Ace of Spades HQ

April 22, 2010

Oh Goody, A New Security Threat
— LauraW

Got a photocopier in your home or office?
Chances are, it keeps a record of everything you have ever copied.

Nearly every digital copier built since 2002 contains a hard drive - like the one on your personal computer - storing an image of every document copied, scanned, or emailed by the machine.
In the process, it's turned an office staple into a digital time-bomb packed with highly-personal or sensitive data.
If you're in the identity theft business it seems this would be a pot of gold.

I highly recommend reading the linked article. It is a good bit of investigative journalism and you will be surprised at what they found. Gotta give credit where credit is due.

So many corporations, doctor's offices, police stations, attorneys, etc. use high tech procedures to protect your data, as well as low tech (shredding).

But now all your information can, and likely already has been, wheeled unknowingly out the back door at the end of their copiers' lease period, off to God-knows-where.

The day we visited the New Jersey warehouse, two shipping containers packed with used copiers were headed overseas - loaded with secrets on their way to unknown buyers in Argentina and Singapore.

Oh, well. I'm sure that's fine.

Posted by: LauraW at 08:02 AM | Comments (38)
Post contains 219 words, total size 1 kb.

Any statistics on what percentage of these images contain private bits?

Posted by: Fritz at April 22, 2010 08:06 AM (GwPRU)

I'm sure my dept copier has seen its fair share of women's crotches and boobs.

Posted by: EC at April 22, 2010 08:10 AM (mAhn3)

3 How big would that hard drive have to be in order to hold even a week's worth of copies? In theory, a thief could use it to find the last 1000 copies. Unless they know what they're looking for, it's a needle in a haystack situation.

Posted by: AmishDude at April 22, 2010 08:10 AM (T0NGe)

4 There should be a method to erase those hard drives.

Posted by: Vic at April 22, 2010 08:10 AM (QrA9E)

5 #4, There is. A very strong magnet passed several times over the drive.

Posted by: 1sttofight at April 22, 2010 08:12 AM (cVnTj)

6 Big win for bored Kinko's clerks everywhere.

Posted by: DelD at April 22, 2010 08:13 AM (eWtdM)

4 There should be a method to erase those hard drive.

Nuc them from space.

Posted by: Ronster at April 22, 2010 08:14 AM (50lLr)

8 About the only thing anybody will learn from this is how big the average bored office worker's ass is. (Answer: Really, really big.)

Posted by: joncelli at April 22, 2010 08:18 AM (RD7QR)

9 My spider-sense determines there will be lawsuits. Many of them copied repeatedly.

Posted by: Nemo from Erewhon at April 22, 2010 08:19 AM (kKHE8)

10 3 How big would that hard drive have to be in order to hold even a week's worth of copies? In theory, a thief could use it to find the last 1000 copies. Unless they know what they're looking for, it's a needle in a haystack situation.

As a (very) rough estimate for a 20 GB hard drive (tiny) figure it would hold over 100,000 pages assuming a fairly large 200KB post script document.

Posted by: s☺mej☼e at April 22, 2010 08:27 AM (4y0YU)

11 From a friend:
Homeland Security requirements following 9/11. It's actually in one of the continuing appropriation bills that go through Congress without getting read. Wanna know the part that REALLY gives you the heebie-jeebies? If it's a copier used in any federal facility, building, courthouse, department, etc., the snoops have ONLINE ACCESS to the stored images in that machine.

Don't ask me how I know this - I can't say - but it's in the public version of the law if you want to look it up.

Posted by: Original Roy at April 22, 2010 08:29 AM (wTawr)

12 9 No more ass-scans for me.

It was goofy of you to tattoo your Social Security number and mother's maiden name on it, honestly. Don't know what you were thinking.

Posted by: lauraw at April 22, 2010 08:29 AM (ZjdpY)

13 The hard drive big enough to hold my junk hasn't been made.

Posted by: Cerebral Paul Z. at April 22, 2010 08:30 AM (iSdjV)

14 Ok, how about a little more investigative journalism and find out who's fucking bright idea it was to put hard drives in copiers? Name 'em and shame 'em, maybe something'll get done about it.

Posted by: KG at April 22, 2010 08:38 AM (S8TF5)

15 Wonder how much of this "threat" is simply PR for a "solution."

Posted by: ParisParamus at April 22, 2010 08:49 AM (Dpyu9)

16 I had also heard that right after this report aired someone had broken into a warehouse and stolen the hard drives out of eighteen used copiers.
I know many large corporations (insurance, financial, etc.) that send out their older tech units for recycling. I know that the computer hard drives are ussually dealt with but wonder if these were ever considered.

