David Potocnik wrote:
Is it possible to remove/defuse this whole thing with a Coreboot flash?
That depends on the..
technical details about how the peculiar Absolute thing operates.
..which I don't know. Here are some conditions:
If the Computrace thing is implemented exclusively in BIOS/UEFI then yes, it is replaced by flashing coreboot.
But if the Computrace thing is implemented in part through a ME module then no, it would not be completely replaced by coreboot per se, but perhaps you could use me_cleaner to remove such a Computrace ME module (if there is one), and combined with coreboot replacing BIOS/UEFI then you would have removed all of it.
It seems likely that you could get rid of it, but you should look for those technical details.
//Peter
Hello,
On Thu, Nov 22, 2018 at 7:53 PM David Potocnik david@middlemachine.com wrote:
I saw an auction for a number of Thinkpad X230's, noted to be sold with the Absolute system enabled.
It could be those laptops have been stolen. I'd take this possibility into account, especially if it's an auction (listing is mostly guaranteed to be short-lived).
On Thu, Nov 22, 2018 at 8:36 PM Peter Stuge peter@stuge.se wrote:
David Potocnik wrote:
Is it possible to remove/defuse this whole thing with a Coreboot flash?
That depends on the..
technical details about how the peculiar Absolute thing operates.
..which I don't know. Here are some conditions:
If the Computrace thing is implemented exclusively in BIOS/UEFI then yes, it is replaced by flashing coreboot.
As far as I have seen, this Computrace thing is a UEFI DXE module. With this in mind, I believe some "features" of Computrace can be rendered unfunctional just by removing said DXE module, but I haven't tested anything.
But if the Computrace thing is implemented in part through a ME module then no, it would not be completely replaced by coreboot per se, but perhaps you could use me_cleaner to remove such a Computrace ME module (if there is one), and combined with coreboot replacing BIOS/UEFI then you would have removed all of it.
I have seen that Computrace can pair with the ME to lock down the computer even more. It could be that the ME has specific code for Computrace, in which case replacing the ME firmware with a clean copy (either use a compatible ME firmware or run me_cleaner on the original one) should work.
Regards,
Angel Pons Pons
-
Angel Pons -
Peter Stuge