Absolute Home & Office

<h2 id="functionality">Functionality</h2>
Once installed, the Absolute Home & Office agent makes itself persistent by making an initial call to the "Monitoring Center".<a class="footnote-ref" id="fnref:9" href="#fn:9">9</a> The software may be updated by modules, downloaded from a command server.<a class="footnote-ref" id="fnref:10" href="#fn:10">10</a> Subsequent contact occurs daily, checking to ensure the agent remains installed and provides detailed data such as location, user, software, and hardware.
If the device is stolen the owner is able to contact Absolute. Then, the next time the protected device connects to the <a href="/facts/Internet/Xw1rVvJU">internet</a>, it switches to theft mode and accelerates Monitoring Center communication. The Investigations and Recovery team forensically mine the computer using key captures, <a href="/facts/Windows_registry/cH9RlHTp">registry</a> and file scanning, <a href="/facts/Geolocation/yY41HfWV">geolocation</a>, and other investigative techniques. The team works with local law enforcement to recover the protected device, and provides police with evidence to pursue <a href="/facts/Criminal_charges/g9V345nw">criminal charges</a>. In the event of theft, a user can log into their online account to remotely lock the computer or delete sensitive files to avoid <a href="/facts/Identity_theft/WeTNe9DG">identity theft</a>.<a class="footnote-ref" id="fnref:11" href="#fn:11">11</a>
Absolute Home & Office comes preinstalled in some <a href="/facts/Acer_Inc./HQ3INX1c">Acer</a>, <a href="/facts/Asus/134Qobfp">Asus</a>, <a href="/facts/Fujitsu/6e5gvNSa">Fujitsu</a>, <a href="/facts/Panasonic/TqkBQmgj">Panasonic</a>, <a href="/facts/Toshiba/QHRaw8Tr">Toshiba</a>, <a href="/facts/Dell/wLlYNTMM">Dell</a>, <a href="/facts/Hewlett-Packard/abuNSYNu">HP</a> and <a href="/facts/Lenovo/4UNdKGUU">Lenovo</a> machines.<a class="footnote-ref" id="fnref:12" href="#fn:12">12</a> Apple, unlike some other <a href="/facts/Personal_computer/koaYfNce">PC</a> manufacturers, does not allow the software to be installed in the BIOS.<a class="footnote-ref" id="fnref:13" href="#fn:13">13</a> Absolute Home & Office can be installed on Apple computers, but it will be stored on the hard drive instead of the BIOS. If the hard drive is replaced or reformatted, the software will be lost.
The <a href="/facts/BIOS/AYYPUogS">BIOS</a> service is disabled by default and can be enabled by purchasing a license for Absolute Home & Office; upon being enabled, the BIOS will copy a downloader agent named rpcnetp.exe from the BIOS flash ROM to the System32 folder on Windows systems. On some Toshiba laptops, rpcnetp.exe is factory-preinstalled by Toshiba on the unit's hard drive. In turn, rpcnetp.exe will download the full agent software and install the rpcnet.exe <a href="/facts/Windows_service/qzNquuK6">Windows service</a>. From then on, rpcnet.exe will phone home to Absolute Software servers once a day, querying for a possible theft report, and transmitting the results of a system scan, IP address, user- and machine names and location data, which it obtains either by tapping the <a href="/facts/GPS/DKVLnzF3">GPS</a> data stream on machines equipped with GPS hardware, or by triangulating available <a href="/facts/Wireless_LAN/ooq0WA45">WLAN</a> access points in the vicinity, by providing WLAN IDs and signal strengths so Absolute Software servers can geolocate the device using the <a href="/facts/Navizon/YfIfkQ7K">Mexens Technology</a> data base. If Absolute receives a theft report, the service can be remotely commanded to phone home every 15 minutes, install additional 3rd party vendor software, such as a key logger or a forensic package, make <a href="/facts/Screenshot/efJKoKp5">screenshots</a>, and various other actions.
Absolute Home & Office also supports <a href="/facts/Intel/SMF0gJJX">Intel</a>'s <a href="/facts/Intel_vPro/Udgq4Lcj">AT-p</a> anti-theft protection scheme. If it is unable to phone home within a configurable time interval it will require a special BIOS password upon the next reboot. It can be configured to shut down the machine's power supply immediately in this case, to force a reboot.

