Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Dumpster Diving
During Microsoft's landmark antitrust trial, fellow software giant Oracle hired detectives to attempt to purchase Microsoft's trash. Though this may not seem a sanitary activity, it can potentially offer an amazing wealth of information.
Print It Out
Almost every office with a common printer prints separator sheets with a user's name and the filename of the printed document. A healthy percentage of these sheets wind up in the trash, allowing the brave trash diver to identify at least a partial user list and a list of documents associated with those users. Since people generally give descriptive names to their files, this can also offer many suggestive hints as to what projects company employees may be working on. Additionally, it may offer the format of the usernames. This format along with a company directory could give the hacker a sample user list for the target network.
Further, as employees work on documents, they often print multiple copies to proofread and make changes. This iterative cycle may yield several printed versions that don't reach the paper shredder and instead are left in the normal trash. These older versions can still contain a great deal of sensitive information. This is especially true if the final revision was merely for running the spell checker.
Stick with Me
Sticky notes (in yellow and other colors) stand out just as well in trash as they do on a crowded desk. On such slips of paper are scribbled names, telephone numbers, and addresses; gift ideas for special occasions; notes from meetings and telephone conversations; and often various user passwords. Valid usernames and passwords to printers, remote servers, file shares, guest accounts, and so on frequently are clearly and neatly written on sticky notes and thrown away when either memorized or no longer needed. However, the accounts and access privileges may well still be valid.
Going Through the Trash
A bit of advice for the dumpster diver here: We strongly recommend using caution when going through the trash. Trash can contain sharp objects, caustic chemicals, rotten food, and other unhealthy and potentially dangerous items. If you're going dumpster diving, wear proper protective equipment; latex surgical gloves underneath thick, heavy-duty work gloves are recommended. However, even these two layers of protection may not be enough to guard against a hypodermic needle. Use caution. If the organization recycles office paper, you'll often find the most useful information there and can avoid the unsanitary conditions of general trash. As for where to dump the trash, please don't dump the contents of the trash receptacle onto your own or a colleague's desktop. Instead, spread a sheet of plastic on a flat surface, dump the trash on the plastic slowly, conduct your examination, and when finished wrap up the plastic and discard it again. Going through the trash can be done on a user-by-user basis by collecting individual trash receptacles or on a far larger scale by attacking dumpsters and recycle bins that serve entire divisions or even whole companies.