Computrace developer slams Kaspersky report as inaccurate

The developer of the Computrace anti-theft mechanism shipped with millions of PCs which was recently claimed to be vulnerable to remote hijacking has rubbished the report as inaccurate and based on old research.

Absolute Software chief technology officer Phil Gardner told iTnews the Computrace analysis by security vendor Kaspersky was flawed, and his company had not been contacted to verify the findings.

Allowing vendors whose products are affected time to test and remedy problems before publication is the customary process for newly-discovered security issues.

"We’ve reviewed the report ... and we are unable to determine how Kaspersky was able to reach the conclusions they provide," Gardner said.

Kaspersky had found the software could be compromised remotely and used to hijack devices and wipe them.

Gardner said there was no transmission in clear text of any data and the software agent requires authentication. Nor can external attacks take place as the communication is encrypted and authenticated - the encryption would have to be broken first, Gardner said.

He said Computrace does not hide itself from anti-virus software, nor is it a root kit that rejects an administrator's commands to stop functioning or be deleted.

Computrace is only pre-activated under certain scenarios when the customer requests it as a time-saving measure, the company states. It cannot be activated without a customer's knowledge and is always under the control of an administrator.

Kaspersky appears to have based its report on prior research presented at the Black Hat security conference in 2009, which Absolute Software said was conducted with an unreleased code module that could not be activated and therefore was unable to be exploited by attackers.

Absolute Software noted Kaspersky has not shown any evidence of a successful attack on Computrace, or use it as a platform for other attacks such as delivery of spyware.

Update 10:50am: Kaspersky said in a statement it had contacted Absolute Software on February 3 with a draft version of the paper but received no response.

"Although Absolute Computrace is a legitimate software, due to security weaknesses it can be used not as a protection tool, but as an instrument for cyber attacks," it said.

"As a security company we believe it’s our job to warn people about potential serious risks hidden in Absolute Computrace."