Kanagawa government hard disks swiped, sold online

https://www3.nhk.or.jp/nhkworld/en/news/20191206_24/

by ytch • 7 years ago

63 64 7 years ago

www3.nhk.or.jp

I am curious why they chose to rent them instead of buying them, and how many times over they paid their price by doing so?

gibolt• 7 years ago

Maybe there was some reliability guarantee or it is just a tiny government office will little technical background.

pizza234• 7 years ago

The leasing model (it's not 100% certain from the article that they have been leased) may make sense for disks, if the idea is that after some time they must be necessarily replaced.

Assuming they were leased, since the client returned them (instead of purchasing them), physicial space may have been a reason.

ossworkerrights2• 7 years ago

Wouldn't it mean that the lessor would be allowed to sell the drives? I mean if you rent them out, and they are handing the goods back would you just destroy them? Something doesn't sound right here.

blondin• 7 years ago

off topic -- it made me happy to see a news paper from japan and in english too. i browsed around to see what they were covering and even if the news was gloomy, it was somewhat refreshing to see another perspective on what's going on in the world.

ytch• 7 years ago

From my personal experience, reading data in japanese language is the only reliable source to understand what happened in Japan. Their news, press releases, announcements in English are usually too loose.

mpiedrav• 7 years ago

There's also The Japan Times [1]. Several non-English speaking countries do have at least a newspaper in English [2].

[1] https://www.japantimes.co.jp

[2] https://en.m.wikipedia.org/wiki/Category:English-language_ne...

mikekchar• 7 years ago

What follows is a completely biased opinion, but I don't really have a high opinion of The Japan Times. IMHO they have an editorial slant that tends to cater to the foreign reader's biases rather than reporting news from a Japanese perspective. Like all newspapers, it's a mixed bag and there are often well written and insightful stories. However if I were looking for a place to stoke my confirmation bias for common misconceptions about Japan, The Japan Times would be the absolute first place I would look.

The NHK world news linked in the original article is probably the best place to get Japanese news from a Japanese perspective in English, but you also have to be a bit careful. While the NHK is very similar to the UK's BBC in many ways, news stories are frequently very soft on government policy. So it's sort of the opposite of the Japan Times ;-) The quality in general is much better IMHO, though.

If you don't mind relying on Google Translate (which is getting quite good these days) the TBS news website is very good: https://news.tbs.co.jp/ There is video for most stories and a transcript written under the video. This is actually what I used for studying to learn to understand the news. The quality of the stories vary, but they make a good counterpoint to the NHK. Keep in mind that all Japanese news offices tend to have a cozy relationship with the government, so you need to keep your mind open.

If you have an interest in Japan, keeping abreast of these Japanese news is useful as I have found numerous blatant errors in foreign reporting of Japan -- sometimes to the point where they translate something a Japanese official says exactly the opposite to what they are saying. I don't think this is true only of Japanese news either. World news is full of shenanigans and it really is an eye opening experience to follow the news from the perspective of a different country/culture.

bobthepanda3• 7 years ago

If you want something done right (like making sure your data is no longer on someone else’s hard drive), you should really do it yourself.

Zeroing filling a hard drive isn’t hard.

GrumpyNl• 7 years ago

Every hd i ever had and didnt use anymore, i smash a 2 inch nail through it. Thats permanent.

bobthepanda3• 7 years ago

They said they rented the disks, so that probably wasn’t possible.

Renting physical hard drives does seem pretty dumb, though.

sharedfrog2• 7 years ago

For anyone curious as to how, GNU `shred` can do that. Something like:

`shred --force --zero /dev/sda`

should wipe the whole drive, overwriting 3 times (the default) with random bits and once with all zeroes.

a012• 7 years ago

Nothing is more secure than wipe them with a hammer

jki2752• 7 years ago

Unfortunately this is not necessarily effective on modern SSDs.

viraptor• 7 years ago

But also not really guaranteed to do what you want in case of SSDs. It may. Or it may get optimised/balanced leaving lots of data behind.

Aeolun• 7 years ago

I guess a hammer takes care of that too :)

washadjeffmad2• 7 years ago

Years ago we settled on using block device encryption for all flash storage and then destroying the headers or revoking all keys.

This satisfies the infeasibility requirement of NIST SP 800-88 without relying on flash vendors to have appropriately implemented ATA command standards like secure erase, which almost none fully do.

toyg• 7 years ago

No OS handling sensitive data should ever save on unencrypted volumes, ever. Particularly nowadays - with BitLocker and FileVault it’s trivial to achieve this even on desktops and laptops. When you want to kill the data, you just destroy the/any key and you’re done.