Posted by: Have Blue at April 22, 2010 08:53 AM (mV+es)

17 Unintended side effect of a technological advancement. Be glad they're not cylons... yet.

FIFY

Posted by: KG at April 22, 2010 09:00 AM (S8TF5)

18 OK, I have done some checking around. This problem was noted all the way back in 2001 when the hard drives were first being installed in the copiers. They typically had a 5g drive that maintained the images.

The IT departments were made aware of the potential for loss of info and the larger firms have taken steps to make sure the data is protected.

Note that not all copiers have these drives.

Posted by: Vic at April 22, 2010 09:00 AM (QrA9E)

19 This isn't really news, larger printers and copiers etc. have had hard disks and other persistent storage in them for quite a while.

There's also been a couple notable security holes in the network administration facilities of some printers and copiers, and it's really quite rare to find a shop that spends any time keeping its printers and copiers up to date on their OS patches.

Posted by: mrkwong at April 22, 2010 09:02 AM (G8Eo0)

20 Man this has been known about for years in the military community.

Posted by: CDR M at April 22, 2010 09:38 AM (Mv/2X)

21 Yeah this is an old story and not really investigative journalism. More like some guy wanting to sell his software program. This has been known for some itme. I recall several years ago when some college kids were doing illegal music file swapping by storing them on the copier's hard drive...pretty clever actually. And a couple of years ago there was some thing at the Social Security Admin about this. Apparently they weren't all following procedure and sanitizing the hard drives when they disposed of the copiers or had them repaired.

Posted by: Deanna at April 22, 2010 09:56 AM (ZzV20)

So it would seem that every HR dept, employment or temp agency that copies an applicants' drivers lic. and soc. sec. card has a goldmine of info, all in one tidy package, potentially available to prying eyes. And I thought only my gov't handlers could get into my personal life...

Posted by: hatchie1 at April 22, 2010 11:21 AM (tUBUr)

23 And isn't it strange you can never find the documents that you have stored in the damned things!

Posted by: kingfisher at April 22, 2010 12:32 PM (Rb259)

24 Wow, Laura, thanks. I didn't have a clue that this was possible.

Posted by: Lipstick at April 22, 2010 12:49 PM (b+nOT)

25 That's okay. Nobody will be able to tell that that fat black ass sitting on the copier was Michelle.

Posted by: Anonymous White House Resident at April 22, 2010 01:35 PM (ITzbJ)

26 I dealt with all the copier/printer mfrs for a fortune 10 company so I know what the machines are capable of. Yes they do store the image of the originals for the purpose of copy/fax. So as far as it goes that report is accurate. But it is not the whole truth either.

First your typical desktop printer does not have this capability as it typically does not have a hard drive. They use memory instead. So if you are worried about retention, turn the printer off at night.

The workgroup class machines all have harddrives as the report covered. But all the machine from Xerox, HP, Lexmark, Canon has administrative functions that can limit the amount of data stored on the drives. Not only that but the admin can wipe the data if it is consider necessary. They can also set the time span that data is retained for many of the models.

A sensaton article written for fear when the real issue is a lack of administrative attention to wiping drives before they leave the business. IT does this for servers. They need to do the same for printers.

Posted by: JohnMc at April 22, 2010 04:38 PM (kZxAh)

27 Thank you for posting this, Laura.

That means it is possible that my company is liable for the social seciriuty numbers, driver's license pics, and other private info from employees, and credit card info, asdresses and phone numbers from customers, that may get stolen.

Posted by: flashbazzbo, s.e. at April 22, 2010 05:27 PM (x7MwC)

28 There should be a method to erase those hard drives.

A) Remove drive
B1) Penetrate the disk area several times with 9mm FMJ or...
B2) Chuck up a 1/2" drill in your drill press and drill several holes completely through the drive top to bottom

B1 is obviously more fun, but B2 disturbs the neighbors less.

Posted by: Purple Avenger at April 22, 2010 08:30 PM (5EXej)

29 penis bÃ¼yÃ¼tÃ¼cÃ¼

Posted by: penis büyütücü at December 11, 2010 03:38 PM (wVs6u)

30 Hi.NHL Jerseys on sale,buy your favariteNHL Hockey Jersey for you.the best team : Chicago Blackhawks Jerseys and Pittsburgh Penguins Jerseys .

Posted by: NHLJersey at February 17, 2011 08:41 PM (kRyvz)

31 good method

Posted by: car dvd at April 14, 2011 06:14 PM (1q5uT)

32 cz

Posted by: baseball online shop at May 01, 2011 06:25 AM (s+Nt6)

33 What I want to know is why I should care? I mean, not to say that what youve got to say isnt important

Posted by: NBA Cheap Jerseys at May 20, 2011 11:45 PM (G45jB)

34 jerseys