Comment Absolute refrutes Computrace BIOS vulnerability (Score 1) 236
I work for Absolute Software. Absolute reviewed the research paper, and the claims that there's a vulnerability in Computrace or Computrace LoJack for Laptops BIOS module are without merit and systems are secure:
- The Computrace BIOS module does not allow a special undetected path into the operating system. It is not a rootkit.
- In order for the Computrace BIOS module to work, it is activated by the end-user customer, not the computer manufacturer, upon receipt of the computer and activation of Absolute Software's products.
- The Computrace BIOS code alleged in the article to have this vulnerability is old code that was not officially released into a BIOS and, to Absolute's knowledge, has never been active in the BIOS of any computer.
- If a malicious attacker were able to alter the BIOS code, any popular anti-virus software would alert the customer.
- The Computrace BIOS module currently on the market is not susceptible to the risks claimed in the article and therefore none of our customers are at risk for this specific type of attack.
Absolute has issued a statement to the public, refuting these claims and explaining their position at length here: http://www.absolute.com/company/pressroom/news/2009/07/refutes_claim
- The Computrace BIOS module does not allow a special undetected path into the operating system. It is not a rootkit.
- In order for the Computrace BIOS module to work, it is activated by the end-user customer, not the computer manufacturer, upon receipt of the computer and activation of Absolute Software's products.
- The Computrace BIOS code alleged in the article to have this vulnerability is old code that was not officially released into a BIOS and, to Absolute's knowledge, has never been active in the BIOS of any computer.
- If a malicious attacker were able to alter the BIOS code, any popular anti-virus software would alert the customer.
- The Computrace BIOS module currently on the market is not susceptible to the risks claimed in the article and therefore none of our customers are at risk for this specific type of attack.
Absolute has issued a statement to the public, refuting these claims and explaining their position at length here: http://www.absolute.com/company/pressroom/news/2009/07/refutes_claim