Why rely on hardware encryption, when software encryption is basically free?

squarefoot2• 7 years ago

Not an expert here (suggestions welcome), but maybe short of having some thermite at hand, multiple passes of dd if=/dev/urandom of=/dev/disk would be more effective against well equipped parties. There are ways to extract data from zeroed platters in a clean room with the right equipment; writing random data multiple times should be harder to defeat.

hvidgaard2• 7 years ago

I don't think anyone have ever demonstrated the ability to recover data after a few overwrites on any modern harddisk. The entire concept of "residual" magnetism that you can reliably measure sounds ridicules to an engineer.

NKK6co7lnafKvg• 7 years ago

On Linux this will generally be CPU bound instead of IO bound because urandom is very slow. It's much faster to mount it as an encrypted drive with a random key and then dd over the encrypted mapping.

Eg:

cryptsetup open --type plain --key-file /dev/urandom --key-size 256 $DEV crypttmp

dd if=/dev/zero of=/dev/mapper/crypttmp bs=4k

jowsie• 7 years ago

Last place I worked where we had to dispose of customer harddrives, we had some home made contraption that was basically a metal frame with a bottle jack that moved a pickaxe head. No data coming back after a few passes with that.

tyingq4• 7 years ago

Basically a tabletop hydraulic press. You can buy those for under $200.

notadev• 7 years ago

Likely unrelated, but Kanagawa prefecture is home to a large US Navy base in Yokosuka city. A lot of military and US government employees likely have some of their data somewhere on those servers.

jki2752• 7 years ago

I'm hoping this isn't the case as I spent a lot of years there. Most of us had little contact with the local government -- road tax was the only thing we were liable for to the local government.

Well anyway, the US Government has managed to export all my personal data multiple times anyway, this can't be worse than that. The most they'd ever be able to get out of the Kanagawa government is the address where I lived when I was there and probably the license plate to the car I had.

_wldu• 7 years ago

Years ago, I bought an old Sun Netra server from ebay. It had the original OS and apps still installed. Before installing OpenBSD, I changed the root password and looked around. It had customer data from a large, well-known online company.

I looked-up the company's contact info and emailed them. They called the next day and asked for the server's serial number (which I gave them). A few days later one of the company's executives called back and asked me to confirm the serial number (which I did), he said he was holding a certificate of destruction for that server's hard drives and would be taking some action against the contractor that had been hired to destroy them. I had already wiped the data and installed OpenBSD (or was about to).

Anyway, I'm not surprised this type of thing still occurs. To be sure data is not exposed, companies ought to wipe drives themselves and encrypt them before handing them over to contractors. Once the gear is gone, no one knows where it will end up.

tyingq4• 7 years ago

I had a similar experience. Bought a 1U server on eBay. It was apparently the central controller for the flight information displays at a big airport. Lots of plain text passwords for upstream services in config files, etc.

mc325• 7 years ago

If things are that sensitive and important no disk should leave a building whole. You have to have a ridiculous process in place that is unforgiving that says that unless physically destroyed a disk cannot leave a building (unless it’s in a sealed bag from mfg —obviously disks have to get from receiving to where they’ll be used).

avar2• 7 years ago

You make that policy and pay a contractor to enforce it, and now you're back to square #1. Usable hard disks are just heavier and more inconvenient money.

Truly ensuring their destruction is going to cost, including but not limited to security guards, people to watch those people, searching through or destroying the trash generated in the building, looking through "parts" to see if they're disassembled hard disks etc.

vidarh7• 7 years ago

Part of the problem is that modern hard drives are hard to destroy. E.g. try taking a hammer and chisel to them - you might manage to destroy the connectors and PCBs, but those are replaceable, and someone having hacked the pcb to pieces is a good sign it's worth trying to get to the contents. Getting to the platters is a pain, and destroying them enough to make recovery impossible as well.

If you don't have a facilities department that is prepared - e.g. with protective gears and an angle grinder or similar power tools, odds are someone will decide it's easier to bypass that process you describe than to get the equipment and do the job properly. It takes firm management by someone who knows and understand the risks and cares about preventing them to ensure it's hard enough to bypass these processes, and hiring someone that takes this seriously just isn't high up on peoples list (e.g. I've never been asked about what approach I'd take to physical security of server infrastructure by anyone wanting to hire me to roles where I'd be responsible for server infrastructure).

C14L• 7 years ago

There should be no need to wipe or zerofill the drives. They should be full disk encrypted from the start.

Kanagawa government hard disks swiped, sold online

Related Stories