Cybersecurity Threat: The West Sends Old Servers to Foreign Countries

Western countries have been criticised for their routine habit of disposing old servers, filled to the brim with sensitive information, in foreign countries, opening up the opportunity to hackers to test their skills in extracting private information and holding it for ransom.
Often it is the case that the old servers are being replaced with newer hardware equipment and workstations, and being sold to private companies in distant locations without completely removing confidential and sensitive data that have the potential to identify individuals and impair government systems.
Alas, this unguarded data is a hacker’s jackpot.

An anonymous source has shed light on this; the owner and manager of an IT refurbishment company in Romania, which buys old equipment from countries like Spain and the UK to resell to customers who do not require top-spec technologies, has brought to surface the cybersecurity vulnerabilities of the procedure as a result.

According to him, the equipment is “stuff that is past its prime or out of warranty, but is still perfectly useable. The procedure is simple: hardware comes in, gets evaluated, fixed, wiped and sold.” The issue, however, is with incoming equipment labelled as clean, when in fact the data has not been fully wiped.
In the last three years, the source claims to have seen the codes, software and procedures for a number of Spanish cities’ traffic lights and railway systems, credit card information of users of a prominent UK supermarket chain, and the full employment database of a European aerospace manufacturing company.
“Right now, I’m looking at [a French power company’s] sensor listing, their IP’s and access data,” the source said. “Obviously, I’m sanitising everything before passing it on, but it never should have gotten into my hands in the first place.”

The source may be anonymous, but Nir Giller and Andrew Tonschev, CTO of CyberX and director of technology at Darktrace respectively, have confirmed the information, saying the scenarios are not uncommon. The issue primarily lies with the organisation sending away its equipment to distributors like the one in Romania. More often than not, they appear to be in denial and disbelief that their security is so poor, and that critical data left the confines of the company to outside hands.

Fundamentally, the problem is with the way in which data ought to be discarded and destroyed. Large organisations tend to lease server space from specialists who retain the responsibility of destroying information once contracts are over. But when technologies get upgraded en masse, the specialists skip steps and forget to wipe the servers, sending them away with the original data intact. It is at this point that businesses become vulnerable to cybersecurity threats.
The source concluded: “The West is failing at an institutional level to keep their critical data safe. No need for CSI-worthy hacking stories, just a credit card to up your used hardware – odds are the data will still be there, even if someone marked them as already wiped.”