Do you know? Deleted computer files can actually be recovered by hackers in seconds!
In our day-to-day work, we all have the experience of deleting computer files, but many of us never seem to have delved into whether these files have really been completely deleted. I always feel that I can send them to the "Recycle Bin" with one click, and then click on a "Empty Recycle Bin", and everything will be fine.
But this is not the case, although the deleted files have disappeared from the recycle bin, they are still present in our computer system, and these files are not really gone, but have been moved elsewhere.
It is important to know that in some deleted files, there is a high probability that they contain a lot of confidential information and sensitive data. If this data is not properly processed and is recovered and exploited by hackers, it is likely to cause huge losses to companies or individuals.
According to a previous Blancco and Ontrack Privacy for Sale study, more than 40% of used hard drives contain data left over from previous users. This legacy data includes a large number of emails, photos, and documents from offices and employees, putting users and employers at risk of privacy, finances, and reputational damage. In addition, more than 15% of hard drives contain sensitive information. So how to make sure that the files are really gone is very important for us.
Where exactly do deleted files go?
In fact, when we delete a file on our computer, we are actually removing the file from the directory structure in the file system, and the deleted file data remains in the hard disk space of the computer.
To put it simply, the data is still on the hard drive. However, on the computer, the original space where the file data was stored was marked as a blank area, and this blank area can be written into new data at any time. In other words, deleting a file only deletes the pointer information to the data, and does not actually delete the data, and the deleted file still exists on the hard drive, but just becomes invisible.
The delete command only marks the file directory item as a deletion, and the data area does not change in any way. Since the deletion operation does not actually erase the disk datazone information, some data recovery tools take advantage of this to bypass the file allocation table and read the datazone directly and then recover the deleted files.
Seeing this, some people may want to ask, if one-click deletion to the recycle bin cannot completely destroy the data, what about formatting the hard drive? In fact, formatting is simply creating a new index of empty files for the operating system, much the same as emptying the recycle bin, which simply marks all sectors as "unused" and makes the operating system think that there are no files on the hard drive. In most cases, formatting does not affect the data area on the hard disk. Therefore, data recovery software tools can also be used to recover data from formatted hard drive.
In summary, due to the different nature of information carriers, compared with paper documents, data files are usually stored in physical storage media (such as USB flash drives, tapes, hard disks and optical discs), etc., and their destruction technology is more complex and the operation is more cumbersome. Whether you're reformat your hard drive (especially with Quick Format), deleting files from your active environment, or even dragging files to the Trash, the information is still there. All of these methods simply remove the pointer information to the data, but do not actually delete the data itself. When deleting files, it's critical to employ effective and certified data cleansing methods. The goal of complete declassification can only be achieved by adopting correct and thorough data destruction methods.
The serious consequences of inadequate data destruction are "chilling"
In today's era of information explosion, data has become one of the most valuable assets of a business. With the rapid development of cutting-edge technologies such as big data, cloud computing, and the Internet of Things, the amount of data that enterprises accumulate, store, and process is exploding at an unprecedented rate.
But with the sheer value of data comes unprecedented security concerns. Problems such as data leakage, illegal use, and personal privacy infringement frequently appear, which have a serious impact on the economic interests and brand image of enterprises. Therefore, data destruction, as a key part of the entire data lifecycle management, is of great importance to enterprises.
If an enterprise does not destroy 100% of redundant data, it will not only have a false sense of security, but also lead to the leakage of a large amount of information, such as emails, confidential documents, and other sensitive information, which can easily bring high-risk security risks to the enterprise if it is illegally used by hackers.
In addition to the risk of intrusion, stricter data protection rules, such as the Personal Information Protection Act (POPIA) and the General Data Protection Regulation (GDPR), mean that companies must not afford to relax in their information management, according to the Identity Theft Resource Centre. POPIA and GDPR drive the same storage restriction principle, which allows businesses to delete personal data when it's no longer needed. In addition, data storage costs and storage limitations are significant challenges for many companies.
As the "end" of data processing activities, if there is a mistake in this link and leads to data leakage, it will not only harm the rights and interests of the personal information rights holder, but also may cause the leakage of enterprise trade secrets, and may even affect the security and development of society and the country. The consequences of this are not alarmist, as data breaches occur every year, and in many cases, in addition to malicious attacks, are caused by data processors failing to properly destroy the data.
Previously, Tesla had been reported to have the potential risk of user data leakage in its discarded parts. Tesla's media control unit (MCU) stores a large amount of private user data, and although Tesla requires manual confirmation of whether the abandoned media control unit interface has been completely destroyed, the fact that the abandoned media control unit can be traded, and the unit with the interface is not damaged is more expensive. The hacker who received such a media control unit said that according to the user information left on it, the user's phone number and private address could be easily obtained.
It is not uncommon for an enterprise to be negligent in the destruction of data in office equipment, and others have illegally obtained confidential information, thereby committing fraud against users in the name of the enterprise. And it's not just the data in the computer that can be leaked, but also the routers, printers, shredders and other equipment that are discarded by the enterprise may cause security incidents due to incomplete data destruction.
