Return to Answer

IMPORTANT! Note, that the previous answer might be outdated. Kaspersky did a research on Computrace in 2015, which is also already 2 years outdated!

2. Yes, computrace resides in your BIOS, therefore it has the highest privilege to send collected data about your real activity. Also here the author of the secondary source says it does not disappear with reflashing. Some other articles say, it is on a CHIP. Obviously there are different informations from different times and versions. Even if it shows "not activated", it does not mean, that computrace is not running and phoning home.

3. You do a hardware BIOS inspection. Otherwise software tools are not reliable, but Kaspersky also provided some informations about it at the end of the presentation, and how to kill it. But they warn everyone not to mess with it, unless you have experience in BIOS, becuse you can accidsentally permanently enable it, and not even Absolute can turn it off for you. If we suppose, that we are not infected from backdoor, we can rely partially on a clean Wireshark inspection.

IMPORTANT! Note, that the previous answer might be outdated. Kaspersky did a research on Computrace in 2014 August, which is also already 2 years outdated!

2. Yes, computrace resides in your BIOS, therefore it has the highest privilege to send collected data about your real activity. Also here the author of the secondary source says it does not disappear with reflashing. Some other articles say, it is on a CHIP. Obviously there are different informations from different times and versions. Even if it shows "not activated", it does not mean, that computrace is not running and phoning home.

3. You do a hardware BIOS inspection. Otherwise software tools are not reliable, but Kaspersky also provided some informations about it at the end of the presentation, and how to kill it. But they warn everyone not to mess with it, unless you have experience in BIOS, becuse you can accidsentally permanently enable it, and not even Absolute can turn it off for you. If we suppose, that we are not infected from backdoor, we can rely partially on a clean Wireshark inspection. If you know how to mod a BIOS, you ccan also do that yourself, or just trust someone with that.

IMPORTANT! Note, that the previous answer is outdated. Kaspersky did a research on Computrace in 2015, which is also already 2 years outdated!

Otherwise bad news, there is still nothing 100% reliable about it, especially not about Linux. You can try to purchase open source or military hardware.

IMPORTANT! Note, that the previous answer might be outdated. Kaspersky did a research on Computrace in 2015, which is also already 2 years outdated!

WARNING: you should do your own wireshark test with your own Linux distributon and hardware setup. DO NOT RUN wireshark as superuser!

" sudo addgroup -system wireshark sudo chown root:wireshark /usr/bin/dumpcap sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap sudo usermod -a -G wireshark YOUR_USER_NAME

Then just start Wireshark and select the network interface. It worked for me on 10.04 LTS. permanent link

answered 04 Apr '12, 11:41 kyphos"

Otherwise bad news, there is still nothing 100% reliable about it, especially not about Linux. You can try to purchase open source or military hardware.

(I couldnt link much, but copy the quoted things for more sources if you wish)

Interesting problem: I saw on the official Absolute site, that Linux is not listed, also the signs always involve an .exe running = windows. How does an .exe work with Ubuntu, Debian? Prbably only if wine is installed. Also found on other forums people agreeing, that it does not work with linux. In an mail from 2007 Absolute seems to represent the philosophy that Linux is a minor operating system, thats why they do not support it:

John: Thanks for bringing the updates in Absolute Software's product, CompuTrace, to my attention! If you like, I can post an update on the article itself (which one are you referring to since it's published in several places?), as well as share it in my blog (which gets lots of visitors). That should ensure the correct information gets out...will that help clear up any misconceptions?

That said, I would also like the opportunity to ask some follow-up questions to your email. Two questions come to mind that I would love to have you share your unique insights on; those questions include the following:

Well we support Windows and MAC OS 10+ so yes; we would work if rebooted into a Windows world, but not if the user boots into Linux."  ( full artice: http://www.mguhlin.org/2008/10/computrace-revisited.html?_escaped_fragment_=#! )

edit

I have found an older article, where it seems, that they listed ubuntu and debian as compatible, but the site is defunct. Also here the author says it does not disappear with reflashing. Some other articles say, it is on a CHIP. Obviously there are different nformations from different times and versions. Even if it shows "not activated", it does not mean, that computrace is not running and phoning home.

https://bartblaze.blogspot.de/2014/11/thoughts-on-absolute-computrace.html

I do not know yet, what is a real solution to this, it looks, like a permanent backdoor, which can be activated even if the customer had deactivated it.

Updated, edited answer 2017 August

IMPORTANT! Note, that the previous answer is outdated. Kaspersky did a research on Computrace in 2015, which is also already 2 years outdated!

So yes, computrace seems to be a permanent backdoor, unless you have hardware experience to inspect and follow BIOS modification, decribed by Kaspersky. Any authority or hacker can alter the files and take full control over your machine, including full activity monitoring and deleting files.

Answers according to 2017:

1. We dont know, but: Secondary sources ( like Kaspersky@youtube and https://bartblaze.blogspot.de/2014/11/thoughts-on-absolute-computrace.html ) refer to Ubuntu/Debian agents, which are not found on the official site as supported. I also did a Wireshark packet capture with Linux, and I did not find any suspicious activity listed in the end of Kaspersky presentation. Exe does not run on linux, unless you have wine installed.

In an mail from 2007 Absolute seems to represent the philosophy that Linux is a minor operating system, thats why they do not support it:

(...)

Well we support Windows and MAC OS 10+ so yes; we would work if rebooted into a Windows world, but not if the user boots into Linux." 

( full artice: http://www.mguhlin.org/2008/10/computrace-revisited.html?_escaped_fragment_=#! )

BUT I assume, it is just a question of time to develop it. 2 years passed, and they still do not write anything about it. Kaspersky proved on live demonstration, that modified files are allowed to run in your system (Win).

2. Yes, computrace resides in your BIOS, therefore it has the highest privilege to send collected data about your real activity. Also here the author of the secondary source says it does not disappear with reflashing. Some other articles say, it is on a CHIP. Obviously there are different informations from different times and versions. Even if it shows "not activated", it does not mean, that computrace is not running and phoning home.

3. You do a hardware BIOS inspection. Otherwise software tools are not reliable, but Kaspersky also provided some informations about it at the end of the presentation, and how to kill it. But they warn everyone not to mess with it, unless you have experience in BIOS, becuse you can accidsentally permanently enable it, and not even Absolute can turn it off for you. If we suppose, that we are not infected from backdoor, we can rely partially on a clean Wireshark inspection.

Otherwise bad news, there is still nothing 100% reliable about it, especially not about Linux. You can try to purchase open source or military hardware.