Security
Brief items
Cleaning up your disks
Simson Garfinkel has written another story on the interesting things he has found on used disk drives; this one appears in CSO magazine. He looked at some 150 drives, and found that only 10% of them had been sanitized.
In general, one need not think to long before realizing that letting an unsanitized disk out of your possession is not a particularly good idea. One might well wonder, however, what the best method is for cleaning up a disk. There are a few different options available. Note that running fdisk or mkfs is not an option, however; those utilities leave most of the information on the disk intact.
The safest way, perhaps, is to encrypt the contents of your disks from the beginning. Such disks should be safe even if they leave your possession in an unexpected, undesired way. Most Linux distributions do not come with easy disk encryption options now, but that is likely to change within the next year or so. The inclusion of the crypto-API code in the 2.6 kernel, combined with the block encryption capabilities being patched into the device mapper code, should make this capability widely available.
The GNU shred utility is part of the "coreutils" package. It can be used to overwrite the contents of a single file or an entire device. The single file mode can be tripped up by things like journaling filesystems and should not be relied upon for too much security. When shred is applied to an entire block device, however, it should be effective.
Lacking a tool like shred, one could always overwrite a device with a command like:
dd if=/dev/urandom of=/dev/disk-to-wipe
The truly paranoid among us will want to run that command more than once.
Another option is the standalone disk wiper, which boots from a diskette or CD to do its cleanup work. This sort of utility is useful when an entire computer is being surplussed, and the person doing the cleanup does not, necessarily, know how to log into and clean the system. Besides, wiping the root disk on a running system can be a difficult operation to complete. A couple of offerings in this area are autoclave and Secure Harddisk Eraser. Both of these are compact Linux systems which boot in a standalone mode and trash the disk. Autoclave goes to some lengths to ensure that the user knows what is about to happen; Secure Harddisk Eraser, instead, simply waits a minute and goes to work.
The final option is the physical destruction of the disk drive. Modern drives can be surprisingly hard to destroy, however.
The one course which is not an option is getting rid of drives without cleaning them up first. It has become clear to a lot of people that used drives can be gold mines of information which should not be disclosed. If you throw away a loaded disk, chances are good that somebody else will go digging through it.
New vulnerabilities
ecartis: several vulnerabilities
| Package(s): | ecartis | CVE #(s): | CAN-2003-0781 CAN-2003-0782 | ||||
| Created: | March 24, 2004 | Updated: | March 24, 2004 | ||||
| Description: | The ecartis mailing list manager (version 1.0) suffers from an input validation vulnerability which can result in the disclosure of list passwords. Ecartis also has several buffer overflow vulnerabilities. See this advisory for more information. | ||||||
| Alerts: |
| ||||||
httpd - vulnerabilities fixed in Apache HTTP Server v2.0.49
| Package(s): | httpd | CVE #(s): | CAN-2004-0174 CAN-2003-0020 CAN-2004-0113 | ||||
| Created: | March 23, 2004 | Updated: | March 30, 2004 | ||||
| Description: | The Apache Software Foundation and the Apache HTTP Server Project have announced the release of version 2.0.49 of the Apache HTTP Server ("Apache"). More on the vulnerabilities fixed in this release can be found in this announcement. | ||||||
| Alerts: |
| ||||||
Resources
Rootkit Hunter 1.0.0
Rootkit Hunter 1.0.0 has been released; this package will scan a system for signs of compromise. The release contains a long list of "supported" malware that Rootkit Hunter can detect; that list does not include the Adore rootkit discussed here last week, however.
Page editor: Jonathan Corbet
Next page:
Kernel development>>