#Computrace x absolute lojack driver
#Computrace x absolute lojack software
#Computrace x absolute lojack free

“In cases of LoJax compromise, traces of other Sednit tools were never far away,” the researchers said. To differentiate between the legitimate anti-theft technology and the trojanized version, ESET refers to APT28’s UEFI rootkit as LoJax. On systems where SPI was protected, the attackers attempted to exploit a vulnerability known since 2015 that can be used to bypass those restrictions. The hackers used a second tool to save an image of the system’s firmware, which they then modified to include their malicious module and tried to flash it back to the system with a third tool.

#Computrace x absolute lojack driver

This driver can be used to read information about a computer’s low-level settings and was used to determine if the SPI flash was protected or not.

#Computrace x absolute lojack free

However, enabling these protections is up to OEMs and, unfortunately, misconfigured platforms that allows SPI flashing are not uncommon.Īccording to ESET’s research, on select targets, APT28 used a digitally-signed kernel driver called RwDrv.sys that’s part of a free utility called RWEverything. “Moreover, cleaning a system’s UEFI firmware means re-flashing it, an operation not commonly done and certainly not by the typical user.”Ī computer’s SPI flash memory where the UEFI resides should normally be protected against arbitrary write attempts from inside the OS. “This persistence method is particularly invasive as it will not only survive an OS reinstall, but also a hard disk replacement,” the researchers said in a new blog post. Researchers from antivirus firm ESET have now found evidence that APT28 not only modified and abused the LoJack Windows agent, but at least in one case, they also successfully wrote a malicious UEFI module into the system’s firmware and used it to drop and execute malware during the boot process. Once turned on by users, the low-level module ensures that the Windows agent gets reinstalled even if the hard drive is wiped.

#Computrace x absolute lojack software

LoJack/Computrace has two components: A software agent for Windows that communicates with Absolute’s service and allows users to perform operations on their stolen devices and a UEFI module that computer manufacturers preload in firmware. Earlier this year, those fears came true, when researchers from Arbor Networks found samples of the LoJack Windows software agent that had been modified to communicate with a command-and-control server associated with APT28, instead of the legitimate server run by Absolute.

Security researchers from Kaspersky Lab warned since 2014 that the Computrace technology can be modified to act as a malicious backdoor. Once enabled by users, it allows laptop owners to remotely locate, lock and wipe their devices in case they’re stolen or lost. They attribute the attacks to the a notorious Russian cyberespionage group known as APT28, Fancy Bear or Sednit.Ībsolute LoJack, previously known as Computrace, is a highly persistent software that’s preloaded on many laptops and is embedded in their low-level UEFI/BIOS code. Security researchers have found malicious versions of the LoJack anti-theft software on computers belonging to government agencies from the Balkans and Central and Eastern Europe.