is computrace a permanent backdoor?

Question

I was reading about CompuTrace and this thing is pretty much a backdoor and irremovable. It's in the firmware, in the BIOS and survives formatting and even hard drive change and OS reinstalls.

Some question came to mind,

1. Does CompuTrace work with Linux?

2. Does CompuTrace still work when using VPN or Tor?

3. How do you find out if it's on the computer, even if inactive?

I did some reading online and this exploit/backdoor is very dangerous. It can basically obtain ANY information and send it back home and is a poison pill and a tracking device. One of the issues I have noticed is the purchasing of used notebooks which you cannot be sure are not stolen.

Read this: http://www.freakyacres.com/remove_computrace_lojack

One comment was particularly interesting, apparently coming from a cop, which claims (quote)

"It's all nice in theory to sit here and talk about how you think you can disable the software, but from a law enforcement perspective I can tell you it is a LOT more persistent than you know and it does a whole lot more than you think it does."

That does not sound good and is pretty much an information security killer.

Am I missing something here or is this a permanent, irremovable exploit/backdoor?

Answer 1

According to "Absolute Computrace Revisited" and "Absolute Computrace / System Requirements" answers to your questions are:

1. Yes (Ubuntu, Debian). There should not be a big problem for CompuTrace developers to make it work with RH or SuSE I believe, since SW versions, placement of binaries and packaging are more or less standard in these distributions also. RH SeLinux and SuSE AppArmor can be a bit of a problem, but it is more administrative (to get a proper profile built-in) than technical.

2. Yes/probably. Since VPN just wraps IP traffic and routes all or part of it to another location, CompuTrace will follow that routing. If the addresses it wants to contact are routed to VPN gateway and the gateway does not know/is not configured to route these addresses further, CompuTrace will not work, but this issue is not specific to VPN, the same is also true for any router that has configurable routing tables. As for TOR if a TOR proxy is set in IE properties of a user then IE process launched by CompuTrace will also use this setting. Other ways to connect to Internet are not announced, but there is no problem for CompuTrace developers to build TOR presence detection and act accordingly.

3. On the first linked page there is a list of signs of CompuTrace presence on a computer. Also on CompuTrace official site there is a list of laptop models where CompuTrace is preinstalled by manufacturers, so if you buy a new laptop that is in the list - you have CompuTrace.

And the answer to your last question would be "Yes, but..." Technically CompuTrace is a permanent irremovable (for an average/above-average user) backdoor. Legally it was not developed with malicious intentions in mind (or I hope so) so at least in some countries it is not considered malware. It is not an exploit per se, since it was made to function exactly like it functions, but it can be exploited by bad guys, just like any other network-enabled SW.