More than half (56%) of corporate network devices sold second-hand still contain sensitive company data, according to a new study by ESET.
A security vendor purchased 16 recycled device routers, 9 of which had one or more IPsec or VPN credentials, or a hashed root password, and enough information to identify the previous owner. was found to contain
ESET argues that this information could theoretically allow a threat actor who got hold of the device to gain network access to the organization that recycled the router.
Some of the routers analyzed also included:
- customer data
- Credentials for connecting to other networks as a trusted party
- Connection details for a specific application
- Router-to-router authentication key
More specifically, researchers found a complete map of the major local and cloud-based application platforms used by organizations that previously owned routers. These ranged from corporate e-mail to physical building security and business applications.
ESET researchers were able to determine which ports and hosts these apps were communicating with, and could theoretically have investigated known vulnerabilities, the vendor claims.
In some cases, we were also able to map the network topology, including remote offices and operator locations.
The net result of this failure to properly decommission was to expose many of these companies, their customers, and partners to high cyber risk.
Routers were originally owned by midsize and global organizations operating across multiple verticals, including data center providers, law firms, technology vendors, manufacturers, creative companies and software developers.
Some treated the event as a serious data breach, while others appeared to fail to respond to repeated attempts by ESET to notify them.
Study leader Cameron Camp said the findings should serve as a wake-up call, whether companies dispose of devices themselves or contract with e-waste companies.
“We would expect medium to large enterprises to have a stringent set of security initiatives to decommission their devices, but we found the opposite,” he added.
“Organizations were more aware of what was left of the devices they grazed because most of the devices they obtained from the secondary market contained the digital blueprints of the companies involved, including but not limited to core networking. information, application data, corporate credentials, and information about partners, vendors, and customers.”
