7 ms·

> Computrace/Lo Jack is a legitimate application that is factory installed into the firmware of nearly every laptop in the world, of all varieties. The idea is

by dplgk 8y ago

> Computrace/Lo Jack is a legitimate application that is factory installed into the firmware of nearly every laptop in the world, of all varieties. The idea is that if your laptop gets stolen, you can find it, and/or wipe it remotely. This is obviously good, and useful. How is this so? No one's ever mentioned this when talking about stolen laptops. They talk about high level software like Prey or whatever Apple uses. How would you use this to find your laptop? There's a central server that almost every laptop on earth talks to? Seems highly doubtful.

rzzzt 8y ago
ekianjo's wikipedia link describes how it works: tracking is still done by a high-level software agent, the firmware part is there to make sure that it is present on the filesystem each time the machine boots, making it survive Windows reinstalls.
bcaa7f3a8bbc 8y ago
Wow, we've posted the same points within the same minute...
ekianjo 8y ago
https://en.m.wikipedia.org/wiki/LoJack_for_Laptops https://en.m.wikipedia.org/wiki/LoJack_for_Laptops
- John_KZ 8y ago
  I can't believe I haven't heard of this before.
- josteink 8y ago
  > The software agent behaves like rootkit (bootkit), reinstalling a small installer agent into the Windows OS at boot time. This installer later downloads the full agent from Absolute's servers via the internet. This installer (small agent) is vulnerable to certain local attacks And once again Linux is a solution.
  - SmellyGeekBoy 8y ago
    I'm a full time Linux user so I'm all for fanboying, but the belief that Linux would be immune to this type of attack is naive at best.
    - josteink 8y ago
      UEFI let’s the FW signal to the OS upon boot “please install this driver blindly”, but it can’t force the OS. Only Windows obliges to this request. Linux is immune.
      - josteink 8y ago
        Can someone explain to me why this factually correct[1] comment is so heavily downvoted, as opposed to explaining how I may be mistaken? I’m baffled to say the least. [1] https://news.ycombinator.com/item?id=10039870 https://news.ycombinator.com/item?id=10039870
        arminiusreturns 8y ago
        There is not just a single explanation, but I'll give it a go. 1) Many industry titans such as MS, Apple and Monsanto, just as examples, have encouraged employees to participate in forums like this in order to affect conversations and influence debates, so real users of a strong bias against uncomfortable truths/facts use down votes in a way not intended. 2) from those same types of companies, sockpuppetry has become a pervasive and powerful item in their toolbelt, accomplishing the same as above but with inorganic users and on a large scale. 3) HN has some extremely good commentators, some who have been around for a long time, but I have noticed a large careening away from the type of hackeristic dogged pursuit of truth and lack of fear of attacking power that seemed to be the core of HN in its earlier days. in particular, since the user protested and ignored rule change to "don't be negative" , where heated debates between truth to power speakers and status quo speakers tend to bring the hammer down on those against the status quo. Hence why I say HN seems to me to have become much More than ever before, MBAs who pretend to be hackers, instead of the other way around. 4) As a greybeard sysadmin type, I think many users suffer from Stockholm syndrome, and will blindly downvote (usually with no comment) attacks against their kidnappers, even if truthful.
RL_Quine 8y ago
It's listed in many BIOS screens under "security".
- SmellyGeekBoy 8y ago
  So if my BIOS doesn't mention it I'm in the clear? Or is it just the case that some users have no way to disable/enable it?
  - exikyut 8y ago
    Google your BIOS version strings, perhaps, or extract/dump and disassemble/unpack it.
  - jlgaddis 8y ago
    You might be in the clear, but make sure you've traversed every menu and sub-menu in the BIOS configuration. One of my laptops -- I don't recall which, sorry -- has the settings located a few levels deep with some very unsuspecting terminology. Even when I was looking specifically for it (I knew it was in there!), it took me a few minutes to actually find it. Also, WRT turning it off, there are typically two options: deactivate and disable. One is just "temporary" (in that it can be turned back on later), the other is (supposedly) permanent and "impossible" to revert. Make sure you choose the right one (for you).
lawnchair_larry 8y ago
You’d hope that’s unlikely, but unfortunately it is not. Microsoft left a backdoor in UEFI/Bootlocker to specifically support this. It’s also had a history of major security issues, and a vendor who does not understand how to deal with vulnerability reports. They aren’t on Apple laptops though, just most OEMs. Personally, I think it’s absolutely fantastic that this has finally been publicly exploited in the wild and repurposed for malicious purposes, because this was called out as an obvious threat almost 10 years ago now, and none of the vendors took it seriously or cared. Now they can’t ignore it with the “we have no reports of any customers being attacked” deflection and they will likely face far more scrutiny. It’s just like what happened with the Intel ME staying under the radar for so long, but at least to Intel’s credit, they actually attempted to build security in.
xab9 8y ago
Doubtful, but true - though it _should_ not be preactivated. But sometimes it is. Not to mention the Lenovo "rootkit" which is quite widely known.
iou 8y ago
Yup, these guys got a deal way back and built their business on it https://www.absolute.com https://www.absolute.com
dmichulke 8y ago
Wow, that's so wrong on so many levels: - Install more software to make it more secure - Put secure software in the lowest ring possible to make it more secure - "The good can use it against the bad" but not the other way round - Proof of ownership based on "I said it first" - Of course, closed source, because security Sorry for the tinfoil interpretation, but I believe it's hard to convince every company to (most likely) pay for this stuff without some sort of coercion. Looks to me like Intel ME, secure platform processors, mandatory backdoors for devices, and the likes.

