Confidential Home Office data turns up in laptop on eBay Yet more confidential UK government files may have been mislaid by public servants. However, in a sign that Whitehall may be raising its game slightly, this time the data was encrypted - and the copies originally lost have been recovered. The Guardian reports today that a small IT-repair firm near Bolton received a laptop on …
"We put the disk in the drive to see what it was, but it was encrypted."
"As soon as I saw it belonged to the Home Office I placed it in the company safe and called the police."
If he put in the company safe "as soon as I saw it belonged to the Home Office", how did he manage to put it in the disk drive...?
Or more likely "wow, I can be famous... aww crap. Suppose I better be seen to do the right thing"
I guess they must, because as soon as the disc, labelled "Home Office Confidential" was seen to belong to the Home Office, they locked it in the company safe, and also put the disc in the drive to see what it was...
BTW, probably best not to buy a laptop on eBay if it needs repairing straight after
"However, in certain unusual circumstances a savvy attacker can lift the keys from computer memory. "
Presumably the article is referring to the recent work at Princeton. This attack is simply infeasible in this instance. The main memory of the laptop would have faded and thus the key would not have been recoverable. Furthermore, since the data has held on floppy disk there is nothing to suggest that the floppy disk's encryption key would have ever resided in the laptop's main memory (this relies upon the assumption that at some stage the disk had been used in that laptop, moreover, it must have been used recently)
What user stores a CD UNDER the keyboard? Ho many screws had to be removed to take out the keyboard? This sounds fishy. Possibly an attempt by the HO to demonstrate that they have cleaned up their act re: data security? What better way than to flog a lappy on eBay with a hidden prize. Like a box of cereal.
.. it could be a wind-up! Lets face it - who in the Home Office would have the knowledge to hide a disk UNDER the keyboard. I can believe a forgotten disc in the drive but.....
When they decrypt it it'll probably be the complete "Third Policeman" by Flann O'Brien!
I suspect there'll be thousands of "Property of Home Office - Confidential" disks appearing from everywhere in the coming months.
In fact, it'd be a good line in CD labels.... for those of an entrepreneurial bent.
♠
I assume that the disc label was all official looking and didn't just have 'Home Office' scrawled on it in permanent marker (with smudged finger prints, coffee stains etc)?
Cos shurely you could fill a CD with random bytes and then scrawl 'MS Windows 2010 source code' couldn't you? And the 'real owner' as such would be out of their mind to risk the possibility that the disc was in fact legitimate rather than a fake.
No, really.
There's a bunch of kerfuffle about the home office losing data.
Then a mysteriously "encrypted" cd turns up from eBay with the words Home Office and Confidential on it.
What's the bet that someone created a CD sized bunch of random data, encrypted it, put it on eBay, then started counting down how long it takes for people to figure out (if ever)?
Half of the point of encryption is that people wouldn't be able to tell if there really is data in there. ;->
So the government lost a laptop, it happens. They had taken all the right steps to make sure that all that was lost was a bit of kit, and no sensitive data made available. Your weasely attempts to suggest that the data could still have been copied are pathetic.
When they do something wrong, go ahead and kick them. When they do it right, report that or at the very least shut up.
HMG typically uses "Restricted", "Confidential", "Secret" and "Top Secret" as its labelling scheme. Stuff properly marked Confidential shouldn't be taken out of a Government office, regardless of whether encrypted or not and regardless of whether on paper, cd or a laptop. So someone is for the chop if this is true. More likely a prank though.
Looks like eBay is now being used for Dead-Drops...
Good thing that the [Chinese | Ruskies | Terrrrreeeerrrrreeessstttss | Cubans | French] were out bid this time... next time we may not be so lucky...
(shame there isn't an icon of Paris Hilton riding a Black Helicopter with her coat ...)
... guess what I found under the keyboard of this laptop I bought off a dodgy-looking bloke in a pub? A neatly-folded inflatable girlfriend and a tube of KY both labelled "Property of David Blunkett, The Home Office, Queen Anne's Gate, London SW1"
And a couple of Bonio biscuits.
I have a CD on my desk which is marked as property of the Home Office. When I put it in my drive, it comes up blank. Obviously, this is the work of a form of unbreakable encryption which requires access to the entire set of data to use as a decryption key.
