. he'd have been thrown in the slammr for sure. he only had 2 options. stay quiet and tell no one at all, or go full blown public screaming from the hill tops so that there was too much public attention to risk making him disappear.

    • Re: (Score:3, Insightful)

      To be honest, I don't care about your need to buy second hand hardware on eBay cheaply, but I do care about my bank's incompetence at keeping its data secure (I'm a customer of Nat West, possibly soon to be ex customer). If this man had tried either of your suggestions, I would never have known about their stupidity.

      You really do need to get a sense of perspective.