[coreboot] coreboot & Absolute "Computrace"

[David Potocnik]

Hi,

What is the coreboot view of the Absolute "Computrace" ware?

If it is set to "Enabled" in the stock BIOS of a machine, and has an active
subscription - the options to "Disable" and "Permanently Disable" are not
accessible. Is it possible to remove/defuse this whole thing with a
Coreboot flash?

I am asking as I saw an auction for a number of Thinkpad X230's, noted to
be sold with the Absolute system enabled. Some forum posts suggest the only
way to disable an activated system like this is to contact the Absolute
company, get them to contact the "original owner" of the machine, then, if
they'll able to reach them, disable the ware from their end. Then, your
machine is to be left running online "for some time" (in Windows, but also
Debian is said to be "supported"!), and when the ware phones home next,
will discover its new state, and unlock the BIOS option to "Permanently
Disable" (wipe) it's own code.

I'm very interested if flashing Coreboot would clean this up, as well as
technical details about how the peculiar Absolute thing operates.

Thank you all and kind regards,
David

[Peter Stuge]

Is it possible to remove/defuse this whole thing with a Coreboot flash?

That depends on the..

technical details about how the peculiar Absolute thing operates.

..which I don't know. Here are some conditions:

If the Computrace thing is implemented exclusively in BIOS/UEFI then
yes, it is replaced by flashing coreboot.

But if the Computrace thing is implemented in part through a ME module
then no, it would not be completely replaced by coreboot per se, but
perhaps you could use me_cleaner to remove such a Computrace ME module
(if there is one), and combined with coreboot replacing BIOS/UEFI then
you would have removed all of it.

It seems likely that you could get rid of it, but you should look for
those technical details.


//Peter

[Angel Pons]

Hello,

I saw an auction for a number of Thinkpad X230's, noted to be sold with the Absolute system enabled.

It could be those laptops have been stolen. I'd take this possibility
into account, especially if it's an auction (listing is mostly
guaranteed to be short-lived).

Is it possible to remove/defuse this whole thing with a Coreboot flash?

That depends on the..

technical details about how the peculiar Absolute thing operates.

If the Computrace thing is implemented exclusively in BIOS/UEFI then
yes, it is replaced by flashing coreboot.

As far as I have seen, this Computrace thing is a UEFI DXE module.
With this in mind, I believe some "features" of Computrace can be
rendered unfunctional just by removing said DXE module, but I haven't
tested anything.

But if the Computrace thing is implemented in part through a ME module
then no, it would not be completely replaced by coreboot per se, but
perhaps you could use me_cleaner to remove such a Computrace ME module
(if there is one), and combined with coreboot replacing BIOS/UEFI then
you would have removed all of it.

I have seen that Computrace can pair with the ME to lock down the
computer even more. It could be that the ME has specific code for
Computrace, in which case replacing the ME firmware with a clean copy
(either use a compatible ME firmware or run me_cleaner on the original
one) should work.

Regards,

Angel Pons Pons