14 ms·

Digital Photocopiers Loaded with Secrets (2010)

166 points by artsandsci 8y ago

dsfyu404ed 8y ago
This has been known for a long time now. Articles like this pop up from time to time. Competent IT departments pull hard drives before copiers are gotten rid of.
- michrassena 8y ago
  And most of them have the option to secure erase either after every scan, or on a schedule. But it's amazing how few people outside of IT know that most devices have embedded websites, let alone the security implications.
  - djsumdog 8y ago
    Secure erase of a metal/spinny drive is really not enough. There are data recovery companies who can pull data on metal hard drives from hundreds of writes in the past. These hard drives should be pulled and re-purposed internally for sensitive information in data centers (to reduce waste), and if they can't be, they should be physically destroyed. (US government agencies shred or melt drives). Ideally, copier companies should (if they insist on not removing the drives) encrypt them by default. That way when you "wipe" the copier for sale, it just deletes the encryption key from flash memory. Then the bar for data recovery becomes incredibly difficult and you don't have to waste the drive.
    - fooker 8y ago
      Source for 'hundreds of writes in the past'?
    - tinus_hn 8y ago
      That only works on a disk using a format from the 90s. On a modern disk once you overwrite a sector the contents are no longer retrievable. There are no companies that can read a sector that has been overwritten. They can only recover damaged drives and files that have been deleted by the operating system and not been overwritten. On the other hand, deleting flash memory is very difficult because the controller doesn’t really do what you ask it to do.
      - BoorishBears 8y ago
        These days controllers have secure delete / wipe commands too
    - jacquesm 8y ago
      > There are data recovery companies who can pull data on metal hard drives from hundreds of writes in the past. That's great, that means we can store 100's of times more data on the drives than we do!
    - ClassyJacket 8y ago
      > There are data recovery companies who can pull data on metal hard drives from hundreds of writes in the past. This isn't true - if it was, hard drive companies would use that space to store primary data, increasing the capacity of their drives by hundreds of times compared to the competition.
    - c22 8y ago
      For what it's worth I gave you an upvote because even though your unsourced assertion in the first paragraph is clearly absurd, I liked your message about recycling and agree that an encrypted ring buffer that loses the key on "factory reset" would be an elegant solution to this problem that would not impact other functionality.
    - kalleboo 8y ago
      The "you can recover overwritten data" thing is a myth. There was a paper that showed a theory behind it (for old drives using a different technology than is used today), but there's no proof anyone has ever actually done it. http://www.infosecisland.com/blogview/16130-The-Urban-Legend-of-Multipass-Hard-Disk-Overwrite.html http://www.infosecisland.com/blogview/16130-The-Urban-Legend...
- jlgaddis 8y ago
  Yep, and printers should be on their network, with a firewall in between them and end users -- print jobs must go through a print server. An end user device should not be able to communicate directly with a network printer. Last I knew, most HP network printers still have SNMP enabled by default (with the default "public" and "private" community strings as well) and many (most?) also have exposed web interfaces and the default credentials often are not changed. Even relatively competent tech people don't realize they can get "pwned" via their printers.
  - mindslight 8y ago
    Hey now. Putting strategically-located campus printers in my own /etc/printcap was how I JIT-printed my college assignments back in the day.
- egypturnash 8y ago
  This is definitely one of those things that's worth repeating, though. I got to be one of today's Lucky 10,000 (https://xkcd.com/1053/ https://xkcd.com/1053/) with regards to this old news.
yaccz 8y ago
Its from 2010
mathieubordere 8y ago
Why do they store everything?
- ironcan 8y ago
  This is the important question, why is this feature even on by default? Why is it an option to NOT have that feature?
  - giardini 8y ago
    For the same reason most, if not all, copiers and printers embed hidden markings into output - so 3-letter agencies and law enforcement can track documents: https://www.google.com/search?q=hidden+markings+in+printed+pages https://www.google.com/search?q=hidden+markings+in+printed+p...
    - hnaccy 8y ago
      I have to agree. Storing thousands of old documents does not seem like an accident.
      - pwg 8y ago
        The code running the copier likely did an unlink(filename) when done with the job. And once deleted, it looked like it was gone from the point of view of looking at a directory listing of the drive. Of course the programmer writing the code did not consider all those "undelete" utilities that exist to "undo an unlink(filename) operation" and how they might just be used to recover the files.
- 21 8y ago
  Probably they have a "redial" feature, which let's you reprint something again.
- RachelF 8y ago
