Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Millions of usable hard drives are being destroyed

bbc.com

Post reply on HN
Print view View original

91–100 of 153 posts

Re: Millions of usable hard drives are being destroyed

#91

Post by NotYourLawyer »

hospitalJail wrote: post #51
NotYourLawyer wrote: post #48

Earlier quoted context omitted.

I can imagine lots of plausible/implausible things. If they’re not practically possible, I’m not gonna worry about them.

Oh for sure, you aren't a high value target. Its why people don't worry about Apple and Privacy/Security. They arent the best in the business, but unless you are a VIP, no one is going to waste the latest 0click pegasus exploit on you.

Developing a 0 click exploit is a lot easier than recovering useful data from a small, physically damaged chip of a hard drive platter.

Re: Millions of usable hard drives are being destroyed

#92

Post by Damogran6 »

I've had this argument til I'm blue in the face.

1. Nuke the key and an encrypted drive is indistinguishable from noise. 1a. When SAN sizes get STUPIDLY LARGE, miltiple writes are cost and energy prohibitive, crushing is cheap, cert revocation is cheaper and leaves a device with residual value. 2. In the datacenter, data at rest is not a target, the attack happens higher up the stack where the OS/SQL/App can read the data 3. Areal density is such that a drive in a RAID array doesn't have much to offer up*

(* = I'm willing to lose #3 if #1 is utilized.)

But there's always some mouthbreather n00b or auditor or person that took a forensics class once that stands in the way.

Re: Millions of usable hard drives are being destroyed

#93

Post by pixl97 »

hallgrimur1471 wrote: post #49
V__ wrote: post #39

Earlier quoted context omitted.

> "They have a zero-risk policy. It can't be one in a million drives, one in 10 million drives, one in 100 million drives that leaks. It has to be zero." At some point human error will kick in, a firmware bug will prevent a complete override of the disk, or some new technology will be able to detect overridden data.

Yes but shredding the drives isn't zero risk either. For example, there is a risk a disk would be stolen before it reaches the shredding place.

So measure the risk probability and show it to me?

There are multiple ways to shred. When you get drives from the bank, they have a semi down in the parking lot doing it on site. Other companies tag each device then document each one getting tossed in the shredder. If one of these devices shows back up after destruction then there is going to be some legal hell to pay.

It's nearly impossible to tell if a disk has been erased by looking at it from the outside. But a shredded device, well that's easy enough.

Re: Millions of usable hard drives are being destroyed

#94

Post by crazygringo »

JohnFen wrote: post #83
crazygringo wrote: post #71

This article mentions disposing of hard drives that have reached their five-year mark and are no longer under warranty. Does anybody actually want hard drives this old? Isn't the whole point that the risk of failure and therefore data loss is too high by this point? Even if you're using them to store data redundantly, you're running the risk that when one drive fails, the backup will also encounter failure due to the…

> Does anybody actually want hard drives this old? Sure, I would! I frequently use hard drives much older than this, and while I know there's an increased risk of failure, it has never happened to me -- so that risk appears to be quite tiny.

Take a look at how failure rates dramatically accelerate once you hit 5 years:

https://www.backblaze.com/blog/how-long-do-disk-drives-last/

The risk is anything but tiny.

"How long do drives last? It would appear a reasonable estimate of the median life expectancy is six years and nine months."

Re: Millions of usable hard drives are being destroyed

#95

Post by Damogran6 »

gumby wrote: post #65
thedougd wrote: post #7

Surprised it doesn't mention compliance frameworks as a culprit. NIST 800-88 calls for destruction if the data is highly sensitive and the drive is leaving the organization. Wrt risk management, it's not worth deviating from NIST. https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=91793...

who would want to claim that their data isn't "highly sensitive"? How embarrassing that would be! This isn't a sarcastic remark: I think a lot of human activity can be explained this way.

It isn't even data sensitivity.

Laptop stolen? What was on it? "zOMG, We Don't KNOW!?!!!1" Was it encrypted? Yes Was the lid closed? Yes Order another laptop and move along.

