3 ms·

I’m having a little trouble following since I don’t speak French, but based on other comments here, it sounds like: 1. French YouTuber Micode bought a used SSD

I’m having a little trouble following since I don’t speak French, but based on other comments here, it sounds like: 1. French YouTuber Micode bought a used SSD from leboncoin. 2. Micode wanted to demonstrate that data should always be properly wiped from used drives. 3. The SSD Micode obtained had been quick-formatted and was never encrypted, so it was trivial to recover the data on it. 4. Micode asked his followers on Twitter to try to identify the source of the drive. 5. It was eventually identified as belonging to Scaleway, and it contained important data from a Scaleway customer’s VM, including an SSH key, source code, and an S3 secret. 6. Scaleway threatened Micode, who now claims to have wiped the data. 7. Scaleway published a blog post claiming the drive was stolen while being transported between datacenters. Unless I’m missing something that was lost in translation, I call bullshit on #7. They also seem to be claiming customers were notified immediately, but it that doesn’t appear to be the case. This just seems like they sold an old drive that should’ve been encrypted (it wasn’t) and wiped (it wasn’t). Whether that sale was authorized is a matter of debate—one former employee said they wouldn’t be surprised if someone just decided to walk out of the building with decommissioned hardware.

sofixa 5y ago
> This just seems like they sold an old drive that should’ve been encrypted (it wasn’t) and wiped (it wasn’t I find that unlikely ( unless as you said it was a rogue employee) - they're certified HDS ( hosting healthcare data) so i find it improbable they aren't supposed to have a special disk decommissioning process to follow, including secure wiping.
- orwin 5y ago
  Yeah, our procedure for decommissioned SSD and HDD (imposed to us by HDS requirement) where 3-pass shred on the disk (logical wiping), and either pierce the HDD or microwave the SSD, with photographic proof send to our client if asked. The 3-pass shred was done on the virtual disk each time a client left, and was done on the physical during maintenance. [edit] And concerning encryption, it was at a premium, and i think only one of our client asked for it (this had a few issue). "hot" logs where not encrypted, but during the logrotation we tried to implement this (this was not technically audited btw, i think it was OK for Deloitte not to see our code)
MisterTea 5y ago
> one former employee said they wouldn’t be surprised if someone just decided to walk out of the building with decommissioned hardware. Who here hasn't taken decommissioned or unneeded work computer crap home? At work I recently replaced four 2.5" WD black 500GB spinning rust disks in Dell mini computers with m.2 SSDs. Since we are moving all of our systems to SSDs the WDs were trash but perfectly working with only a few months of time on them. I took the disks home and used them to play with FreeBSD and NetBSD on my Lenovo laptop. I didn't wipe them before taking them home either...

sofixa 5y ago

> This just seems like they sold an old drive that should’ve been encrypted (it wasn’t) and wiped (it wasn’t I find that unlikely ( unless as you said it was a rogue employee) - they're certified HDS ( hosting healthcare data) so i find it improbable they aren't supposed to have a special disk decommissioning process to follow, including secure wiping.

orwin 5y ago
Yeah, our procedure for decommissioned SSD and HDD (imposed to us by HDS requirement) where 3-pass shred on the disk (logical wiping), and either pierce the HDD or microwave the SSD, with photographic proof send to our client if asked. The 3-pass shred was done on the virtual disk each time a client left, and was done on the physical during maintenance. [edit] And concerning encryption, it was at a premium, and i think only one of our client asked for it (this had a few issue). "hot" logs where not encrypted, but during the logrotation we tried to implement this (this was not technically audited btw, i think it was OK for Deloitte not to see our code)

MisterTea 5y ago

> one former employee said they wouldn’t be surprised if someone just decided to walk out of the building with decommissioned hardware. Who here hasn't taken decommissioned or unneeded work computer crap home? At work I recently replaced four 2.5" WD black 500GB spinning rust disks in Dell mini computers with m.2 SSDs. Since we are moving all of our systems to SSDs the WDs were trash but perfectly working with only a few months of time on them. I took the disks home and used them to play with FreeBSD and NetBSD on my Lenovo laptop. I didn't wipe them before taking them home either...