9 ms·
Rootkit on a Brand new Toshiba laptop
- baltcode 15y agoHow do I check this on my laptop?
- DizzyDoo 15y agoCheck your process list for 'rcpnetp.exe'. Just checked my six month old Toshiba Satellite Pro C650, happily it was clean.
- sodiumphosphate 15y agoI see related Google results for 'rpcnet.exe'. Not sure if they are related yet (spelling error?). Also, I wonder how quickly they could rename the executable to deter removal, given the nature of their 'Persistence Module' and antivirus industry cooperation.
- dfox 15y agorpcnet.exe seems to be essentially same thing as rpcnetp.exe, only without the BIOS persistence hack.
- benologist 15y agoThe T135 is a pretty old laptop which explains why it was present after vendors stopped using it - I bought one around January or February last year, it doesn't seem to have the rootkit but it's a Latin American model which might have been exempt.
- jpcosta 15y agoi understand the frustration, but how else would a laptop tracking software work if not by connecting to the web and listening for commands, etc? It seems that this app is created by: http://www.absolute.com/en-GB/ http://www.absolute.com/en-GB/
- jitbit 15y agoYeah, correct. But what if some Absolute's employee turns out to be dishonest? A non-removable process, not detected by most antiviruses, that listens to the commands from the Net... Seems like a botnet to me.
- Duff 15y agoWhen we asked this question in the context of the laptops at the big enterprise that I worked for, the response from Absolute was "most of our employees are ex-cops, so that isn't a problem".
- natch 15y agoWow. Even setting aside the question of whether all cops are trustworthy, one does wonder why they are "ex" cops.
- HedgeMage 15y agoWhy should something like that be present/active without the owner's knowledge and consent? It's not the sort of thing I'd allow to run on my machine.
- viraptor 15y agoFor a start, user could be notified that he can install that system, instead of getting a laptop with such software preinstalled. I don't really see a reason to have this installed when users are not aware of it. How many people go to the producer after their laptop is stolen and ask "Have you by any chance installed some laptop tracking software on my laptop by default? I cannot identify my laptop anymore in any meaningful way - it's one of toshiba ones." ? If the user isn't aware of it, it's useless. If the user didn't agree to the way it's done, it's pretty much an illegal spying device.
- trotsky 15y agoIt is possible, though not the easiest thing in the world, to rebuild your bios while removing the lojack option rom. http://www.freakyacres.com/remove_computrace_lojack http://www.freakyacres.com/remove_computrace_lojack This article gives an overview, there may be better sources or you could refer to forums people use for bios modification of SLIC tables to get a better introduction to the tools.
- gitarr 15y agoIsn't this "unauthorized access to computer systems[1]"? When buying a laptop on Amazon, is there some sort of agreement/contract between the buyer and the "security" firm where one signs his privacy away? Especially the screenshot taking would be a concern to me. What if you were working on secret company files while screens are being taken? [1] http://www.ncsl.org/default.aspx?tabid=13494 http://www.ncsl.org/default.aspx?tabid=13494
- amalcon 15y agoI'm sure they've got it in the fine print somewhere. The (commercial) tracking software almost certainly has an EULA, which I'm sure buyers are required to agree to.
- xyzzyz 15y agoThis is fucking outrageous. Imagine what would have ensued if new cars were equipped with concealed GPS tracker, which sends location info to some unknown place, along with pictures taken by hidden camera, without any clue given to owners. I do not give a shit if it actually helps one to recover a stolen laptop, when I am not even told about this, let alone given the possibility to opt out.
- deleted 15y ago[deleted]
- cooldeal 15y agoI think you haven't heard of OnStar, have you?
- trafficlight 15y agoBut it's pretty obvious that your car is equipped with OnStar. Plus, you have to pay for that service.
- xyzzyz 15y agoI actually haven't, but it is not available here where I live.
- pasbesoin 15y agoPrevious discussion (including a few Blackhat links, though I haven't looked at those). http://news.ycombinator.com/item?id=2018703 http://news.ycombinator.com/item?id=2018703
- paulgerhardt 15y agoThat page has been removed from Absolute's website; cache here: http://webcache.googleusercontent.com/search?q=cache:vb0e0b5bfAkJ:www.absolute.com/products/bios-compatibility+absolute+software+bios&cd=1&hl=en&ct=clnk&gl=us&source=www.google.com http://webcache.googleusercontent.com/search?q=cache:vb0e0b5... edit: Or Absolute updated their site map; list here: http://www.absolute.com/en/partners/bios-compatibility.aspx http://www.absolute.com/en/partners/bios-compatibility.aspx
- aphexairlines 15y agoAn incentive to support coreboot/openbios?
- die_sekte 15y agoFound Computrace in my ThinkPad X201's BIOS. However, there's an option to permanently disable it.
- huhtenberg 15y agoIn a defense of Absolute software - I met with them few years ago and they are a fairly large and very technical company, not a bunch of hacks. Their CTO is a guy who wrote QEMM [1] back in 80-90s. Younglings may not know what this is, but it was one of the most impressive and useful bits of software to ever hit MS-DOS. With regards to the CompuTrace - it is their primary product and it has been in the development for quite a while. From what I remember they have went to great pains to standardize the placement of the tracing software on bootable disks, i.e. create an open standard through RFC process with disk/OS vendors and what not. As I said they are not some random hacks, and they fully understand the importance of being open and transparent. In other words, if you want to point a finger here, point it at Toshiba that failed to disclose the placement of ComputTrace on their laptops. Also understand that the software is designed to be hard to detect as its primary usage is tracking, recovery and remote wipe of stolen laptops, hence it being very similar to a rootkit. [1] http://en.wikipedia.org/wiki/QEMM http://en.wikipedia.org/wiki/QEMM
- jitbit 15y agoSorry, but I want to be able to run the CHKDSK tool. No matter how "technical" the company is and how respectful is their CTO. Their software kills the standard "autochk.exe" file, making it impossible to fix basic disk errors.
