What is the likelihood of getting sensitive information off of a backup tape?

Question

For purpose of the quesition, I am going to paint a picture:

A system administrator maintains and backs up a production server for clients with sensitive financial information (account numbers, names, SSNs, etc). The machine is a Windows 2003 R2 64-bit Itanium server with Backup Exec 13d as the backup solution. The backup rotation is a full backup on a 3 week rotation unencrypted using LTO3. One tape a week is transported to another location for disaster recovery purposes.

The concern:

What if the tape gets lost in transit?

Aside from the PR issues with the clients having to disclose that their information has been displaced, what is the actual likelihood that useable information for the purpose of identity fraud could be abstracted? I paint the picture above because from the point of view of the finder of the tape there are a lot of unknowns (aside from the label of what day the tape is backed up on). This backup could have been from an *nix system using bacula on an IBM Power System for all they know. The only thing they have for sure is the type of tape from the labeling. Aside from that, where would somebody with malicious intent start?

Answer 1

Yes, it is very easy to retrieve data if you have the tape. The only challenge with older tapes is ensuring you have an appropriate reader. Once you have the reader you can easily work out what operating system and backup application write to the tape.

You must treat backups the same way you treat live data. If it is sensitive, use controls such as encryption.

From an attacker's viewpoint backups are often a soft target.

Answer 2

Well depending it would be quite easy to start looking for stuff if you know what you are doing.

I'd make a binary copy of the tape on hard drive (for random access it would be faster).

I'd then use some forensic tools to go look for keywords like password, confidential, credit card, email address and guard the offset on the hard drive. Have a look at my answer here.

After you have found those keywords I can see if it's anything interesting. If there are emails on the system I can look for internal communication about business processes and find confidential stuff or private data.

Also more concerning would be if the disk contains private SSL keys, as you could after scanning for RSA keys, use these keys to do man in the middle attacks and sniff passwords, credit card numbers etc... to obtain even more info (if they don't change their keys).

You could extend and look for extensions and compare it with their magic number. If a file has magic number that's off with its file extension you know something fishy/interesting is there. Maybe a secret book keeping ?

So suggest you want to do identity fraud, you could obtain from this backup:

• Credit card number
• Address
• Phone numbers
• Info about family
• ...

As you see I might get a lot of data. You can extract it if it's there. Best thing to do is encrypt everything, it would render it useless to an attacker. (normally)

Answer 3

If you have the correct reader the data an unencrypted tape is no different than browsing an unknown hdd. All you have to do is restore all data from the tape to a disk and go to work picking through it.

Figuring out what created the backup will be a challenge. I would think if someone was completely intent on getting the data, sending it off to a professional data recovery company would be where to start. they would have access to just about any tape drive that has been popular in the last decade. They will have the knowledge and expertise to figure out what created the backup and restore it. All for a price of course.

This would be a treasure trove for anyone with malicious intent. A good rule of thumb is to think of any data containing device that leaves the 4 walls of your building the same way you would a laptop with with the same level of sensitive data. Regardless of the transportation medium (laptop hdd, tape, desktop hdd, flash drive, cd/dvd, etc) if its lost it should be considered a potential threat to system security.

So to directly answer your initial question. If the person who comes upon your data has access to the correct equipment (Directly or Indirectly) it is very likely they could extract the data and figure out where it came from. That being said, the chances of the individual who ultimately comes into possession of the lost tape is not very likely to have the resources to do so. I would imagine very few people who came upon said tape would know what to do with it never mind spend any significant time trying to find out. 90% of the non IT population would not even know what it is to start with. Regardless, ALL data leaving the building needs to be secured with the appropriate level of security for the data contained.