BIOS Rootkit for real !

CloneRanger · May 22, 2014

Absolute Computrace Revisited

This module is embedded into BIOS PCI Option ROM or UEFI firmware

*

Nowadays EFI BIOS can contain up to several hundred EFI drivers, applications and other modules packed into a type of file system

*

We have contacted Absolute Computrace technical support service and provided serial numbers of hardware that had suspicious installation of Computrace Agents. The technical support assistant reported that those serial numbers were not in their database. We believe this means Computrace was not activated in the normal way. How it was activated, why and by whom remains a mystery.

*

However, on systems with DEP and ASLR enabled some extra steps may significantly ease the process of running code and make the process smoother and more stable.

*

When we first found and analyzed Computrace we mistakenly thought it was malicious software, because it used so many of the tricks that are popular in current malware. It has specific anti-debugging and anti-reverse engineering techniques, injects into the memory of other processes, establishes secret communication, patches system files on disk (autochk.exe), keeps configuration files encrypted, and finally drops a Windows executable directly from BIOS/firmware.

*

Nevertheless, detection of Computrace modules was later removed by Microsoft and some AV vendors. Computrace executables are currently whitelisted by most AV companies.

We believe that Computrace was designed with good intentions, but our research shows that vulnerabilities in this software can turn a useful tool into a powerful weapon for cybercriminals. We believe that such a powerful tool needs to have powerful authentication and encryption mechanisms to continue fighting the good fight
Click to expand...

http://www.securelist.com/en/analysis/204792325/Absolute_Computrace_Revisited

J_L · May 22, 2014

And I thought DRM rootkits were bad.

guest · May 22, 2014

everything can be "cured" in a way or another.

MrBrian · May 22, 2014

Also discussed at https://www.wilderssecurity.com/thr...echnology-absolute-computrace-article.362309/.

Log in or Sign up

BIOS Rootkit for real !

CloneRanger Registered Member

J_L Registered Member

guest Guest

MrBrian Registered Member

Log in or Sign up

BIOS Rootkit for real !

CloneRanger Registered Member

J_L Registered Member

guest Guest

MrBrian Registered Member

Useful Searches