<h3>Persistence</h3>
The <a href="/facts/Persistence_(computer_science)/frF0o2q2">persistence</a> module, installed as part of system BIOS/UEFI, detects when the Absolute Home & Office software has been removed. It ensures the software is automatically reinstalled even if the hard drive is replaced, or the <a href="/facts/Firmware/62UVKIUK">firmware</a> is flashed. Absolute Software partners with many <a href="/facts/Original_equipment_manufacturer/hmUhIWaS">original equipment manufacturers</a> to embed this technology in the firmware of computers, netbooks, smartphones, and tablets by <a href="/facts/Acer_Inc./HQ3INX1c">Acer</a>, <a href="/facts/ASUS/134Qobfp">ASUS</a>, <a href="/facts/Dell/wLlYNTMM">Dell</a>, <a href="/facts/Fujitsu/6e5gvNSa">Fujitsu</a>, <a href="/facts/Hewlett-Packard/abuNSYNu">HP</a>, <a href="/facts/Lenovo/4UNdKGUU">Lenovo</a>, Motion, <a href="/facts/Panasonic/TqkBQmgj">Panasonic</a>, <a href="/facts/Samsung/oNXUwDjn">Samsung</a> and <a href="/facts/Toshiba/QHRaw8Tr">Toshiba</a>.<a class="footnote-ref" id="fnref:14" href="#fn:14">14</a>

<h2 id="vulnerabilities">Vulnerabilities</h2>
The Absolute Home & Office client has <a href="/facts/Trojan_horse_(computing)/FVqh3nDy">trojan</a> and <a href="/facts/Rootkit/PV3NlgGC">rootkit</a>-like behaviour, but some of its modules have been whitelisted by several antivirus vendors.<a class="footnote-ref" id="fnref:15" href="#fn:15">15</a><a class="footnote-ref" id="fnref:16" href="#fn:16">16</a>
At the <a href="/facts/Black_Hat_Briefings/eUNo4nyK">Black Hat Briefings</a> conference in 2009, researchers showed that the implementation of the Computrace/LoJack agent embedded in the BIOS has vulnerabilities and that this "available control of the anti-theft agent allows a highly dangerous form of BIOS-enhanced rootkit that can bypass all chipset or installation restrictions and reutilize many existing features offered in this kind of software."<a class="footnote-ref" id="fnref:17" href="#fn:17">17</a><a class="footnote-ref" id="fnref:18" href="#fn:18">18</a><a class="footnote-ref" id="fnref:19" href="#fn:19">19</a> Absolute Software rejected the claims made in the research, stating that "the presence of the Computrace module in no way weakens the security of the BIOS". Another independent analyst confirmed the flaws, noted that a malware hijacking attack would be a "highly exotic one", and suggested that the larger concern was that savvy thieves could disable the phone home feature.<a class="footnote-ref" id="fnref:20" href="#fn:20">20</a> Later, Core Security Technologies proved the researcher's finding by making publicly available several proofs of concept, videos, and utilities on its webpage.<a class="footnote-ref" id="fnref:21" href="#fn:21">21</a>
Local and remote exploitation of the first stage CompuTrace agent, which is used to install the full version after activation or reinstallation of the operating system, was demonstrated at BlackHat USA 2014. This dropper agent is whitelisted by several antivirus vendors and can be used to set up some local attacks, for example to download and install software from different servers.<a class="footnote-ref" id="fnref:22" href="#fn:22">22</a> <a href="/facts/ESET/roFfK0Kh">ESET</a> discovered a first attack in the wild with a rootkit called LoJax that infected vulnerable LoJack configurations.<a class="footnote-ref" id="fnref:23" href="#fn:23">23</a>

<h2 id="see-also">See also</h2>
<ul><li><a href="/facts/Prey_(software)/x1dy5hKM">Prey (software)</a></li></ul>

