2024 Training Schedule Available

Are You Being Vigilant Against a Dumpster Diving Attack?

Are You Being Vigilant Against a Dumpster Diving Attack?

Share This Post

When one thinks of Open Source Intelligence (OSINT), things like Facebook, court records, and Google-fu typically come to mind.  However, a skilled reconnoiter will also utilize the contents of your trash when looking for information.  Fraudsters can use the information found in a dumpster to find vendor lists, quotes, customer information, and other proprietary secrets of a business.  If they are searching the trash from your house, they may be able to find out banking information, insurance policies, and other Personally Identifiable Information (PII) on you and your family.  Whether it’s business or personal, the information found can be used to mount a vishing or phishing attack against you, used to steal your identity, or as corporate espionage to gain a competitive advantage.  

Are You Being Vigilant Against a Dumpster Diving Attack?Legalities of dumpster diving

Different cities and states have varying laws on anyone being able to peruse through garbage; however, it’s generally not considered a crime in most places. Currently, the U.S. Supreme Court has deemed that things thrown in a curbside receptacle are considered “abandoned” and are up for grabs by the public and police without a warrant.  

Protecting your corporate secrets

It’s important to protect your proprietary secrets and customer PII from exposure to a third-party.  Part of a corporation’s security policy should have terms in place for dealing with the proper disposal of sensitive information and media. Cross-cut shredders should always be used, and it may be helpful to have several throughout the facility for easy access.  If this isn’t possible, there are companies that will come to your office and shred the documents for a fee.  If this is the route chosen, make sure employees have secure/locked bins for them to dispose of materials in the interim.  For media such as CDs, hard drives, and thumb drives; employees should turn these into the I.T. department for physical destruction of the media.  Regular checks should be done to ensure employees are disposing of things properly.  Sadly, it is all too common that corporations are found dumping whole records like medical files, nuclear secrets, and payroll information in their dumpsters.  These kinds of exposures can lead to fines, lawsuits, and violations of laws such as HIPAA and PCI compliance.  

Protecting yourself at home

At home, you should shred all bills, credit card offers, insurance information, and anything containing sensitive data/PII.  (Don’t forget the shipping labels from delivered packages.Make sure to invest in a good cross-cut shredder, you can even get one for $30 on Amazon that will shred credit cards too.  Many of the newer credit cards are made of metal and your standard home shredder won’t be tough enough to destroy them.  While you can use the pre-paid envelope to return these for destruction by the issuer, it can be a risky move.  If that mail gets lost or stolen, a criminal can easily use the information to vish as you get access to your current account.  The best way is to use a torch or place it in a fire to melt off any of the PII on the card, then disposing of it once it is cooled down.  

Stay safe if you’re doing the diving

If you’re in a situation where you are doing a security assessment or penetration test, make sure to check out the available rubbish that employees are throwing out.  Always wear sturdy leather boots, jeans, long-sleeve shirts, and use heavy leather gloves.  This will help you to avoid being injured by anything sharp and dangerous that may be lurking among the other treasures.  Happy hunting!

Sources:
https://www.amazon.com/AmazonBasics-6-Sheet-Cross-Cut-Credit-Shredder/dp/B00HFJWKWK/ 
https://en.wikipedia.org/wiki/California_v._Greenwood 
https://www.publicintegrity.org/2016/02/03/19243/workers-threw-out-us-nuclear-secrets-common-rubbish-20-years 
https://www.kitv.com/story/36705195/medical-records-found-in-trash-bins-in-palolo 
https://www.findlaw.com/injury/torts-and-personal-injuries/dumpster-diving.html

More To Explore

AI assisted social engineering attacks
Social Engineering

AI Assisted Social Engineering Attacks 

Social engineering attacks have become more complex with the integration of artificial intelligence. Malicious actors are leveraging AI, resulting in social engineering attacks that are increasingly cunning and difficult to

The Psychology Behind Social Engineering
Psychological principles

The Psychology Behind Social Engineering 

Cyber security isn’t just about computer systems and networks, the people who use these technologies also play an important role. Most ransomware attacks begin with the human factor – social