#Absolute lojack code software
#Absolute lojack code code

The Netscout report contains file signatures for the rogue LoJack samples as well as domain names and other indicators of compromise. Finally, Lojack’s ‘small agent’ allows for memory reads and writes which grant it remote backdoor functionality when coupled with a rogue C2 server.” “The attacker simply needs to stand up a rogue C2 server that simulates the Lojack communication protocols. “With low AV detection, the attacker now has an executable hiding in plain sight, a double-agent,” the Netscout researchers said.

LoJack users who willingly turned on the feature on their computers are also likely to have whitelisted the agent in their security products. The LoJack agent is whitelisted by default by many antivirus programs, and those that do detect it flag it as “not-a-virus” or “Risk Tool” instead of malware. It seems that four years later, cyberespionage groups are taking advantage of this powerful functionality that’s present on many devices and is both persistent and stealthy. “The protocol doesn’t use any encryption or authorization with the remote server, which creates numerous opportunities for remote attacks in a hostile network environment.”

#Absolute lojack code code

“The protocol used by the Small Agent provides the basic feature of remote code execution,” the researchers warned in a blog post at the time.

#Absolute lojack code software

They pointed out that its small Windows software agent could easily be modified to make it connect to a rogue server. In 2014, security researchers from Kaspersky Lab published a paper showing how Absolute’s Computrace technology could be abused to serve as a backdoor. Security researchers from Netscout’s Arbor division have come across five instances of the LoJack software agent that were communicating with four suspicious domain names, three of which have been associated in the past with Fancy Bear’s cyberespionage operations. This service then connects to a remote server controlled by Absolute Software and installs the theft recovery agent.

The BIOS/UEFI component injects a small software agent into Windows and registers it as a system service. This means that it survives even OS reinstalls and hard disk drive replacements. The technology stands apart because it has components embedded in BIOS/UEFI firmware through partnerships with computer manufacturers.