We put a lot of trust in big companies, so when they let us down it can have serious consequences.

I recently went shopping for a new computer. I wanted a low-end laptop for light work, and the HP Stream seemed like a good deal. That deal was made even sweeter when Best Buy offered to sell me a returned one for almost 20 percent off. The salesman assured me that it was in like-new condition and that they would honor all warranties. Sold.

I always get a little thrill opening a new gadget. The computer looked like it had never been touched and all the paperwork was still in sealed bags. There was even a slip of paper in the box with the ID of the tech who cleaned and certified the unit.

So it surprised me when I booted up and saw someone else’s name and Hotmail address at the login prompt. So much for like-new!

As I stared at the full name and e-mail address of the previous owner—let’s call him David—I wondered. Could I get into this computer another way? It was mine after all. And how much more could I learn about him? How bad of a mistake had the store made?

My inner blackhat

I’ve worked with computers for a long time, but I’m no security expert.

Most people use familiar names, dates, and places in their passwords , so my first step was to learn a little more about David. I had his first and last names, and he used his middle initial in his e-mail address. I also assumed he lived somewhere local. My searches returned a possible address. I considered visiting, but I chickened out. To be honest, I couldn’t think of any situation where that would end well.

It didn’t take long to locate a list of common passwords that meet the minimum requirements for a Windows Live account. It also didn’t take long for me to realize that this was painfully slow. Windows happily let me type in about 20 passwords peppering some with the address information I got. I’m no stranger to doing tedious things, but I’d rather the computer do them for me.

I needed to automate, which meant I needed to find the right tools. A Google search for “I forgot my Windows 8 password” helpfully returned millions of results, and the second one was all I needed. Surprisingly the tools haven’t changed in the last 15 years, and in some ways the process is easier now. (Hooray for progress!)

Fifteen years ago I’d have pulled the hard-drive from the machine, fiddled with the jumpers, and mounted it in another box. Then I’d be able to browse the files and maybe crack the password. Ten years ago, I’d have put the hard drive in a USB enclosure. Today, all I needed was a flash drive with Linux.

After a quick detour through the BIOS to change the boot order, I was in business.

In very little time, I was able to browse through all the files on the computer. There wasn’t a single picture or song or document to be found. I expect David hadn’t had the computer very long, maybe just long enough to set up his account, or he was smart enough to delete everything. I was a little disappointed, but I still had a few tricks up my sleeve. I copied off several system files—specifically the ones that stored the encrypted passwords.

Encryption today is better than it’s ever been, but it still suffers from the same weakness—humans. If David's password wasn't strong enough, then it was already cracked and posted in a rainbow table somewhere. These tables are giant lists of passwords and what they look like after they are encrypted. I could essentially look up David’s encrypted password and get his plain-text password.

It's not as dark as you think. This whole thing may sound a bit nefarious, but I didn’t go to any shady sites to find this information. I downloaded a program from SourceForge (we know), installed it on a USB drive, and ran it on the computer. It took all of 28 seconds to return the password.

There you go. The latest Windows operating system, and it was compromised by a Web search and some open source software. The whole process took me a few hours. I can only imagine how fast a seasoned hacker could do it. Also, I didn’t change anything about the computer’s hard drive. The default Windows security has improved over the years, but so have the tools to get around it. There are settings that can protect against this type of attack, but those aren't the default settings.

Connected world

I logged in as David and the computer looked like I expected it to—default. I’d already perused through the files, so I knew there wasn’t much to be found there.

What I didn’t know was what I’d find online. David’s password didn’t just get me into this computer. It was also his Hotmail and Windows Live passwords. I was now logged in as David on a computer that the world still thought was his.

I debated whether I should take my research one step further and log into a website. But I didn’t want to invade David's privacy any more than I already had—even though I hadn’t gotten much. Up to now, I’d been accessing data on a computer I purchased that was supposedly wiped clean and like new. But going online? That felt a bit too far.

For example, if he had logged in to social media sites, a less moral-conscious hacker could do some embarrassing things or some social engineering. Imagine if he’d logged into Amazon or his bank and the financial damage that could have resulted. They would also have access to David's Windows Live account profile, purchase history, Xbox Live account, OneDrive, and other Microsoft services. And don’t forget that they could also see his Internet history and visit all the sites whose passwords are saved in the browser.

I did make one mistake. This was my first time using Windows 8 with a touch screen, and I accidentally launched the Mail app, which automatically logged me in to David’s Outlook mailbox. This is the brass ring for a would-be thief, giving the thief the ability to search which sites David had accounts for. Most people use the same passwords over and over, so that would give a thief a leg up. And if the password didn’t work, the hacker could simply use the forgot password link on the site and it would send an e-mail to—you guessed it—the Outlook e-mail.

A thief would have immediately changed David’s e-mail password. Luckily, I’m not a thief, so I quickly exited the app and silently apologized to David.

Pièce de résistance

I couldn't go any further. I’d gotten what I needed to write this article and was ready to move on. I packed everything back into the box to return it to the store. The least I could do was to tell Best Buy about their mistake so it hopefully wouldn’t happen again.

As I packed up the paperwork, my eyes were drawn to the slip of paper with the ID of the person who inspected the machine. I wanted to make special note of who it was so I could report it to the manager.

That looks familiar. It’s David’s password. It was in the box the entire time. Not only did they sell me a computer with someone else’s data still on it, they gave me the password as well. No hacking required.

I may not be the world’s worst blackhat-wannabe, but discovering this didn’t help my ego much. In retrospect, this should have been the first password I tried.

My embarrassment quickly became anger. Mistakes happen, but this was too much. The password is clearly printed on Best Buy receipt paper, so it had to be written in the store. Why would they need David’s password to reset the computer? I could understand if they were working on the machine to return it to him, but they were doing a factory reset. And how did that password and machine get taped up and put back on the floor for resale?

I packed everything up and drove to Best Buy. I immediately asked to speak to a manager. He was very nice, apologized several times, and said that this was a serious mistake. He wrote down some information from my receipt and explained that he would track down how this happened. He suspected that this computer never made it to the Geek Squad for a reset. I don’t exactly know what that means in their process, but it was a serious miss.

The manager asked me to leave the computer for them to clean it up, but I told him I was in a hurry and knew how to do it myself—it’s not hard. He let me pack up the computer and take it home as-is. This surprised me. I had had the computer for a week, so maybe he thought that any possible damage was already done? Or maybe I just look trustworthy?

I performed a factory reset as soon as I got home. The process didn’t involve knowing David’s password, and it took about 20 minutes to complete. I also sent David an e-mail to let him know what happened, but I haven’t heard back.

In the end, I don’t know if David was lucky that I ended up with his computer or not. While I didn’t go all evil-hacker on it, I did poke around. I suspect most people would have taken the machine back, Best Buy would have reset it, and no one would have known the difference.

I wonder how many times this happens.

As for me, I think I’ll hang up my blackhat. It didn’t fit very well anyway. But I will keep my white hat close—and my personal data even closer.

Listing image by John Ferguson