Feeds

Oz rail company sold USB keys from lost property in auction

All your brollies, data sticks and lost scarves are belong to us...

Beginner's guide to SSL certificates

Someone in RailCorp will be nursing a bruised ego after selling a pile of USB keys lost on trains in the authority’s regular lost property auction.

It may have never raised an eyebrow, except that the keys were bought by the keen-eyed Paul Ducklin of Sophos. What Ducklin thought of as a good source of research into user habits has consequently turned into a shouting match over privacy.

Certainly Ducklin’s research into the keys he picked up at the auction reveals a nation of overconfident users. Extracting the metadata from the keys – he emphasised, both in this blog post and on the telephone to The Register that nobody at Sophos viewed any private data – he discovered that none of the keys were encrypted (or had any kind of access control enabled), and two-thirds were infected with malware.

The pervasive problem of USB data leakage also popped up, with CAD files, meeting minutes, tax deductions and the like turning up on the keys.

On its own, that would have made a story, but the second story – the bruiser for RailCorp – was that the rail authority made no attempt to wipe the keys before selling them. This is at odds with the policies that dictate that more sensitive devices like PCs and mobile phones are wiped before sale.

According to SC Magazine, this brought a slap from the NSW privacy regulator, which stated that RailCorp “should be cleaning these USBs” before sale.

The Register was also moved to wonder whether someone’s lost USB stick might not be still protected by laws protecting private data against unauthorised access.

While not a lawyer, the point hadn’t escaped Ducklin. He emphasised that in analysing the keys, Sophos didn’t open any private user files – rather, it created a script to scrape out information like filenames, and made its inferences from the filenames.

Also, under the legislation covering railway lost property, unclaimed objects eventually become the property of RailCorp. Since it, as the owner of the devices, on-sold them to Sophos, this should cover the “authorisation” question: by the time it analysed the USBs, Sophos was the owner. ®

Beginner's guide to SSL certificates

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Shellshock over SMTP attacks mean you can now ignore your email
'But boss, the Internet Storm Centre says it's dangerous for me to reply to you'
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
NOT OK GOOGLE: Android images can conceal code
It's been fixed, but hordes won't have applied the upgrade
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
How to simplify SSL certificate management
Simple steps to take control of SSL certificates across the enterprise, and recommendations centralizing certificate management throughout their lifecycle.