  Not everything, but think of the workflows they are used for: Printing: They spool print jobs to their hard drive before printing. Scanning: They create temporary image files for ocr and pdf conversion. These files then need to be emailed to a user or sent via a file server. Photocopying: Temporary image files are also created. Photocopying on a digital copier is effectively a scan then print operation.
atVelocet 8y ago
"One of the copiers had documents still on the copier glass, from the Buffalo, N.Y., Police Sex Crimes Division." No comment.
btown 8y ago
> from Affinity Health Plan, a New York insurance company, ... we obtained the most disturbing documents: 300 pages of individual medical records. They included everything from drug prescriptions, to blood test results, to a cancer diagnosis. A potentially serious breach of federal privacy law. > As for Affinity Health Plan, they issued a statement that said, in part, "we are taking the necessary steps to ensure that none of our customers' personal information remains on other previously leased copiers, and that no personal information will be released inadvertently in the future." For comparison, per https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf - "As required by section 13402(e)(4) of the HITECH Act, the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals." Of course, any single breach of a copier would be limited to the individuals whose documents touched that copier, and might come under this threshold. Affinity is not on the list at the moment - this may be because the news only just broke. But do the regulatory bodies say "Affinity, you were found to not have a procedure for properly disposing of copiers, so we need to assume that you've leaked health information from EVERY disposed copier historically?" Only then would it be treated with the same seriousness that e.g. HIPAA-compliant SaaS services are expected to treat security. Just because copier hard drives aren't networked software doesn't mean that they don't have network-scale security problems.
- josefdlange 8y ago
  Only just broke eight years ago. Curious...
- wrs 8y ago
  https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/examples/health-plan-photocopier-breach-case/index.html https://www.hhs.gov/hipaa/for-professionals/compliance-enfor... "Affinity Health Plan, Inc. will settle potential violations of the HIPAA Privacy and Security Rules for $1,215,780. OCR’s investigation indicated that Affinity impermissibly disclosed the protected health information of up to 344,579 individuals when it returned multiple photocopiers to a leasing agent without erasing the data contained on the copier hard drives."
liveoneggs 8y ago
fax machines used to leave copies of everything on the roll/ribbon/drum/whatever too. Especially the ones in sealed plastic were often just a giant roll of carbon paper with everything you've ever sent/received on it.
- shkkmo 8y ago
  Wouldn't the carbon paper only have everything you've received?
  - liveoneggs 8y ago
    good catch.
vasili111 8y ago
What about personal (home versions) Photocopiers, Scanners and Printers? Did they store similar information too?
- daxfohl 8y ago
  Anyone could provide an answer but barring that do you have one of those magic 8 balls around? It might be more accurate.
- crankylinuxuser 8y ago
  Well, probably not, at least for document storage. Although you could take the thing apart and use a bus pirate and interrogate the flash chips onboard, to see what goodies are there. My guess is its just firmeware. Storage is still too expensive for a junk consumer model, to dump TBs of storage. Now on an office copier, of course they do that. But that's what the target here is. If you have a printer, it likely puts the yellow dots on it.
NegativeLatency 8y ago
> One product from Sharp automatically erases an image from the hard drive. It costs $500. Storing the images isn't a bug, it's a feature.
metaphor 8y ago
Worth noting that NIST has published a brief report[1] providing risk management guidance on this security concern. [1] http://dx.doi.org/10.6028/NIST.IR.8023 http://dx.doi.org/10.6028/NIST.IR.8023
kakwa_ 8y ago
I've seem a similar mistake nearly been made. There was a printer (the big, one cubic meter, enterprise type) in a sensitive air-gaped network that was not used anymore, and there was a plan to reuse it on the main network. It was nearly installed when I saw it and mentioned that these things have hard drives in them to my Security Officer over a coffee. It was promptly removed after that. This organization was quite conscientious about this kind of stuff, every disks was labeled, regularly inventoried and crushed in presence of the Security Officer when not used anymore. But these printers can easily be mismanaged as people don't realize they are basically computers that see tons of information.
- golergka 8y ago
  That seems like a highly unusual organization in terms of how well it manages it's security and how seriously does it take it. Does it specialize in it?
  - kakwa_ 8y ago
    If you are touching sensitive systems, like military infrastructure, nuclear power plant, law enforcement, banks, it's not uncommon at all. In some cases, mostly governmental stuff, you can be personally liable if you misplace accidentally documents or other sensitive pieces of information (like a spending a few years in prison).
syshum 8y ago
Given this is from 2010 perhaps people should look at current practices before freaking out. Almost all modern copiers employ some kind of Disk Encryption so this issue has largely been resolved. http://siica.sharpusa.com/Document-Systems/Security http://siica.sharpusa.com/Document-Systems/Security

