Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Absolute persistance technology amounts to a persistent rootkit pre-installed by many device manufacturers (Acer, Asus, Dell, HP, Lenovo, Samsung, Toshiba, etc) to facilitate LoJack for laptops, and other backdoor services:

The Absolute persistence module is built to detect when the Computrace and/or Absolute Manage software agents have been removed, ensuring they are automatically reinstalled, even if the firmware is flashed, the device is re-imaged, the hard drive is replaced, or if a tablet or smartphone is wiped clean to factory settings.

Absolute persistence technology is built into the BIOS or firmware of a device during the manufacturing process.

This has echoes of both Rakshasa and vPro.

Also, like other corporate rootkits, it increases the attack surface available on the host PC and thereby opens the door to additional malware:

The protocol used by the Small Agent provides the basic feature of remote code execution [and] creates numerous opportunities for remote attacks in a hostile network environment. ... A typical attack on a local area network would be to redirect all traffic from a computer running Small Agent to the attacker’s host via ARP-poisoning. Another possibility is to use a DNS service attack to trick the agent into connecting to a fake C&C server. We believe there are more ways to accomplish such attacks, though this is beyond the scope of the current research.

Anyhow, if a user legally purchases, secondhand or new, a device that originally had Absolute persistence technology built in and may even have had it activated, and wishes:

  • to detect whether the technology is still present in the device; and, if so,
  • to remove that technology from the device (i.e. disinfect the device),

how best should (s)he go about this?

I'm guessing that Coreboot is part of the answer.

share|improve this question
Unless there is a dedicated chip onboard for storing such preinstalled modules, flashing with a clean or moded version of BIOS is enough. Coreboot also can be used. To detect the presence, the best way is to observe the system deeply and carefully, check settings in bios, reverse engineer the BIOS etc. – Nikhil_CV Sep 29 '15 at 5:12
@Nikhil_CV, I've no idea whether there is a dedicated chip, or indeed if the rootkit persists by homing itself in multiple chips/firmwares/etc (e.g. is it related to "Intel Anti-Theft Technology" in many modern Intel CPUs?). If you know more than I do, then please expand on your comment in an answer, and provide sources for your information. Thanks! – sampablokuper Sep 30 '15 at 18:44

"Absolute persistence technology is built into the BIOS or firmware of a device during the manufacturing process."

So, in addition to removing the agent, you will need to flash the BIOS or firmware of the device, with a version without the technology.

Since "core boot is a Free Software project aimed at replacing the proprietary BIOS (firmware) found in most computers", it is potentially part of an answer.

Of course, you haven't specified a device, so it's impossible to provide you with a detailed answer. The only correct answer is 'it depends'.

The functionality of the technology requires that removing it remain infeasible, so its quality/repuation hinges on us being unable to provide you with a detailed answer.

It's really not one technology, but many; review the NSA's ANT technology codenamed DEITYBOUNCE, IRONCHEF, FEEDTROUGH, GOURMETTROUGH, etc; see

share|improve this answer
I didn't specify a device because I'm interested in in the general case and I don't know whether there's a common implementation or if implementation varies from model to model. Still, if you want a specific suggestion, how about the ThinkPad X60? – sampablokuper Apr 17 '14 at 17:44
That's cool. The only correct answer is 'it depends', because the implementation varies from model to model. I don't have specifics for the ThinkPad X60. For the Juniper brand, for example, there are three implementations in the NSA toolbox. Can these be detected? Not readily. There is no answer to your question 'till someone knows what the technology is in a specific case. How to go about knowing that? Buy the tech, and compare a protected system to an unprotected one. – Matthew Elvey Apr 25 '14 at 19:11
I'm not sure what you mean by "protected". Presumably, you mean one with the Absolute rootkit removed. Anyhow, this still begs the question of how to get both a protected and unprotected X60 (for instance) in order to make such a comparison. – sampablokuper Apr 26 '14 at 13:34

According to the FAQ:

What if the Absolute software agent needs to be removed from a device?

IT administrators that have been authorized to do so, may carry out this function themselves within the Absolute Customer Center for Computrace, or from within the Absolute Manage console for Absolute Manage software agent removal.

I.e. you have to allow CompuTrace to be installed, persuade Absolute that you are the authorised user now, get control transferred to you, and de-activate it using their managed service.

Which will certainly involve sending them money.

I am guessing that CompuTrace will be detected by any competent antivirus as "remote management software" which you can probably flag not to run.

share|improve this answer
I'm afraid this FAQ answer ("What if the Absolute software agent needs to be removed from a device?") doesn't address my question, as it would only remove the software agent, not the Active persistence technology. – sampablokuper Mar 19 '14 at 18:20
As for using mainstream antivirus software to block the execution of any part of the Active system, that's unlikely to work: "the [Absolute] rootkit is white-listed by anti-virus software". – sampablokuper Mar 19 '14 at 18:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.