CAPEC-675
Retrieve Data from Decommissioned Devices
An adversary obtains decommissioned, recycled, or discarded systems and devices that can include an organization’s intellectual property, employee data, and other types of controlled information. Systems and devices that have reached the end of their lifecycles may be subject to recycle or disposal where they can be exposed to adversarial attempts to retrieve information from internal memory chips and storage devices that are part of the system.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-675: Retrieve Data from Decommissioned Devices: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/675.html and https://cve.bz/cve/capec/675?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Prerequisites
An adversary needs to have access to electronic data processing equipment being recycled or disposed of (e.g., laptops, servers) at a collection location and the ability to take control of it for the purpose of exploiting its content.
Skills required
- High skill
An adversary may need the ability to mount printed circuit boards and target individual chips for exploitation.
- Medium skill
An adversary needs the technical skills required to extract solid state drives, hard disk drives, and other storage media to host on a compatible system or harness to gain access to digital content.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Bypass Protection Mechanism | Accountability |
Mitigations
Backup device data before erasure to retain intellectual property and inside knowledge.
Overwrite data on device rather than deleting. Deleted data can still be recovered, even if the device trash can is emptied. Rewriting data removes any trace of the old data. Performing multiple overwrites followed by a zeroing of the device (overwriting with all zeros) is good practice.
Use a secure erase software.
Physically destroy the device if it is not intended to be reused. Using a specialized service to disintegrate, burn, melt or pulverize the device can be effective, but if those services are inaccessible, drilling nails or holes, or smashing the device with a hammer can be effective. Do not burn, microwave, or pour acid on a hard drive.
Physically destroy memory and SIM cards for mobile devices not intended to be reused.
Ensure that the user account has been terminated or switched to a new device before destroying.
Weaknesses it exploits
- CWE-1266 Improper Scrubbing of Sensitive Data from Decommissioned Device
Related attack patterns
Examples
A company is contracted by an organization to provide data destruction services for solid state and hard disk…
A company is contracted by an organization to provide data destruction services for solid state and hard disk drives being discarded. Prior to destruction, an adversary within the contracted company copies data from select devices, violating the data confidentiality requirements of the submitting organization.
MITRE's words, unchanged: CAPEC-675 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.