Two-Thirds of Second-Hand Memory Cards Contain Data From Previous Owners (bleepingcomputer.com) 130
Catalin Cimpanu, writing for BleepingComputer: A recent study conducted by academics from the University of Hertfordshire in the UK has revealed that almost two-thirds of second-hand memory cards still contain remnants of personal data from previous owners. For their study, researchers analyzed 100 second-hand SD and micro SD memory cards purchased from eBay, conventional auctions, second-hand shops, and other sources over a four-month period. All in all, researchers say the memory cards they recovered were previously used in smartphones and tablets, but some cards were also used cameras, SatNav systems, and even drones. The research team says the analysis process consisted of creating a bit-by-bit image of the card and then using freely available software to see if they could recover any data from the card. Their efforts were successful and worrisome at the same time, as the team says it managed to recover data from the memory cards, including intimate photos, selfies, passport copies, contact lists, navigation files, pornography, resumes, browsing history, identification numbers, and other personal documents.
Just Surprised... (Score:4, Interesting)
...that it's ONLY 2/3rds. Who remembers / bothers to erase that data, anyway? For my cameras and GPSs, I doubt that I'd bother. Info available is immensely non-useful to anyone else. A PC memory I would erase, and spend time writing 1's, 0's, and then random #'s to it, but the other hardware I really wouldn't care about.
And who is SELLING these memory cards, anyway? That's not how you get rid of 'em. You get rid of 'em by losing them. Everybody knows that.
Who bothers? WHO BOTHERS? (Score:1)
That's the first damn thing on my mind whenever such a device is leaving my control.
WTF is wrong with you people? Bell curve, that's what.
Re: (Score:2)
That's the first damn thing on my mind whenever such a device is leaving my control.
WTF is wrong with you people? Bell curve, that's what.
I wouldn't even SELL or giveaway any SD card/ HDD, etc, even if I had wiped it. Not worth potential privacy and identity loss, even if I have wiped it with special software... I just would never take that risk. Who even sells their used SD cards? What do you get $2? Not worth it.
Re: (Score:2)
I have never bothered selling a used memory card. If it is leaving my possession, it gets the "dd if=/dev/urandom of=/dev/sdwhatever" treatment, at least once or twice.
Re:Just Surprised... (Score:5, Insightful)
And who is SELLING these memory cards, anyway? That's not how you get rid of 'em. You get rid of 'em by losing them.
That kind person who made you lose the card is selling; he can't drink, smoke nor inject that card in its present form. And you did not get an opportunity to clean the data.
Thus, we'd need some way to encrypt the cards yet still be able to comfortably share them between diverse systems, as unless the card is sitting in the dust behind your couch, the data is likely to be used. Not by the direct "finder", but as soon as anyone pays for the copy, those nudes and bank statements will be out there. Oh, by the way: if you're evil enough, here's a business opportunity. Don't take it.
Re: (Score:2)
I read that the SD secure part which consists of 20% of the card is still present, but you have to have a special controller to access that part. I wish the specs were more open, as it would possibly be a useful way to back up sensitive data, or just store the key to the rest of the card there.
Limited erase/write cycles (Score:1)
Also, given that flash cards have a limited number of erase/write cycles, doing a proper erase would reduce the lifespan of the card significantly (at least compared to a hard drive).
Re: Just Surprised... (Score:1)
Not before she makes a backup copy on Carlos Danger's laptop.
Re: (Score:1)
Re: (Score:2)
Thats nothing! A few years ago some folks bought 100 used copy machines. In every case, the hard drives in those machines had not only records of copier usage, but the actual documents that had been copied. Wait...you didn't know that copiers had hard drives and kept copies of documents? Some of the used copiers had come from police stations, and had copies of case documents on them.
Be careful what you copy and where!!!
Re: (Score:2)
What blows my mind is that it isn't hard to create an encryption system to guarantee that temporary files stored there are zapped. It can be as simple as deleting the old cruft, creating an LUKS volume or eCryptFS directory on bootup, keeping the key in RAM, and storing files there. If the copier gets power cycled, the keys are forgotten, and the documents are never accessible. Next bootup, the files are cleared out, and a new volume is made.
If the copier uses Windows, a partition that is formatted and a
Re: (Score:2)
Info available is immensely non-useful to anyone else.
Last time I found a memory card the contents were useful enough to directly identify the owner even though it contained nothing but camera snaps. Hell the last 2 times that was true and the second time I found the camera in the bottom of the ocean.
Don't discount what is on your memory card. It's like those people who don't realise that posting a selfi with your plane ticket barcode visible is about all that is needed for someone to come in and cancel your flight on you.
Re: (Score:2, Funny)
If you weren't a lazy bastard you'd click on the relevant link to see that this study was commissioned by a company.