<h2 id="external-links">External links</h2>
<ul><li><a href="http://www.pcworld.com/article/2023756/12-security-resolutions-for-2013.html">11 Security Resolutions for 2013</a> / PCWorld
<ul><li><a href="http://www.pcworld.com/article/251719/how_to_protect_your_laptop.html">How to Protect Your Laptop</a> / PCWorld</li></ul></li>
<li><a href="http://mobileoffice.about.com/od/mobilesecurity/a/lojack-for-laptops-track-and-recover-a-stolen-laptop.htm">Recover a Stolen Laptop with Anti-Theft Software</a> <a href="https://web.archive.org/web/20130511182458/http://mobileoffice.about.com/od/mobilesecurity/a/lojack-for-laptops-track-and-recover-a-stolen-laptop.htm">Archived</a> 2013-05-11 at the <a href="/facts/Wayback_Machine/nmQ3a6JC">Wayback Machine</a> / About.com</li>
<li><a href="https://www.usatoday.com/story/travel/2012/12/18/new-last-minute-gifts-for-business-travelers/1776373/">New last-minute gifts for business travelers</a> / USA Today</li>
<li><a href="http://thinkwiki.de/Computrace">CompuTrace</a> at ThinkWiki (in German)</li>
<li><a href="http://threatpost.com/millions-of-pcs-affected-by-mysterious-computrace-backdoor-2/107700">Millions of PCs Affected by Mysterious Computrace Backdoor</a> / Threatpost, 2014-08-11</li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1">Theft Report White Papers Archived 2013-03-18 at the Wayback Machine. by Absolute Software <a href="http://www.absolute.com/en/resources/whitepapers/theft-report" target="_blank">http://www.absolute.com/en/resources/whitepapers/theft-report</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></li>
<li id="fn:2">David A. Andelman (2005-08-19). "Does LoJack For Laptops Work?". Forbes. Archived from the original on December 19, 2005. <a href="https://web.archive.org/web/20051219090848/http://www.forbes.com/technology/2005/08/19/digilife-lojack-laotops-cx_daa_0819digilife.html" target="_blank">https://web.archive.org/web/20051219090848/http://www.forbes.com/technology/2005/08/19/digilife-lojack-laotops-cx_daa_0819digilife.html</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></li>
<li id="fn:3">LoJack foils laptop theft, Techworld.com <a href="http://techworld.com/security/news/index.cfm?newsID=11882&pagtype=all" target="_blank">http://techworld.com/security/news/index.cfm?newsID=11882&pagtype=all</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></li>
<li id="fn:4">"LoJack for Laptops Software Review by PCMag.com". 2011-06-21. <a href="https://www.pcmag.com/article2/0,2817,2387275,00.asp" target="_blank">https://www.pcmag.com/article2/0,2817,2387275,00.asp</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></li>
<li id="fn:5">"LoJack licenses technology to track stolen computers". Boston Business Journal. June 27, 2005. Retrieved 2009-04-10. <a href="http://www.bizjournals.com/boston/stories/2005/06/27/daily5.html" target="_blank">http://www.bizjournals.com/boston/stories/2005/06/27/daily5.html</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></li>
<li id="fn:6">Absolute Computrace Revisited / SecureList, Vitaly Kamluk, February 12, 2014. <a href="https://securelist.com/absolute-computrace-revisited/58278/" target="_blank">https://securelist.com/absolute-computrace-revisited/58278/</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></li>
<li id="fn:7">Ortega, Alfredo; Sacco, Anibal (2009-07-24). Deactivate the Rootkit: Attacks on BIOS anti-theft technologies (PDF). Black Hat USA 2009 (PDF). Boston, MA: Core Security Technologies. Retrieved 2014-06-12. <a href="https://www.blackhat.com/presentations/bh-usa-09/ORTEGA/BHUSA09-Ortega-DeactivateRootkit-PAPER.pdf" target="_blank">https://www.blackhat.com/presentations/bh-usa-09/ORTEGA/BHUSA09-Ortega-DeactivateRootkit-PAPER.pdf</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></li>
<li id="fn:8">Kamlyuk, Vitaliy; Belov, Sergey; Sacco, Anibal (August 2014). Absolute Backdoor Revisited (PDF). Black Hat USA 2014 (PDF). Las Vegas. Retrieved 2015-01-27. <a href="https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf" target="_blank">https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></li>
<li id="fn:9">Kamlyuk, Vitaliy; Belov, Sergey; Sacco, Anibal (August 2014). Absolute Backdoor Revisited (PDF). Black Hat USA 2014 (PDF). Las Vegas. Retrieved 2015-01-27. <a href="https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf" target="_blank">https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></li>
<li id="fn:10">Kamlyuk, Vitaliy; Belov, Sergey; Sacco, Anibal (August 2014). Absolute Backdoor Revisited (PDF). Black Hat USA 2014 (PDF). Las Vegas. Retrieved 2015-01-27. <a href="https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf" target="_blank">https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></li>
<li id="fn:11">How to keep your laptop from being stolen - by Andrew Nusca for The ToyBox, February 26, 2009 <a href="https://www.zdnet.com/article/how-to-keep-your-laptop-from-being-stolen/" target="_blank">https://www.zdnet.com/article/how-to-keep-your-laptop-from-being-stolen/</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></li>
