The Latest Sophos News
Product and Solution Information, Press Releases, Announcements

Sydney, Australia – December 7, 2011 – Sophos conducted an analysis of 50 USB keys bought at RailCorp's 2011 Lost Property auction in Sydney.

Unsurprisingly, USB keys are lost on RailCorp trains quite literally by the bucket-load. With a current retail price in Sydney of less than $7 for a 4GB device, replacing a USB key costs less than a pint of beer.

But what about the cost of losing a USB key's worth of data? Just as interestingly, what about the potential cost of finding a lost or discarded key?

Sophos attended this year's RailCorp lost property auction and bought up a collection of pre-owned USB sticks, studying 50 USB keys. The study revealed that two-thirds were infected by malware, and quickly uncovered information about many of the former owners of the devices, their family, friends and colleagues.

Disturbingly, none of the owners had used any sort of encryption to secure their files against loss.

Sophos identified 4443 directly accessible files on the 50 devices including 2882 images, 629 source code files, 197 web files, 145 documents, 128 programs and 23 videos.

Paul Ducklin, Head of Technology, Asia Pacific at computer security company Sophos, says that with the silly season well and truly in full swing, revellers shouldn't be lulled into a false sense of security that the personal data on any device is unimportant.

"This study serves as a timely reminder that any information about you is worth money to cybercriminals, no matter who you are," Ducklin warns.

"And don't forget the crooks don't need to be directly involved in identity theft themselves - there's an underground market for selling on personally identifiable information of all sorts."

The files included:

• Lists of tax deductions.
• Minutes of an activists' meeting.
• School and University assignments.
• AutoCAD drawings of work projects.
• Photo albums of family and friends.
• A CV and job application.
• Software and web source code.