by dplgk 8y ago

rzzzt 8y ago

ekianjo's wikipedia link describes how it works: tracking is still done by a high-level software agent, the firmware part is there to make sure that it is present on the filesystem each time the machine boots, making it survive Windows reinstalls.

bcaa7f3a8bbc 8y ago

Wow, we've posted the same points within the same minute...

ekianjo 8y ago

https://en.m.wikipedia.org/wiki/LoJack_for_Laptops https://en.m.wikipedia.org/wiki/LoJack_for_Laptops

John_KZ 8y ago
I can't believe I haven't heard of this before.
josteink 8y ago
> The software agent behaves like rootkit (bootkit), reinstalling a small installer agent into the Windows OS at boot time. This installer later downloads the full agent from Absolute's servers via the internet. This installer (small agent) is vulnerable to certain local attacks And once again Linux is a solution.
- SmellyGeekBoy 8y ago
  I'm a full time Linux user so I'm all for fanboying, but the belief that Linux would be immune to this type of attack is naive at best.
  - josteink 8y ago
    UEFI let’s the FW signal to the OS upon boot “please install this driver blindly”, but it can’t force the OS. Only Windows obliges to this request. Linux is immune.
    - josteink 8y ago
      Can someone explain to me why this factually correct[1] comment is so heavily downvoted, as opposed to explaining how I may be mistaken? I’m baffled to say the least. [1] https://news.ycombinator.com/item?id=10039870 https://news.ycombinator.com/item?id=10039870
      - arminiusreturns 8y ago
        There is not just a single explanation, but I'll give it a go. 1) Many industry titans such as MS, Apple and Monsanto, just as examples, have encouraged employees to participate in forums like this in order to affect conversations and influence debates, so real users of a strong bias against uncomfortable truths/facts use down votes in a way not intended. 2) from those same types of companies, sockpuppetry has become a pervasive and powerful item in their toolbelt, accomplishing the same as above but with inorganic users and on a large scale. 3) HN has some extremely good commentators, some who have been around for a long time, but I have noticed a large careening away from the type of hackeristic dogged pursuit of truth and lack of fear of attacking power that seemed to be the core of HN in its earlier days. in particular, since the user protested and ignored rule change to "don't be negative" , where heated debates between truth to power speakers and status quo speakers tend to bring the hammer down on those against the status quo. Hence why I say HN seems to me to have become much More than ever before, MBAs who pretend to be hackers, instead of the other way around. 4) As a greybeard sysadmin type, I think many users suffer from Stockholm syndrome, and will blindly downvote (usually with no comment) attacks against their kidnappers, even if truthful.

RL_Quine 8y ago

It's listed in many BIOS screens under "security".

SmellyGeekBoy 8y ago
So if my BIOS doesn't mention it I'm in the clear? Or is it just the case that some users have no way to disable/enable it?
- exikyut 8y ago
  Google your BIOS version strings, perhaps, or extract/dump and disassemble/unpack it.
- jlgaddis 8y ago
  You might be in the clear, but make sure you've traversed every menu and sub-menu in the BIOS configuration. One of my laptops -- I don't recall which, sorry -- has the settings located a few levels deep with some very unsuspecting terminology. Even when I was looking specifically for it (I knew it was in there!), it took me a few minutes to actually find it. Also, WRT turning it off, there are typically two options: deactivate and disable. One is just "temporary" (in that it can be turned back on later), the other is (supposedly) permanent and "impossible" to revert. Make sure you choose the right one (for you).

lawnchair_larry 8y ago

You’d hope that’s unlikely, but unfortunately it is not. Microsoft left a backdoor in UEFI/Bootlocker to specifically support this. It’s also had a history of major security issues, and a vendor who does not understand how to deal with vulnerability reports. They aren’t on Apple laptops though, just most OEMs. Personally, I think it’s absolutely fantastic that this has finally been publicly exploited in the wild and repurposed for malicious purposes, because this was called out as an obvious threat almost 10 years ago now, and none of the vendors took it seriously or cared. Now they can’t ignore it with the “we have no reports of any customers being attacked” deflection and they will likely face far more scrutiny. It’s just like what happened with the Intel ME staying under the radar for so long, but at least to Intel’s credit, they actually attempted to build security in.

xab9 8y ago

Doubtful, but true - though it _should_ not be preactivated. But sometimes it is. Not to mention the Lenovo "rootkit" which is quite widely known.

iou 8y ago

Yup, these guys got a deal way back and built their business on it https://www.absolute.com https://www.absolute.com

dmichulke 8y ago

Wow, that's so wrong on so many levels: - Install more software to make it more secure - Put secure software in the lowest ring possible to make it more secure - "The good can use it against the bad" but not the other way round - Proof of ownership based on "I said it first" - Of course, closed source, because security Sorry for the tinfoil interpretation, but I believe it's hard to convince every company to (most likely) pay for this stuff without some sort of coercion. Looks to me like Intel ME, secure platform processors, mandatory backdoors for devices, and the likes.