166 points by artsandsci 8y ago

This has been known for a long time now. Articles like this pop up from time to time. Competent IT departments pull hard drives before copiers are gotten rid of.

michrassena 8y ago
And most of them have the option to secure erase either after every scan, or on a schedule. But it's amazing how few people outside of IT know that most devices have embedded websites, let alone the security implications.
- djsumdog 8y ago
  Secure erase of a metal/spinny drive is really not enough. There are data recovery companies who can pull data on metal hard drives from hundreds of writes in the past. These hard drives should be pulled and re-purposed internally for sensitive information in data centers (to reduce waste), and if they can't be, they should be physically destroyed. (US government agencies shred or melt drives). Ideally, copier companies should (if they insist on not removing the drives) encrypt them by default. That way when you "wipe" the copier for sale, it just deletes the encryption key from flash memory. Then the bar for data recovery becomes incredibly difficult and you don't have to waste the drive.
  - fooker 8y ago
    Source for 'hundreds of writes in the past'?
  - tinus_hn 8y ago
    That only works on a disk using a format from the 90s. On a modern disk once you overwrite a sector the contents are no longer retrievable. There are no companies that can read a sector that has been overwritten. They can only recover damaged drives and files that have been deleted by the operating system and not been overwritten. On the other hand, deleting flash memory is very difficult because the controller doesn’t really do what you ask it to do.
    - BoorishBears 8y ago
      These days controllers have secure delete / wipe commands too
  - jacquesm 8y ago
    > There are data recovery companies who can pull data on metal hard drives from hundreds of writes in the past. That's great, that means we can store 100's of times more data on the drives than we do!
  - ClassyJacket 8y ago
    > There are data recovery companies who can pull data on metal hard drives from hundreds of writes in the past. This isn't true - if it was, hard drive companies would use that space to store primary data, increasing the capacity of their drives by hundreds of times compared to the competition.
  - c22 8y ago
    For what it's worth I gave you an upvote because even though your unsourced assertion in the first paragraph is clearly absurd, I liked your message about recycling and agree that an encrypted ring buffer that loses the key on "factory reset" would be an elegant solution to this problem that would not impact other functionality.
  - kalleboo 8y ago
    The "you can recover overwritten data" thing is a myth. There was a paper that showed a theory behind it (for old drives using a different technology than is used today), but there's no proof anyone has ever actually done it. http://www.infosecisland.com/blogview/16130-The-Urban-Legend-of-Multipass-Hard-Disk-Overwrite.html http://www.infosecisland.com/blogview/16130-The-Urban-Legend...
jlgaddis 8y ago
Yep, and printers should be on their network, with a firewall in between them and end users -- print jobs must go through a print server. An end user device should not be able to communicate directly with a network printer. Last I knew, most HP network printers still have SNMP enabled by default (with the default "public" and "private" community strings as well) and many (most?) also have exposed web interfaces and the default credentials often are not changed. Even relatively competent tech people don't realize they can get "pwned" via their printers.
- mindslight 8y ago
  Hey now. Putting strategically-located campus printers in my own /etc/printcap was how I JIT-printed my college assignments back in the day.
egypturnash 8y ago
This is definitely one of those things that's worth repeating, though. I got to be one of today's Lucky 10,000 (https://xkcd.com/1053/ https://xkcd.com/1053/) with regards to this old news.

yaccz 8y ago

Its from 2010

mathieubordere 8y ago

Why do they store everything?

ironcan 8y ago
This is the important question, why is this feature even on by default? Why is it an option to NOT have that feature?
- giardini 8y ago
  For the same reason most, if not all, copiers and printers embed hidden markings into output - so 3-letter agencies and law enforcement can track documents: https://www.google.com/search?q=hidden+markings+in+printed+pages https://www.google.com/search?q=hidden+markings+in+printed+p...
  - hnaccy 8y ago
    I have to agree. Storing thousands of old documents does not seem like an accident.
    - pwg 8y ago
      The code running the copier likely did an unlink(filename) when done with the job. And once deleted, it looked like it was gone from the point of view of looking at a directory listing of the drive. Of course the programmer writing the code did not consider all those "undelete" utilities that exist to "undo an unlink(filename) operation" and how they might just be used to recover the files.
21 8y ago
Probably they have a "redial" feature, which let's you reprint something again.
RachelF 8y ago
Not everything, but think of the workflows they are used for: Printing: They spool print jobs to their hard drive before printing. Scanning: They create temporary image files for ocr and pdf conversion. These files then need to be emailed to a user or sent via a file server. Photocopying: Temporary image files are also created. Photocopying on a digital copier is effectively a scan then print operation.

