Solved - Dell Computrace/Absolute module questions

[hap2001]

Hi guys.
My friend have a Dell laptop with Absolute module permanently activated.
1. If he use Linux, can the Absolute backdoor still spy on him?
2. If he use Linux, can the Absolute backdoor still lock the PC?
3. If he use Windows, can the Absolute backdoor lock the BIOS/UEFI so the whole thing is completely bricked?
Thanks.

[Halcyon]

It depends on the BIOS. Computrace became Absolute.

With the older Computrace modules, they could be permanently enabled (or disabled). Either setting can never be changed again.

With the newer "Absolute" modules, they can be permanently disabled. However, if enabled, they can be either temporarily or permanently disabled again, but it relies on the agent/application to be installed for the command/control aspect to function.

Depending on how the policies were configured, the Absolute agent can be remotely installed (if removed by the user). But yes, it's possible that the system can be locked or remotely wiped by the system administrator. It's designed so stolen computers can be secured remotely, and corporate software policies are enforced.

https://www.dell.com/support/kbdoc/en-au/000142862/computrace-replaced-by-absolute-module-in-newest-bios-revisions

[audiotubes]

I don't know anything about this, but I wonder if you can block ports to disable it. Hopefully the comm link is something simple.

What about reflashing the BIOS? Maybe that does away with the problem entirely.

[Halcyon]

I don't know anything about this, but I wonder if you can block ports to disable it. Hopefully the comm link is something simple.

What about reflashing the BIOS? Maybe that does away with the problem entirely.

They will typically use ports 80 and/or 443. You could block the domains, but that will obviously only be effective if the network is controlled by you.

Computrace/Absoute and similar technologies (such as Intel AMT) are independent of the system BIOS and will survive a re-flash. It's a seperate processor/management engine on the motherboard.

[hap2001]

Thank you everyone.
Yes we are also concerned about Intel AMT.
I did more homework and it seems AMT is inside PCH, while Computrace is inside BIOS firmware.
AMT works out-of-band, even with CPU removed. Computrace relies on Windows.
But AMT can be disabled without too much hassle, Computrace is very rogue and difficult to disable.

[Halcyon]

This is why I generally avoid purchasing secondhand laptops, particularly corporate models unless I can verify both the origin of the machine (so it hasn't been stolen) and the status of Absolute in the BIOS for each machine. Some sellers will be deliberately vague or omit details about it so you can't come back later and lodge a "not as described" claim against them. It puts the responsibility back on you (as the buyer) to know what to look out for and ask the right questions.

[Infraviolet]

"Computrace relies on Windows."
That would mean it would NOT(?) pose a problem to someone buying secondhand machines to install Linux upon?

[hap2001]

"Computrace relies on Windows."
That would mean it would NOT(?) pose a problem to someone buying secondhand machines to install Linux upon?

I cannot say for sure, but to my searches/understanding, yes, at least for early versions.
You can Google by yourself and may find more infos.

[Halcyon]

That's correct. Computrace/Absolute would be rendered ineffective as I don't believe they ever made a Linux agent. However in a Windows environment, the agent is automatically installed by the module (they call this  their "Persistence Technology").

[hap2001]

An update: Reply from official absolute support Email:

Thank you for contacting the Absolute support team. We are not compatible with Linux, please refer to the link below:
https://www.absolute.com/platform/requirements/

What a good news. Use my beloved Linux and shit on them all.