Previously, researchers from cybersecurity firm ESET purchased 18 used core routers online and tested the data retained in the devices, including four devices from Cisco (ASA 5500), three devices from Fortinet (Fortigate family), and 11 devices from Juniper Networks (SRX Series Services Gateways). After testing, researchers Cameron Camp and Tony Anscombe found that more than half of these devices had full configuration data that was accessible and still functional. The test results showed that 1 of the devices was no longer functional on arrival and was eliminated from the test, and 2 devices were mirror images of each other and counted as one in the evaluation results. Among the remaining 16 devices, only 5 devices have their data completely cleared, and 2 devices have almost all their data cleared, making it difficult to access the saved configuration data. The remaining 9 devices retain the complete configuration data of the previous user-configured network and system connection, including owner information, which can be easily accessed by anyone. Some routers retain customer information, allowing third parties to connect to the network's data, and even "credentials to connect to other networks as a trusted party," the researchers said. In addition, 8 out of 9 routers that kept the full configuration data in the above test also saved the router-to-router authentication key and hash. The list of company secrets extends to a complete mapping of sensitive applications hosted on-premises or in the cloud. For example: Microsoft Exchange, Salesforce, SharePoint, Spiceworks, VMware Horizon, SQL, etc. Attackers can deploy specific exploits across the entire network topology based on the granularity and specific version of the application leaked by the router.
For businesses, such detailed internal information is often only accessible to "high-level personnel", such as network administrators and their managers.
However, because the data is not completely destroyed, hackers can easily use this sensitive information in the second-hand core router to easily formulate attack paths and plans to penetrate deep into the network without being detected. With such detailed network information, emulating a network or internal host would be much simpler for an attacker, especially since second-hand router devices often also contain VPN credentials or other easily crackable authentication tokens.
To make matters worse, by analyzing the information in the second-hand routers, the researchers found that some of them came from the environment of hosting IT providers, which operate the networks of many large companies. For example, MSSP, a managed security service provider that handles networks for hundreds of customers in various sectors, such as education, finance, healthcare, manufacturing, and more. The results of this test are a bit chilling, and the importance of data destruction cannot be overstated.
Although the mainland has not yet promulgated effective laws and regulations on data destruction nationwide, various localities have successively issued corresponding documents to regulate the management of government affairs data and public data, and to supervise the compliance of enterprise data, in which they clearly emphasize the establishment of a data destruction system:
*The information is compiled from the official websites of local governments
Data destruction is the last line of defense for data security
In addition to the standardization of the system level, the implementation of technology is also very important, without the support of destruction technology, the system can only be reduced to a "castle in the air". Current data destruction technologies can be divided into two categories:
The first is the destruction of the medium, that is, the destruction of the medium on which the data is stored directly. For example: destruction by physical means such as incineration, high temperature, and crushing; The magnetic field of the mechanical disk is applied to the degaussing machine through the degaussing machine, and the effect of data destruction has been achieved; Or use a variety of acid and alkali corrosive media for chemical destruction.
The second is to erase the data, that is, not to destroy the medium, but only to destroy the data itself, also known as logical destruction. For example, data is erased through data overwriting so that it can no longer be "restored" to the original data; Through the encryption setting, it is "unbreakable with the current computer computing power".
Data destruction technologies have their own advantages and disadvantages, and data processors should choose their own data destruction technologies based on the data they have in their possession, comprehensively consider the technical cost and destruction effect, etc., so as to reduce the risk of data destruction as much as possible. At the same time, enterprises should also establish a special management system for data destruction, clarify the objects, rules, processes, responsibilities, etc., so as to standardize the destruction behavior of specific operators, so as to carry out data destruction activities in an orderly manner.
However, at present, there are still a few entities that can configure relatively complete data destruction technology by themselves, and the destruction medium requires special equipment, tools and sites, and the erasure of data requires reliable technology and personnel, that is, the requirements for data processors are high. In addition, the data processor destroys the stored data by itself, on the one hand, it lacks the ability to supervise, "acting as both an athlete and a referee", which makes it difficult to ensure the true effect of the destruction when the data must be destroyed; On the other hand, "family thieves are difficult to prevent", and the situation of taking risks for the sake of profit cannot be eliminated, so there is a risk that employees who destroy data will resell their data. Therefore, many enterprises will choose to entrust a third-party authority to handle the matter on their behalf. However, when choosing, it should also be noted that it is necessary to entrust a unit with relevant qualifications to ensure the safety and reliability of data destruction.
At present, there is no general open national standard for data destruction in China, but in this field, the DOD 5220.22 technical standard of the US Department of Defense is widely used, which can be used as a reference to evaluate whether the third party meets or even exceeds the requirements of this standard.
In addition, the publicly available national standards were published in 2011, of which the BMB21-2007 standard is "Security and Confidentiality Requirements for the Destruction of Carriers and Information Elimination Involving State Secrets", that is, the standards for the destruction of carriers involving state secrets and the elimination of information have been clarified. In addition, it is reported that the above-mentioned standard should have been updated to BMB21-2019, and there are indeed individual units in the data destruction industry that can meet this standard and have the "Secret Information System Product Testing Certificate" issued by the National Secrecy Science and Technology Evaluation Center. Therefore, data processors can also review the technical capabilities of third-party data destruction in accordance with relevant national standards with higher requirements.
postscript
As a very important part of data security construction, data destruction can effectively prevent data leakage, abuse or improper use, and protect personal privacy and corporate secrets. Data that is not securely destroyed can be stolen by hackers or used by criminals for illegal activities, causing irreparable losses to businesses and individuals. Therefore, data destruction must be regarded as an important part of data security construction to ensure the full-cycle management of data security.
At the same time, the destruction of some expired and redundant data can also reduce the occupation of storage space and improve the efficiency of data processing. A well-defined data destruction process can help companies avoid taking unnecessary risks under the law. Therefore, it is necessary for enterprises to establish and improve the data destruction system and ensure that the destruction technology is complete and reliable.
Resources:
https://news.sohu.com/a/669899030_121124359
http://m.ce.cn/qc/qyw/202005/18/t20200518_34925737.shtml
https://mp.weixin.qq.com/s/bdS7EcO4mP04nKeysNO8dA