Hacker News Reader

Comment by estimator7292 | Hacker News Reader

DO NOT assume SMART is reliable. You can wipe SMART stats or write any values you want.

You have to actually examine the real bits on the drive. Resellers don't want to take the time to actually zero a drive, they usually just nuke the partition table.

You also need to physically examine the drive. Corroded fingerprints on the PCB, wear on the port contacts, scratches from mounting rails, etc.

That's how it found out that the last "new" drive I bought on Amazon was actually a used Backblaze drive. It contained terabytes of customer data, and a shit ton of cleartext files. SMART, of course, reported it was a brand new drive with zero hours. Cleartext logs on the drive showed many thousands of hours of runtime.

Physical examination is the only reliable method.

View on HN

> That's how it found out that the last "new" drive I bought on Amazon was actually a used Backblaze drive. It contained terabytes of customer data, and a shit ton of cleartext files. SMART, of course, reported it was a brand new drive with zero hours. Cleartext logs on the drive showed many thousands of hours of runtime.

This sounds like it could be a big problem for Backblaze customers, and consequently for Backblaze.

Can you alert the Backblaze CEO about their insufficiently-decommissioned drives leaking out like this?

Backblaze customers also need to know, but I would give Backblaze the first shot at figuring out how to notify, whom, of what.

Backblaze erasure-codes customer data across 17 (I think) servers, so customer data is probably not accessible. Yes, it would be better if they zeroed the drive, but Google says that will take 14-30 hours for a 10TB drive.

For drives that implement an internal encryption key, it's faster (instantaneous) to reset the encryption key. It won't give you a zeroed drive, but one filled with garbage.

The earlier description is ambiguous (i.e., is it data of or about customers, and is that data cleartext), but it seems they believe they have a drive from Backblaze with a lot of cleartext files on it, and something involving customers.

> It contained terabytes of customer data, and a shit ton of cleartext files.

In many erasure coding systems, the first X sets of code are simply cleartext chunks.

This is also more efficient in the happy path since then no computation is needed to decode the data. It can be DMA'd straight from the drive to the network adapter with super low CPU utilisation even for Gbps of network traffic.

>Can you alert the Backblaze CEO about their insufficiently-decommissioned drives leaking out like this?

One has to wonder how many times you can deliberately fein incompetence until it's clear it's on purpose.

https://www.bleepingcomputer.com/news/security/backblaze-mis...

Yev from Backblaze here -> That sounds very strange. I've asked our ops team and they said if you can provide the serial number of the drive you have we can track it. Would you be able to write in a support ticket w/ the serial number of the drive you bought so I can personally flag it and investigate? Once done you can write the ticket # here and I'll follow up with the team -> https://help.backblaze.com/hc/en-us/requests/new.

> drive I bought on Amazon was actually a used Backblaze drive

Assuming this is true, I find it weird/surprising that Backblaze doesn't at least zero their drives before disposing of them? I have to do that at my work, and at least by policy I could lose my job if I skipped doing it.

But you don’t work at backblaze :)

I find it more weird that they don't use encrypted storage, then you don't nee to bother with zeroing drives. You only need to 'forget' the key.

I find it weird they are allowed to do anything but destroy end-of-life HDDs

If our legal team finds out about this, we are never going to be allowed to use Backblaze lol.

Seems like the only responsible thing to do is tell them and then stop using Backblaze. Seems to me they can't be trusted.

I work in the refurb division of an ewaste recycling company. I'm pretty sure I would be fired if I didn't wipe a drive before selling it, too. We got certifications that we NEED to keep in order to keep doing business.

Backblaze should get ironclad guarantees that decomissioned drives have been destroyed, besides that their storage system should not be storing anything in plaintext at all.

This seems like it would create a lot of e-waste, as long as the data is guaranteed unrecoverable in entirety or in part it should be okay no?

> actually a used Backblaze drive

Unless you're super, duper sure this is true ... you might want to post your evidence, rather than your conclusion. Any misinformation these days gets amplified even faster and bigger than it did just 1-3 years ago, especially via ChatGPT and Gemini.

I don't understand any scenario where a NAS drive would have a normal filesystem with plainly readable files. Not because of security (as many would expect) but because drives used in arrays are striped and intended for parallel use. They do not contain complete individual files. I know this because when you lose more than 2 drives in, e.g. a RAID 5, you lose everything.

Equally unlikely is why a storage provider would use anything OTHER than an array for any of their drives. Again, tossing security aside, it is not a viable way to store data on one filesystem. That drive could die at any time and lose all the data. So it makes no sense to store it that way.

> You have to actually examine the real bits on the drive.

What is the best utility for doing this?

Shop around digital forensics tools

Reply on news.ycombinator.com