Researchers examine threat of used PCs

Internal Auditor, April, 2005 by D. Salierno

SECOND-HAND PERSONAL computers (PCs) may be providing fraudsters access to sensitive company information, according to a recent study. Researchers at the University of Glamorgan's School of Computing in the United Kingdom analyzed nearly 100 PCs bought through Internet auction site eBay and discovered that more than half contained data from organizations, including multinational corporations and universities.

[ILLUSTRATION OMITTED]

The researchers, who had no prior knowledge of where the computers were bought or what they contained, were able to identify a specific organization on 57 percent of the PCs examined. Twenty percent of the machines contained company financial information, such as sales receipts and profit and loss reports. Nearly 10 percent had information about the organization's computer network, including server names. Other items found included staff records, passwords, internal e-mails, and a document template for university degree certificates. Companies identified ranged from a large leisure services organization and a financial company to a surveyor, a primary school, and several universities.

Nearly half the machines' previous users had made either a failed or partly successful attempt to delete files from their hard drives, but only 17 percent of all disks examined were completely blank. At least seven of the computers provided enough information for a hacker to bypass security completely and gain access to the former owner's systems. A control group of drives, which were sourced from a company specializing in data destruction, was also used in the research--all had been wiped and were found clean.

The School of Computing regularly undertakes research on behalf of police and high-tech crime units. The researchers have an established record in network security and data crime analysis.