Absolute persistence technology amounts to a persistent rootkit pre-installed by many device manufacturers (Acer, Asus, Dell, HP, Lenovo, Samsung, Toshiba, etc) to facilitate LoJack for laptops, and other backdoor services:
The Absolute persistence module is built to detect when the Computrace and/or Absolute Manage software agents have been removed, ensuring they are automatically reinstalled, even if the firmware is flashed, the device is re-imaged, the hard drive is replaced, or if a tablet or smartphone is wiped clean to factory settings.
Absolute persistence technology is built into the BIOS or firmware of a device during the manufacturing process.
The protocol used by the Small Agent provides the basic feature of remote code execution [and] creates numerous opportunities for remote attacks in a hostile network environment. ... A typical attack on a local area network would be to redirect all traffic from a computer running Small Agent to the attacker’s host via ARP-poisoning. Another possibility is to use a DNS service attack to trick the agent into connecting to a fake C&C server. We believe there are more ways to accomplish such attacks, though this is beyond the scope of the current research.
If a user legally purchases, secondhand or new, a device that originally had Absolute persistence technology built-in and may even have had it activated, and wishes:
- to detect whether the technology is still present in the device; and, if so,
- to remove that technology from the device (i.e. disinfect the device),
how best should the user go about this?
I'm guessing that Coreboot is part of the answer.