atVelocet 8y ago

"One of the copiers had documents still on the copier glass, from the Buffalo, N.Y., Police Sex Crimes Division." No comment.

btown 8y ago

> from Affinity Health Plan, a New York insurance company, ... we obtained the most disturbing documents: 300 pages of individual medical records. They included everything from drug prescriptions, to blood test results, to a cancer diagnosis. A potentially serious breach of federal privacy law. > As for Affinity Health Plan, they issued a statement that said, in part, "we are taking the necessary steps to ensure that none of our customers' personal information remains on other previously leased copiers, and that no personal information will be released inadvertently in the future." For comparison, per https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf - "As required by section 13402(e)(4) of the HITECH Act, the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals." Of course, any single breach of a copier would be limited to the individuals whose documents touched that copier, and might come under this threshold. Affinity is not on the list at the moment - this may be because the news only just broke. But do the regulatory bodies say "Affinity, you were found to not have a procedure for properly disposing of copiers, so we need to assume that you've leaked health information from EVERY disposed copier historically?" Only then would it be treated with the same seriousness that e.g. HIPAA-compliant SaaS services are expected to treat security. Just because copier hard drives aren't networked software doesn't mean that they don't have network-scale security problems.

josefdlange 8y ago
Only just broke eight years ago. Curious...
wrs 8y ago
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/examples/health-plan-photocopier-breach-case/index.html https://www.hhs.gov/hipaa/for-professionals/compliance-enfor... "Affinity Health Plan, Inc. will settle potential violations of the HIPAA Privacy and Security Rules for $1,215,780. OCR’s investigation indicated that Affinity impermissibly disclosed the protected health information of up to 344,579 individuals when it returned multiple photocopiers to a leasing agent without erasing the data contained on the copier hard drives."

liveoneggs 8y ago

fax machines used to leave copies of everything on the roll/ribbon/drum/whatever too. Especially the ones in sealed plastic were often just a giant roll of carbon paper with everything you've ever sent/received on it.

shkkmo 8y ago
Wouldn't the carbon paper only have everything you've received?
- liveoneggs 8y ago
  good catch.

vasili111 8y ago

What about personal (home versions) Photocopiers, Scanners and Printers? Did they store similar information too?

daxfohl 8y ago
Anyone could provide an answer but barring that do you have one of those magic 8 balls around? It might be more accurate.
crankylinuxuser 8y ago
Well, probably not, at least for document storage. Although you could take the thing apart and use a bus pirate and interrogate the flash chips onboard, to see what goodies are there. My guess is its just firmeware. Storage is still too expensive for a junk consumer model, to dump TBs of storage. Now on an office copier, of course they do that. But that's what the target here is. If you have a printer, it likely puts the yellow dots on it.

NegativeLatency 8y ago

> One product from Sharp automatically erases an image from the hard drive. It costs $500. Storing the images isn't a bug, it's a feature.

metaphor 8y ago

Worth noting that NIST has published a brief report[1] providing risk management guidance on this security concern. [1] http://dx.doi.org/10.6028/NIST.IR.8023 http://dx.doi.org/10.6028/NIST.IR.8023

kakwa_ 8y ago

I've seem a similar mistake nearly been made. There was a printer (the big, one cubic meter, enterprise type) in a sensitive air-gaped network that was not used anymore, and there was a plan to reuse it on the main network. It was nearly installed when I saw it and mentioned that these things have hard drives in them to my Security Officer over a coffee. It was promptly removed after that. This organization was quite conscientious about this kind of stuff, every disks was labeled, regularly inventoried and crushed in presence of the Security Officer when not used anymore. But these printers can easily be mismanaged as people don't realize they are basically computers that see tons of information.

golergka 8y ago
That seems like a highly unusual organization in terms of how well it manages it's security and how seriously does it take it. Does it specialize in it?
- kakwa_ 8y ago
  If you are touching sensitive systems, like military infrastructure, nuclear power plant, law enforcement, banks, it's not uncommon at all. In some cases, mostly governmental stuff, you can be personally liable if you misplace accidentally documents or other sensitive pieces of information (like a spending a few years in prison).

syshum 8y ago

Given this is from 2010 perhaps people should look at current practices before freaking out. Almost all modern copiers employ some kind of Disk Encryption so this issue has largely been resolved. http://siica.sharpusa.com/Document-Systems/Security http://siica.sharpusa.com/Document-Systems/Security