But you are, so you waste a lot of bandwidth just to be a POS.
Re: (Score:1)
Two of your questions were answered. You asked, "Who proposes such a study and then who approves it?" The previous comment explains that the study was commissioned by a company. More specifically, the company was Comparitech.com, which is in the article. And since the University of Hertfordshire conducted the study, I'd say there's a good chance they approved it. If you're looking for the name of a specific individual or group who signed off on it, I'd recommend getting in touch with the university dir
Re: (Score:1, Troll)
Re: (Score:1)
I'm just not understanding why this makes you so angry. Maybe the company has an idea for simplifying the task of secure deletion for non-tech-savvy users, and wanted to commission a quick-and-dirty study to see how prevalent the problem of recoverable data on secondhand media is before proceeding? Maybe they just want to use it as propaganda to convince people to only buy new media, as you suggest (which I agree would be unethical). But to get so upset about it suggests that you feel it is materially ha
Re: (Score:2)
Re: (Score:2)
They should do separate analysis of solid state drives and magnetic drives as well to see if they suffer from the same issue.
Why? That is what I would call: settled science [scmagazineuk.com]
Incidentally that study on harddisks a few years back also got to the number two-thirds. Maybe two-thirds of people don't know basic data security regardless of what they are selling online :-)
It's probably an undergraduate project (Score:1)
The only problem is that taxpayers are funding it.
There should be a separation of Education and State.
Re: (Score:3, Insightful)
There should be a separation of Education and State.
No... there really shouldn't be. Not even close. That's about the stupidest idea I've heard in a long time. We had that in the 1700's. If you want 2% literacy follow that route! It's a benefit to EVERYONE that all of society is educated. Even if you're some rich snob, it's to your benefit that society is educated enough that it can create entrepreneurs, doctors, etc.
Re: (Score:1)
We had that in the 1700's. If you want 2% literacy follow that route! It's a benefit to EVERYONE that all of society is educated.
Where did you learn that, a government school?
Try going to actually look up the literacy rate in America before the US implemented the Prussian System, when most schools for poor were run by charity, and compare it with other countries around the world that had state education, paying special attention to the counties of comparable wealth.
I know, learning is hard and you don't ha
Re:Academics (Score:5, Informative)
Who proposes such a study and then who approves it?
According to TFA, a company, Comparitech.com, commissioned the study.
Are these the kind of studies Universities should be pursuing?
This wasn't a vast team of world-class researchers. It was likely one undergrad on academic probation working for class credit, sitting at a desk with a small pile of cards, plugging each one into the slot and pushing a button. Total cost: about $200 to buy the cards.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Next question: How many used infected Windows laptops do you have to sell, before your keylogger sends back some "interesting" data? J/K
Re: (Score:1)
Re: (Score:1)
Nice link :D
Re: (Score:1)
Who sells them? (Score:3)
Re: (Score:2)
Stupid people that's who!
The sort of people that do not know how to properly delete files (really a once over zeroing is fine, or choose your favourite number!).
I am more worried about the sort of people that buy these second hand cards to trust their data to!
I have many old cards. I should bin them but I like to hoard! They are all far too small anyway (16gb is the minimum these days, 64gb is usual, your view may differ!) I tend to buy above the burger price but below the point where the price gets silly.
Re: (Score:2)
I have many old cards. I should bin them
Which raises the question of what is the environmentally way of disposing of them?
That's one reason I also have a hoard of memory cards - I have no idea of the best way to dispose of them and the amount of money I'd make on selling them isn't worth my time*
---
*Anyone want to bid on an San Disk EC-8CF 8MB CompactFlash card? It's Nikon branded!
Re: (Score:2)
Re: (Score:2)
But there isn't really an environmentally sound way to dispose of them.
Throw them into an active caldera. They get instantly melted down and form part of the earth's magma. The only downside is you have to walk to the volcano- not drive because driving pollutes. Some people have a longer walk/swim than others.
Re: (Score:2)
Which raises the question of what is the environmentally way of disposing of them?
What about an SD card is hazardous?
Re: (Score:1)
Neckbeard tears are highly toxic, you'd never decontaminate their hoard.
I'd just take them to the local tech recycling nonprofit in an unmarked bag, and just don't even mention where they came from. They probably have neckbeards that attempt to volunteer in exchange for free computers, especially before they learn that the volunteering needed is all manual labor. So they have to already have some precautions; they'll be able to contain any outbreaks. So don't worry. Just don't tell them, they don't want to
Re: (Score:2, Funny)
Re: (Score:2)
I do. I typically make about $5 per memory card, and I sell about 400 per month. It supplements my $50,000 a year salary I get in IT in Silicon Valley.
Where are you getting 400 used memory cards a month?
