Главная
Study mode:
on
1
Intro
2
Where is Computrace?
3
Why this research?
4
How does it work?
5
Suspicious Behavior
6
VT Detection Rate
7
Attacks on Protocol
8
Small Agent Protocol
9
Communication explained
10
Vulnerable Protocol Design
11
Demo Environment
12
Main Agent (rpcnet.exe)
13
Main Agent Communication
14
Vulnerable Protection Mechanism
15
Local attacks - Configuration Block
16
How to detect Computrace?
17
How about network detection?
18
Who activated Computrace?
19
How to deactivate Computrace?
20
Some advice
21
Similar Case: Radmin
Description:
Explore the security vulnerabilities in modern anti-theft technologies embedded in firmware and PC BIOS of popular laptops and desktop computers. Delve into the potential misuse of Absolute Computrace anti-theft software as an advanced removal-resistant BIOS-based backdoor. Learn about unauthorized activations, network security flaws, and how to exploit remote hosts running Computrace. Discover the inner workings of Computrace, including its suspicious behavior, detection rates, and protocol attacks. Examine the vulnerable protocol design, demo environment, and communication methods of the main agent. Understand local attacks on the configuration block and learn how to detect and deactivate Computrace. Gain insights into similar cases like Radmin and receive practical advice for protecting against these security risks.

Computrace Backdoor Revisited

Black Hat
Add to list