Updated, edited answer 2017 August
IMPORTANT! Note, that the previous answer might be outdated. Kaspersky did a research on Computrace in 2014 August, which is also already 2 years outdated!
So yes, computrace seems to be a permanent backdoor, unless you have hardware experience to inspect and follow BIOS modification, decribed by Kaspersky. Any authority or hacker can alter the files and take full control over your machine, including full activity monitoring and deleting files.
Answers according to 2017:
- We dont know, but:
Secondary sources ( like Kaspersky@youtube and https://bartblaze.blogspot.de/2014/11/thoughts-on-absolute-computrace.html ) refer to Ubuntu/Debian agents, which are not found on the official site as supported.
I also did a Wireshark packet capture with Linux, and I did not find any suspicious activity listed in the end of Kaspersky presentation. Exe does not run on linux, unless you have wine installed.
In an mail from 2007 Absolute seems to represent the philosophy that Linux is a minor operating system, thats why they do not support it:
"From: Miguel Guhlin [mailto:[email protected]]
Sent: Monday, January 22, 2007
To: John Livingston
Subject: Re: April 10th, 2006 article "Protecting Deleted Files" - reference to Computrace
1) What if the hard drive is repartitioned, and users employ dual-boot scenario, one side running Linux and the other Windows? If running Linux, would CompuTrace still work?
After repartitioning Computrace will work when running in Windows.
2) You mention Eraser wouldn't cause removal of CompuTrace. If CompuTrace is part of the bios, I imagine that it would not. However, if the machine is reformatted using a utility like Darik's Boot-n-Nuke, loaded with a new Operating System (e.g. Linux), then pressed into service, would Absolute Software be able to find the equipment? In other words, would it still work as advertised?
Well we support Windows and MAC OS 10+ so yes; we would work if rebooted into a Windows world, but not if the user boots into Linux."
( full artice: http://www.mguhlin.org/2008/10/computrace-revisited.html?_escaped_fragment_=#! )
BUT I assume, it is just a question of time to develop it. 2 years passed, and they still do not write anything about it.
Kaspersky proved on live demonstration, that modified files are allowed to run in your system (Win).
Yes, computrace resides in your BIOS, therefore it has the highest privilege to send collected data about your real activity.
Also here the author of the secondary source says it does not disappear with reflashing. Some other articles say, it is on a CHIP. Obviously there are different informations from different times and versions.
Even if it shows "not activated", it does not mean, that computrace is not running and phoning home.
You do a hardware BIOS inspection. Otherwise software tools are not reliable, but Kaspersky also provided some informations about it at the end of the presentation, and how to kill it. But they warn everyone not to mess with it, unless you have experience in BIOS, becuse you can accidsentally permanently enable it, and not even Absolute can turn it off for you.
If we suppose, that we are not infected from backdoor, we can rely partially on a clean Wireshark inspection.
If you know how to mod a BIOS, you ccan also do that yourself, or just trust someone with that.
WARNING: you should do your own wireshark test with your own Linux distributon and hardware setup. DO NOT RUN wireshark as superuser!
" sudo addgroup -system wireshark
sudo chown root:wireshark /usr/bin/dumpcap
sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap
sudo usermod -a -G wireshark YOUR_USER_NAME
Then just start Wireshark and select the network interface. It worked for me on 10.04 LTS.
answered 04 Apr '12, 11:41
Otherwise bad news, there is still nothing 100% reliable about it, especially not about Linux. You can try to purchase open source or military hardware.
(I couldnt link much, but copy the quoted things for more sources if you wish)