<li id="fn:12">Absolute Software, Partner: BIOS Compatibility, absolute.com <a href="http://www.absolute.com/en/partners/bios-compatibility.aspx" target="_blank">http://www.absolute.com/en/partners/bios-compatibility.aspx</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></li>
<li id="fn:13">"How can loJack be effective, if i have a password.... someone steals my laptop, they can't login to connect to the internet". Archived from the original on 2012-01-18. Retrieved 2012-06-18. <a href="https://web.archive.org/web/20120118195300/http://store.apple.com/us/question/answers/product/TS294LL/A?pqid=QAHCAFA27C7TYA9UFXUDDJYKJKDCXJFDU" target="_blank">https://web.archive.org/web/20120118195300/http://store.apple.com/us/question/answers/product/TS294LL/A?pqid=QAHCAFA27C7TYA9UFXUDDJYKJKDCXJFDU</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></li>
<li id="fn:14">Absolute CEO Says Growth to Accelerate After Samsung Win / Bloomberg, by Hugo Miller - April 15, 2013 <a href="https://www.bloomberg.com/news/2013-04-15/absolute-ceo-says-growth-to-accelerate-after-samsung-win.html" target="_blank">https://www.bloomberg.com/news/2013-04-15/absolute-ceo-says-growth-to-accelerate-after-samsung-win.html</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></li>
<li id="fn:15">Absolute Computrace Revisited / SecureList, Vitaly Kamluk, February 12, 2014. <a href="https://securelist.com/absolute-computrace-revisited/58278/" target="_blank">https://securelist.com/absolute-computrace-revisited/58278/</a> <a href="#fnref:15" class="footnote-back-ref">↩</a></li>
<li id="fn:16">Kamlyuk, Vitaliy; Belov, Sergey; Sacco, Anibal (August 2014). Absolute Backdoor Revisited (PDF). Black Hat USA 2014 (PDF). Las Vegas. Retrieved 2015-01-27. <a href="https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf" target="_blank">https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf</a> <a href="#fnref:16" class="footnote-back-ref">↩</a></li>
<li id="fn:17">Sacco, Anibal; Alfredo Ortéga. "Deactivate the Rootkit". Exploiting Stuff. Retrieved 2009-10-06. <a href="http://exploiting.wordpress.com/2009/09/11/138/" target="_blank">http://exploiting.wordpress.com/2009/09/11/138/</a> <a href="#fnref:17" class="footnote-back-ref">↩</a></li>
<li id="fn:18">Robertson, Jordan. "Anti-theft software could create security hole". The Associated Press. Archived from the original on 2009-08-08. Retrieved 2009-08-06. <a href="https://web.archive.org/web/20090808013039/http://www.google.com/hostednews/ap/article/ALeqM5gDEcxr3CSkM0RlVSqVzNWlccf6XwD99P33N82" target="_blank">https://web.archive.org/web/20090808013039/http://www.google.com/hostednews/ap/article/ALeqM5gDEcxr3CSkM0RlVSqVzNWlccf6XwD99P33N82</a> <a href="#fnref:18" class="footnote-back-ref">↩</a></li>
<li id="fn:19">Sacco, Anibal; Alfredo Ortéga. "Deactivate the Rootkit". Black Hat Briefings. Archived from the original on 2011-07-08. Retrieved 2009-08-06. <a href="https://web.archive.org/web/20110708193041/http://www.coresecurity.com/content/Deactivate-the-Rootkit" target="_blank">https://web.archive.org/web/20110708193041/http://www.coresecurity.com/content/Deactivate-the-Rootkit</a> <a href="#fnref:19" class="footnote-back-ref">↩</a></li>
<li id="fn:20">"Absolute Software downplays BIOS rootkit claims". ZDNet. Archived from the original on 2012-10-14. Retrieved 2009-08-20. <a href="https://web.archive.org/web/20121014052719/http://www.zdnet.com/blog/security/absolute-software-downplays-bios-rootkit-claims/3936" target="_blank">https://web.archive.org/web/20121014052719/http://www.zdnet.com/blog/security/absolute-software-downplays-bios-rootkit-claims/3936</a> <a href="#fnref:20" class="footnote-back-ref">↩</a></li>
<li id="fn:21">Sacco, Anibal; Alfredo Ortéga. "Deactivate the Rootkit". Core Security Technologies. Retrieved 2009-09-08. <a href="http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=publication&name=Deactivate_the_Rootkit" target="_blank">http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=publication&name=Deactivate_the_Rootkit</a> <a href="#fnref:21" class="footnote-back-ref">↩</a></li>
<li id="fn:22">Kamlyuk, Vitaliy; Belov, Sergey; Sacco, Anibal (August 2014). Absolute Backdoor Revisited (PDF). Black Hat USA 2014 (PDF). Las Vegas. Retrieved 2015-01-27. <a href="https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf" target="_blank">https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf</a> <a href="#fnref:22" class="footnote-back-ref">↩</a></li>
<li id="fn:23">LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group, WeLiveSecurity by ESET, 2018-09-27 <a href="https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/" target="_blank">https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/</a> <a href="#fnref:23" class="footnote-back-ref">↩</a></li>
</ol>

Absolute Home & Office open-in-new

Absolute Home & Office