EUVD-2009-5106

Malware in sbrugna...

Pentagon Draws Back the Veil on APT Malware with Sudden Embrace of VirusTotal

The Pentagon has suddenly started uploading malware samples from APTs and other nation-state sources to the website VirusTotal, which is essentially a malware zoo that’s used by security pros and antivirus/malware detection engines to gain a better understanding of the threat landscape. The Cyber...

LoJack for computers used to attack European government bodies

Security researchers have detected the first known instance of a UEFI bootkit being used in targeted campaigns against government entities across Central and Eastern Europe. The attack focuses on UFEI-enabled computers and relies on a persistence mechanism that has been stolen from a legitimate,...

Absolute Computrace Agent stub component code execution vulnerability

Absolute Computrace Agent is an agent program for monitoring computer systems. A security vulnerability exists in the stub component of Absolute Computrace Agent version 70.785, which can be exploited to allow the program to execute certain code without a digital signature. A remote attacker can...

Dell Inspiron systems Absolute Computrace Agent Competitive Condition Vulnerability

Dell Inspiron systems is a set of BIOS systems for the Spirit Series from Dell, U.S.A. Absolute Computrace Agent is one of the agent programs used to monitor computer systems. A competitive condition vulnerability exists in Dell Inspiron systems 2009 and prior versions of Absolute Computrace Agen...

Absolute Computrace Agent Code Execution Vulnerability

Absolute Computrace Agent is an agent program for monitoring computer systems. A security vulnerability exists in Absolute Computrace Agent versions 80.845 and 80.866 that stems from the program's failure to use digital signatures for configuration blocks. An attacker could exploit the...

Design/Logic Flaw

The stub component of Absolute Computrace Agent V70.785 executes code from a disk's inter-partition space without requiring a digital signature for that code, which allows attackers to execute code on the BIOS. This allows a privileged local user to achieve persistent control of BIOS behavior,...

CVE-2009-5151

The stub component of Absolute Computrace Agent V70.785 executes code from a disk's inter-partition space without requiring a digital signature for that code, which allows attackers to execute code on the BIOS. This allows a privileged local user to achieve persistent control of BIOS behavior,...

CVE-2009-5150

Absolute Computrace Agent V80.845 and V80.866 does not have a digital signature for the configuration block, which allows attackers to set up communication with a web site other than the intended search.namequery.com site by modifying data within a disk's inter-partition space. This allows a...

Design/Logic Flaw

Absolute Computrace Agent V80.845 and V80.866 does not have a digital signature for the configuration block, which allows attackers to set up communication with a web site other than the intended search.namequery.com site by modifying data within a disk's inter-partition space. This allows a...

Race condition

Absolute Computrace Agent, as distributed on certain Dell Inspiron systems through 2009, has a race condition with the Dell Client Configuration Utility DCCU, which allows privileged local users to change Computrace Agent's activation/deactivation status to the factory default via a crafted...

CVE-2009-5152

Absolute Computrace Agent, as distributed on certain Dell Inspiron systems through 2009, has a race condition with the Dell Client Configuration Utility DCCU, which allows privileged local users to change Computrace Agent's activation/deactivation status to the factory default via a crafted...

CVE-2009-5152

Absolute Computrace Agent, as distributed on certain Dell Inspiron systems through 2009, has a race condition with the Dell Client Configuration Utility DCCU, which allows privileged local users to change Computrace Agent's activation/deactivation status to the factory default via a crafted...

CVE-2009-5150

Absolute Computrace Agent V80.845 and V80.866 does not have a digital signature for the configuration block, which allows attackers to set up communication with a web site other than the intended search.namequery.com site by modifying data within a disk's inter-partition space. This allows a...

CVE-2009-5152

CVE-2009-5152 affects Absolute Computrace Agent on certain Dell Inspiron systems through 2009, due to a race condition with the Dell Client Configuration Utility (DCCU). The vulnerability permits privileged local users to alter the Computrace Agent’s activation/deactivation status back to factory...

CVE-2009-5151

The CVE-2009-5151 entry concerns the Absolute Computrace Agent, specifically its stub component in V70.785. The vulnerability enables code execution from a disk inter-partition space without requiring a digital signature, allowing a local privileged attacker to influence BIOS behavior and maintai...

CVE-2009-5150

Absolute Computrace Agent V80.845 and V80.866 are affected due to the configuration block lacking a digital signature. An attacker could modify data within the disk’s inter-partition space to redirect communication to a site other than the intended search.namequery.com, enabling a privileged loca...

Computrace Detection

Binary data computraceinstalled.nbin...

Dennis Fisher and Mike Mimoso Wrap Up Black Hat and DEF CON 2014

Dennis Fisher and Mike Mimoso look back on the news from the last week in Las Vegas at Black Hat and DEF CON, including the Blackphone rooting, the Computrace research and the more upbeat mood at the conferences this year. Download: digitalunderground162.mp3 Music by Chris Gonsalves Image via Bla...

Millions of PCs Affected by Mysterious Computrace Backdoor

UPDATE: A previous version of this story incorrectly stated that Anibal Sacco works for Core Security. Sacco left Core Security last year to start Cubica Labs. LAS VEGAS – Nearly every PC has an anti-theft product called Computrace embedded in its BIOS PCI Optional ROM or its unified extensible...