- danbmil99 15y agoMy black-hat days are behind me, but isn't it SOP to copy a version of the uncorrupted file under another name, and run it when you're done with your cruftiness? Or incorporate the old code into the .exe along with your insertion?
- archivator 15y agoThe fault lies with Toshiba. I have a Dell Studio laptop and CompuTrace is an option in the BIOS - once enabled, it can't be disabled (I haven't actually tried wiping the EEPROM) but it's an option nonetheless.
- rhizome 15y agoThis reflects badly on CompuTrace and they could certainly have taken steps to ensure that Toshiba's use of their tools didn't affect their business prospects. That they have a "Hey, do what you want with it. We don't care." approach to sales makes me wonder who else is buying from them. As above it appears IBM is on the list as well (unverified).
- pyre 15y agoThe funny thing is that if I point a video camera at a police officer in a public space, I'll get charged with 'illegal wiretapping,' but if Toshiba implants a spying device without user knowledge/consent will they get charged with illegal wiretapping? Doubtful. Even though they are 'spying' on customers behind their backs, it will get less punishment than openly filming a police officer in a public space.
- georgieporgie 15y agoI don't think arguments containing implicit assumptions of the form, "if I did X, Y would happen," lead to insight.
- wnoise 15y agoArguments by symmetry are incredibly powerful and useful. Why do you think they don't get to the heart of things? (Granted, X must be chosen so that it is a fair comparison, but when it's not, that choice is what should be attacked, not the structure of the argument.)
- georgieporgie 15y agoWhat's an argument by symmetry? This, "if I X, then Y would happen," setup is dependent upon accepting various preconditions, which go conveniently unmentioned.
- wnoise 15y agoAn argument by symmetry is that something shouldn't change when some irrelevant bit is changed -- such as the identity of the actors. Yes, the preconditions for using "If I X then Y" when trying to argue that "when someone else X', then Y' " is wrong are that X' is relevantly similar enough to X, and Y' is distinctly different than Y.
- mgkimsal 15y agoYou're a private person, Toshiba is a multinational corporation.
- GoodIntentions 15y agoThe Toshiba Satellite sitting beside me is running slackware like a champ. Problem solved ;-)
- gtank 15y agoHow has Absolute ensured that other malware authors won't be able to piggyback off their system? Can my malware add a hosts file entry and cause this data to be sent to my servers instead? Could I replace the Absolute software with a botnet node and still use their nigh-irremovable persistence mechanism? Selling laptops with a pre-installed surveillance framework, however well you meant, is not acceptable. Your software's security is likely no stronger than that of the software you exploit. Should non-technical buyers of electronic devices simply expect to be subject to malicious behavior?
- joe_the_user 15y agoThis is an especially important point and should be at the top of this page. Makes me miss the karma indicators... The problem with arbitrary surveillance isn't just that it's icky, unfair and (hopefully) illegal. It's that it is easily used by criminals.
- Joeri 15y agoYou can ask Absolute to remove it: http://www.ehow.com/how_7683954_disable-computrace-laptop-bios-toshiba.html http://www.ehow.com/how_7683954_disable-computrace-laptop-bi... So, aside from not being informed about it, this isn't a big deal.
- HelloBeautiful 15y agoHow would you react if you find the builder of your home has installed hidden cameras in every single room? If you somehow find about it and call him he'll turn them off. No big deal, right? If you're a proper person you have nothing to hide anyway ...
- brokentone 15y agoWait, just by providing the SN of a device you can get them to modify the BIOS? (assuming that is how they would get rid of this BIOS-executed payload) I wonder what else you can social engineer out of them with just SN. . .
- simcop2387 15y agoPersonally, I wouldn't trust them to not break things myself. I know they may not be "amateurs" at low level things like they do to make this happen, but I still wouldn't trust it. This is why my suggestion would be to use some kind of disk/filesystem encryption. TrueCrypt should be able to defeat them putting it back on and allow you to restore (from a clean copy) the original files and get your CHKDSK back. On another note, I don't think I'd have ever noticed this myself, every laptop I've had I end up installing Linux on because of all the crapware that gets included with the OS in the first place.
- mcantelon 15y agoBlogpost says it actually isn't a "brand new" laptop and Toshiba has since removed the crapware.
- mleonhard 15y agoWhere does it say that? By the way, I purchased a Toshiba T135 last year from Amazon and updated the BIOS several times. I can't find any trace of the CompuTrace backdoor, but I must say that my trust in Toshiba, DELL, and other laptop manufacturers has been severely shaken. This is infuriating.
- StavrosK 15y agoPicking nits here, but this is a trojan (if that, really), not a rootkit, no?
- compuerase38278 15y agohttp://forums.mydigitallife.info/archive/index.php/t-9213.html http://forums.mydigitallife.info/archive/index.php/t-9213.ht... 448675 2011-05-01 Dell.Service.Tag.Editor.iso.rar initial scan seems ok on opensuse LINUX. http://www.coreboot.org/SeaBIOS http://www.coreboot.org/SeaBIOS backup BIOS first call warantee service. IE is frozen with 100% cpu. install anti-virus?? then get rid of the compu ERASE or lojack problem - then, go to warantteee. do it at the beginning before your important pictures are on the computer and been sent to outsource india for compu ERASE
- boscomutunga 15y agoI think this adds to the advantages of using linux and scrapping windows,after all with the security features of linux nothing like this would have happened.