Ingenious.
This message was encrypted with dual rounds of ROT13 for your protection.
Paris, for your protection.
This post has been deleted by its author
"This reminds me of the stories in the 80's and 90's of users 'missing' the floppy or cd drive slot and a service engineer finding a neat little pile of disks inside the machine.
A very slim chance, but maybe that's what happened here?"
Yes. How about the CD wasn't properly seated in the CD drive and the CD got pushed under the keyboard.
I've just taken a look at a Dell laptop and you'd need a bent or loose case, but it looks possible.
So, some sausage fingers in the HO looses a CD inside the laptop and fails to own up and send the laptop for repair to get the CD out. Or they'd been stiffed with a money grabbing support contract and a repair would cost more than a new laptop. "It costs too much to get the CD out - just make another".
It looks like another example of not following the rules about documents with protective marking. Okay, the data was encrypted. But the CD was still marked confidential and should have been handled accordingly.
"under the keyboard"
My old Toshiba has a pop-up plastic strip near the hinge; pop it up and the keyboard comes out on a little ribbon cable. It's easy, and there's probably enough space there for some cash - thanks to the previous commentator for that wheeze - but a CD wouldn't fit, there are sticky-out prongs that keep the keyboard aligned.
It seems odd to hide something from theft by putting it in a laptop. That would be like hiding valuable sweets by grinding them into powder and sprinkling them into a mobile phone; clever on the surface, but the phone is likely to get nicked, taking the sweets with it. As seems to have happened in this case.
Furthermore, phones are typically nicked by exactly the kind of person who loves sweets.
Actually, hiding a confidential disk under the keyboard of a laptop would be a really good way of getting it off site. At the guard house you solemnly present the laptop and the associated paperwork that lets you take it out, and the guard searches the bag, finds no CDs and lets you out. Then, before you can sell the juicy data to your buyer, you lose the laptop on the train, and some light-fingered git flogs it on ebay.
The laptop should be traceable from its serial number, back to the HO unit that lost it, if it's an HO machine. Maybe it belonged to a bent contractor? What, wait! Surely there's no such thing.
"However, in certain unusual circumstances a savvy attacker can lift the keys from computer memory."
Yes, and those circumstances were absent here. You have to find the computer while it's *actually performing a decryption* (so the keys will actually be in memory -- they get zeroed out as soon as you quit the decryption program), and quickly reboot it. And even then, you're relying on the bit of memory where the keys were stored not getting overwritten during the startup process.
So what we had was a disc of encrypted data and no key. In other words, everything done right. No story.
Anyway, anything that says on it "HOME OFFICE - CONFIDENTIAL" is so obviously a fake, whoever called the Old Bill wants charging with Wasting Police Time.
..If the Reg is still in the business of reporting news or looking for a good reason to slander an unliked agency/corporation.
Everyone who reads now knows you can recover encryption keys from RAM, why try to hold it against the gov that their encrypted drive could be subject to this. And what kind of speculation is that they 'could have written they keys down'...
Come on guys. At least it *was* encrypted this time.
Of course -you realise they sold it cos they dropped the thing, hence the CD slipping out of the tray into the machine.
This demonstrates an extremely poor build and I myself have pulled a disc from an end-users machine guts.
Makes a nice 'nails on chalkboard' numbing screech.
"The possibility also exists of the encrypted government files having been copied, which is much easier than decrypting them - although not as trivially easy as copying normal unprotected files."
Have you ever actually used a computer? This sentence is garbage. A file is a file and copying it is exactly as easy regardless of whether it's a file full of plain text or encrypted gibberish. How on earth did you manage to type this without stopping short and saying "Hang on a minute, I'm talking complete bollocks"? You really ought to read back your text sometime in between writing it and posting it on the site, because there's really no excuse for this kind of pathetic blooper.
When you start asking the right questions on this story and the others in the 'data loss' debacle in which are our 'responsible' government leaders are involved in then nothing stands up to scrutiny. WTF is going on? Why aren't the media showing that this is all nonsense, like 'it's too expensive to create a subset of data from a rdbms so we sent the whole db', who would have that sort of access anyway?
Why hide a cd in a laptop? April 1st gets earlier every year . . .
Come on you guys, get real. Who's doing what to whom here?
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
