Ask HN: Is Dumpster Diving still a thing? What are some modern resources?
Dumpster Diving used to be all the rage in information security for finding discarded but useful equipment and “interesting” information. I don’t see much about it any more, but people are no doubt just as careless today as they were in the past. Thoughts?
5 comments
Several trends make scavenging less attractive than it once was:
• There won’t be as much information. With the shift to e-mail and online documentation, there are fewer interesting paper documents, and the ones that remain, when no longer needed, are more likely to be shredded by the trucks that have become an everyday sight in business districts.
• There won’t be as much equipment. Governments require e-waste to be kept out of the normal solid waste stream, and online markets such as eBay have made it more rewarding to sell surplus items to asset recovery companies, rather than just throwing them away.
• You’re more likely to get caught. Low-cost, high-quality video surveillance, with automated and remote monitoring, has made it routine to cover trash rooms, dumpster enclosures, and similar areas that might, in the past, have been monitored only at the most sensitive facilities.
• There won’t be as much information. With the shift to e-mail and online documentation, there are fewer interesting paper documents, and the ones that remain, when no longer needed, are more likely to be shredded by the trucks that have become an everyday sight in business districts.
• There won’t be as much equipment. Governments require e-waste to be kept out of the normal solid waste stream, and online markets such as eBay have made it more rewarding to sell surplus items to asset recovery companies, rather than just throwing them away.
• You’re more likely to get caught. Low-cost, high-quality video surveillance, with automated and remote monitoring, has made it routine to cover trash rooms, dumpster enclosures, and similar areas that might, in the past, have been monitored only at the most sensitive facilities.
I think there's a lot of carelessness/ignorance with small companies as it pertains to info sec. They simply don't have the budget to contract out the security work, create effective policies (experts in-house or consulting), enforce those polices, etc.
I think most bigger companies have a lot of protocols and contract professionals to remove and remediate old documents or equipment. They are also more likely to have physical security preventing access to the dumpsters.
I think most bigger companies have a lot of protocols and contract professionals to remove and remediate old documents or equipment. They are also more likely to have physical security preventing access to the dumpsters.
Shared workspaces and offices like WeWork seem to pose the biggest threats to "common infosec" but mostly in the form of digital dumpster diving.
Although, the WeWork office the startup I work for occupied in NYC pre-covid had multiple bottles of hand sanitizer stolen before our lease expired this month. That being said, even with a private key-card secured office these spaces are laughably insecure.
Although, the WeWork office the startup I work for occupied in NYC pre-covid had multiple bottles of hand sanitizer stolen before our lease expired this month. That being said, even with a private key-card secured office these spaces are laughably insecure.
I'd say it's been replaced by scouring for S3 buckets with bad permissions.