Re: (Score:1)
Re: (Score:2)
I do. I typically make about $5 per memory card, and I sell about 400 per month. It supplements my $50,000 a year salary I get in IT in Silicon Valley.
So you are buying them for $6 and selling them for $5 with the intention of making up for the loses with volume?
Re: (Score:2)
Yes. I call it the Tesla strategy.
Booooo! You're bashing Musk again! Booooo!
- I was expecting to see you on the Musk offering to help the Thai cave victims article earlier. You let me down, you weren't there.
Re: (Score:2, Insightful)
Thieves. That's also why they don't bother erasing the card.
Re: (Score:2)
Thefts come to mind, be it cell phones, cameras, or whatnot. A cell phone, even if it will never work for a provider, is still worth a lot, due to the screen and other parts, and a SD card, especially a larger one, is just icing on the cake.
Some Android phones do a great job at full volume encryption, so the SD card's loss means data isn't loss. Other phones don't do that, which can be a security risk.
You've discovered my secret! (Score:3)
Oh, wait, people are still lazy? Don't care about security? Wouldn't know how to wipe a card even if they did care? Well, then, I guess I'm all set.
disclaimer: this post is in jest
Re: (Score:2)
Quite the racket you've got going on. But what do you do with the cards after you get the data off of them and blackmail the owners? That's a lot of media. I was thinking, you know, cost per gigabyte on memory cards is so low, it's almost negative. I bet you could do something fun with drive clustering if you had the hardware to do it.
Re: (Score:2)
Load them with malware, then sell them back on eBay! Or sprinkle them at various political gatherings to see who's gullible enough to pick them up and plug them in.
Re: (Score:2)
How devious.
Re: (Score:2)
I like the political espionage angle.
Re: (Score:2)
most memory cards can be used directly by microntrollers with built-in SPI communication. Even just an arduino can give the access. Not to make it fast, but when you're hunting for a "fun" use case, that won't matter; you can still over-build it.
Re: (Score:2)
They're on the card, you just need PhotoRec.
Link to original source (Score:4, Informative)
I could not find the link to the actual report in the summary or the linked article (unless I missed it). But some googling located it.
https://cdn.comparitech.com/static/docs/survey-data-remaining-second-hand-memory-cards-uk.pdf
It is linked in the story of the company that commissioned the research in the first place: https://www.comparitech.com/blog/vpn-privacy/secondhand-memory-card-study/
99% percent of second-hand condoms (Score:1)
Contain genetic material from previous owners.
SD card sellers are cows. (Score:1)
You are all cows. Cows say moo. MOOOOOOO! MOOOOOOO! Moo cows MOOOOOO! Moo say the cows. YOU DBAN-NEEDING COWS!!
Re: (Score:2)
I doubt they'd manage dban, if you want these cows to make progress that easy you'd have to somehow teach them to follow a shepherd.
No, you're going to have to team up with app guy for this one. Make it easier.
TRIM on file deletion would do the job (Score:2)
but alas SD cards don't seem to support it.
FAT chance (Score:1)
P.S. The only reason I know so much about FAT is I tried to write a boot sector virus in assembler in school. Yeah, it didn't work as expected and I en
Re: (Score:2)
Which is ironic, given the high percentage of fat programmers.
Re: (Score:3)
I'm not fat, I've got big ntfs!
Re: (Score:2)
This reminds me of this story [iit.bme.hu].
Re: (Score:2)
Most filesystems in common use don't delete the file's contents, so what's your point?
Help me out (Score:2)
Why is it shocking that you can recover unsecured data from a used memory card again? Especially when you're using recovery software to do the job? This one falls into the "no duh," category.
Re: (Score:2)
people don't understand or don't care (Score:2)
This is nothing new. Several years ago, a local electronics junk store got in a bunch of Blackberries of various models (probably a company going out of business) and were selling them for something like $5 apiece. Daughter was a major texter at the time, and liked the retro look and superior keyboard, so we bought several different models so she could switch between them as her mood took her.
We discovered that all but one of them had not been wiped. Appointments, phone numbers, baby pictures, still inta
Re: (Score:2)
Toss memory cards in fire. Don't breathe the fumes.
A sledgehammer for the HD. It's not enough to mangle the logic board, stepper and heads, you have to destroy the discs.
On selling devices, you're right, but I don't think regular people know enough, and there's few around willing to tell them.
Time for storage to be encrypted by default? (Score:2)
It would cost a bit more but maybe it's time for camera-cards, USB sticks, and the like to routinely use strong encryption with a non-secret-by-default key stored on a the medium itself.
To the end user, it would "just work" except there would be a "quick erase" mode that would scramble the key then either do a normal operating-system-level "long" or "quick" format using the new key.
Even a "quick format" by the OS would be good enough since the left-over data would be encrypted with a now-deleted key.
Now, th