Re: Millions of usable hard drives are being destroyed

#96

Post by SkyPuncher »

From a risk management perspective, most storage devices have a "table stakes" requirement to "not lose data". Performance, storage duration, reliability, etc, etc, etc, etc, are all secondary to "do not lose data". You're dead in the water if you lose data. Everything beyond "don't lose data" can and is proprietary implementations of read/write; often with tricks being used to increase speed.

While it's challenging (if not impossible) to recover data from most "blanked out" drives, there is often no guarantee that a blanking process actually renders the underlying data unusable. For example, I believe many SSDs will simply mark a block as "unused" rather than physically rewriting the data in that block. When the block gets used again, you simply set it to the new values.

Whether it's practical, right now, to recover data really doesn't matter. These drives are leaving an organization forever. You will have absolutely no control over them. If a technique comes out to recover data from them, you cannot risk having drives floating around that are now recoverable.

Re: Millions of usable hard drives are being destroyed

#97

Post by pessimizer »

crazygringo wrote: post #71

This article mentions disposing of hard drives that have reached their five-year mark and are no longer under warranty. Does anybody actually want hard drives this old? Isn't the whole point that the risk of failure and therefore data loss is too high by this point? Even if you're using them to store data redundantly, you're running the risk that when one drive fails, the backup will also encounter failure due to the…

With 6-8 drives in RAID 6, that's a vanishingly small probability which you should have an offline/remote backup to make sure would not be a disaster anyway. If there were a super-cheap source of five year-old drives, I'd never use anything newer.

Re: Millions of usable hard drives are being destroyed

#98

Post by Damogran6 »

404mm wrote: post #55
kryogen1c wrote: post #54

Earlier quoted context omitted.

Don't forget that sensitive data is encrypted. The only thing harder than breaking bitlocker on a hard drive is breaking bitlocker on a random 0.5% chunk of hard drive unaligned with the r/w tracks. Bullshit is too weak a word.

Encrypted and stripped/sharded in most cases. My employer just shredded somewhat new-ish enterprise grade SSD worth a few $M. It hurt to watch :(

Overheard: "Does our Degausser work on SSDs?"

Re: Millions of usable hard drives are being destroyed

#99

Post by b112 »

kryogen1c wrote: post #54
NotYourLawyer wrote: post #28

> The irony is that shredding devices is relatively risky today. The latest drives have 500,000 tracks of data per square inch. A sophisticated data recovery person could take a piece as small as 3mm and read the data off it, Mr Hands says. I call bullshit on this, unless you can show me a single example of this ever happening anywhere.

Don't forget that sensitive data is encrypted. The only thing harder than breaking bitlocker on a hard drive is breaking bitlocker on a random 0.5% chunk of hard drive unaligned with the r/w tracks. Bullshit is too weak a word.

Do you audit all the hard drives, to make sure that:

* someone didn't prep and use the drives before using OS level encryption

* someone didn't ignore swap space, eg config mistake

* some process was supposed to set up / a person set up, but didn't

Are you going to audit all those drives? It's literally cheaper to just destroy them, far far cheaper.

Re: Millions of usable hard drives are being destroyed

#100

Post by doublerabbit »

kryogen1c wrote: post #54
NotYourLawyer wrote: post #28

> The irony is that shredding devices is relatively risky today. The latest drives have 500,000 tracks of data per square inch. A sophisticated data recovery person could take a piece as small as 3mm and read the data off it, Mr Hands says. I call bullshit on this, unless you can show me a single example of this ever happening anywhere.

Don't forget that sensitive data is encrypted. The only thing harder than breaking bitlocker on a hard drive is breaking bitlocker on a random 0.5% chunk of hard drive unaligned with the r/w tracks. Bullshit is too weak a word.

> Bullshit is too weak a word.

Try the English slang word for bullshit, bollocks.

Or that if we wish to keep it PG: deceptive nonsense.

Post reply on HN