Subject: Just Deals DET1 has someone's old messages in memory

From: "Chris H" <runparts@...>
Date: Tue, 22 Nov 2005 10:20:16 -0000

I'm cross posting my message from the I-Appliance BBS because this
seems to get more traffic. Anyway, I found a neat thing about my
MailStation:

So I was playing around with an old Southwestern Bell branded
"eMessage" (DET1 MIVO 100 w/ 2.22CIDSV firmware) that I got from Just
Deals a good time ago, and while browsing with the hex editor
(Shift-Fn-T while powering on, then hiting shift F3? however it is
done, I forget) I found what appear to be someone else's saved emails.
The unit came to me unconfigured, I've added one user and left the
other 4 blank. At around 02 c0 a0 plus or minus there are several
emails from/to a Kirstin who is apparently new to email ("I GOT MAIL
FOR MY PHONE!!"). Interesting to read. My guess is that the Just Deals
units were re-furbished from a warrenty return. They reset them at the
factory but that does not wipe the user space memory clear. So I get
to read some random person's emails. Check it out if you have one of
the Just Deals mailstations or another refurbished unit.

Not necessarly useful information, but interesting and raises several
questions about privacy.

Chris H.

---

From: "Anthony Albert" <albert@...>
Date: Tue, 22 Nov 2005 08:44:13 -0500

>Not necessarly useful information, but interesting and raises several

Indeed, it does raise privacy concerns.  Reliable and complete deletion 
of (possibly) sensitive information should definitely be on the list of 
any refurbishement operation...   My guess is that they just didn't 
give it any thought at the refurb place, just assumed the reset would 
do the trick.  With flash memory, though, that's not enough - I think 
there should have been a ROM routine included for doing just that.

Anthony Albert
===========================================================
Anthony J. Albert                     albert@...
Systems and Software Support Specialist          Postmaster
Computer Services - University of Maine, Presque Isle
	"This is only temporary, unless it works."
			--- Red Green

---

From: "Cyrano Jones" <cyranojones_lalp@...>
Date: Mon, 28 Nov 2005 08:06:53 -0000

--- In [email-masked], "Chris H" <runparts@y...> wrote:
> ...
> done, I forget) 

Hi Chris,

It's Shift-F5 (from test mode), to enter hex viewer mode.

From there, an interesting key sequence is
g710304x<back>

Then try function-s
You will find yourself in hex *edit* mode.  :-)

> I found what appear to be someone else's saved  emails.

I find it both useful and interesting!  Useful, because it inspired
me to take another look at the file structure from the hex-viewer.
I have been trying to understand the file system by examining the
code.  But there were several details that hadn't really clicked 
into place.  Looking at some files after knowing a little bit about
the structure provided a couple of big "AHA!!!" moments.

And interesting, because it raises the question of just where the
responsibility lies for protecting the privacy of data that is 
locked inside of an appliance with non-removable and non-volatile
memory.

I tend to believe it should be the users responsibility.  But maybe
as consumers, we need to demand a privacy policy from the
manufacturers and dealers of these kinds of devices?

--CJ

---

From: "Cyrano Jones" <cyranojones_lalp@...>
Date: Tue, 29 Nov 2005 03:12:11 -0000

Testing the flash seems to wipe out all of the dataflash,
except for the serial number.  The files are no longer just 
tagged as deleted, they are zeroed out.

--CJ

---

From: Gary Clouse <niklaus37217@...>
Date: Tue, 29 Nov 2005 11:08:12 -0800 (PST)

I work a lot with used computers, and they often have
old data on them. I will usually backup the data, and
hold it until I can verify that the previous owner
doen't want it, at which time I delete the backup.
MOst of the time the former owner is unreachable or
doesn't want the old data.

--- Cyrano Jones <cyranojones_lalp@...> wrote:

> > "eMessage" (DET1 MIVO 100 w/ 2.22CIDSV firmware)
> that I got from  
> Just
> > FOR MY PHONE!!"). Interesting to read. My guess is
> that the Just  
> Deals
> > units were re-furbished from a warrenty return.
> They reset them at  
> the
> > Not necessarly useful information, but interesting
> and raises  
> several
> > questions about privacy.
> 

		
__________________________________ 
Yahoo! Mail - PC Magazine Editors' Choice 2005 
http://mail.yahoo.com