Trash-picked Dell Studio XPS 1340 & Computrace rant

Q: What's the difference between Computrace and a computer virus?
A: Computrace never got their spreading routine to work.
I don't usually like post-2006 laptops, but this little Dell really has a nice feature set. It's got a high-end CPU for its age, a dedicated GPU, a really sturdy metal frame, and a generally solid feel to it. It's just a shame that they couldn't stay away from the cancer that is touch buttons, and the desire to run a battery monopoly. Cheeky buggers.
--
THIS VIDEO IS RELEASED TO THE PUBLIC DOMAIN
To the extent possible under law, I have waived all copyright and related or neighbouring rights to this work, according to the Creative Commons CC0 affirmer. This means that anyone is free to use this content in any manner they see fit, without my objection. However, the video may still contain copyrighted content (images, video, audio, software, etc.) that does not belong to me. WHILE I DO NOT RESERVE THE RIGHTS OF ANY PART OF THIS VIDEO, THE COPYRIGHT OF THIRD-PARTY CONTENT STILL BELONGS TO ITS RESPECTIVE OWNERS. THE COPYRIGHT OF THIRD-PARTY CONTENT IS NOT WAIVED. THE VIDEO IS PROVIDED AS-IS, AND I DO NOT PROVIDE ANY GUARANTEE OF ITS QUALITY.

[@PinguimFU]

I am curious as to what would happen if you run Linux on that machine if the rootkit would still be able to run

[@09mpotato]

Gabriel Paiva ii

[@vista9434]

CompuTrace still works with Linux so the best you can do is to call Absolute Software to remove it and then disable it in the BIOS (if you don't want to use Libreboot or Coreboot)

[@nkolvek32]

I had wondered this myself when I was hacking the system back in 2010. I have dated papers I posted to Google Buzz on this system and how I went about defeating it. I never got around to testing my OS injection theory in Linux because it only took me 4 days to find a way to exploit the system and disable it permanently.

[@sheilaburrowes9081]

@@nkolvek32 Do you still have a copy of your papers uploaded anywhere? I'd be very interested in reading them. Thanks!

[@a.f.atecnologia4799]

Can I replace this Core 2 Duo processor with another one on this Dell XPS??? And what is the maximum memory size that I can put in it and what type of DDR3 memory?? Please answer these questions, I have one and I want to upgrade the processor and memory, it is working perfectly

[@TheTechyLuke]

On the Dell laptops that I've worked on Computrace is not activated from the factory, the user can choose to activate it or disable it, but once you activate or disable it, then you can't touch it again

[@EthanLeitch]

Just ended up with one of these. I totally agree with your points about the keyboard and other design flaws. Overall it's a pretty cool laptop though, the Gefore 9500M GS chipset has an 8200 and 8400m in SLI in high performance mode. I've also upgraded the CPU from a P9500 to a T9800 which has sped it up a bit and works flawlessly. It runs really nicely with Windows 7 on an SSD, I really just use it for simple older games because it's got a nice feeling keyboard, great I/O, and a good screen.

[@HeroRareheart]

Things I learned today; 1. What the Computrace option in the BIOS of all the computers I have is 2. I need to repaste everyaingle laptop I've ever pasted as Artic Silver is my paste of choice.

[@SilberRegen]

Watching on my Dell Studio XPS 1340. Kinda weird :D Used it for everything including gaming from 2009 to 2013. Now it's my backup when I'm visiting family. Running Ubuntu 16.04. The thermals always were horrible, even cleaned out regularly and the standard battery's life sucked. It's pretty much impossible to keep it neat looking as the shiny surface and the keys collect grime and dust like crazy. The performance was nice though, even did some videoediting and rendering stuff with it.

[@MrGeforcerFX]

did yours have the Hybrid SLI or just the 9400m graphics? If it has the hybrid SLI any luck getting that to work in ubuntu or being able to pick the discrete over the integrated? Curious as i am thinking of moving mine to Ubuntu when windows 7 support expires.

[@r4microds]

parents had a similar issue with their sell studio with a LEGIT original battery unable to charge after a about a year or two. always disliked Dell for antics like this. never had such an issue with IBM/Lenovo

[@SudosFTW]

you can get a BIOS mod done that removes the computrace section thereby disabling the hardware, last I heard. yours especially since it's a run-of-the-mill Dell-branded-splash Phoenix BIOS instead of the Dell "special" BIOS. installing Linux also completely takes care of the issue, obviously. bios-mods.com and mydigitallife are two places to start checking for information on this, and bios-mods even has some downloadable tools for such things such as Phoenix BIOS editor; but there are newer versions out there you have to get from places such as rom.by amongst other sites. if I acquired a laptop from my friend who deals with scrap metal, with computrace perma-activated on it, and I couldn't do either of the above, and it's of decent specs, I'd just reload it disconnected from the network and have him sell it. it'd be up to the next "poor sap" to deal with it; I don't want any of that crap on my computer. his working laptops usually get sold to a man who buys from the US and sells to places in Egypt and some third-world countries. I don't think having computrace perma-activated in those countries would be too much of an issue, especially if the sale of the laptops as scrap to my friend was legit in the first place as it always is. it's still recycling; just in the powered way instead of the scrap heap way. my T500 came with it disabled, I was lucky enough to find I could permanently disable it and the few other anti-whatever things it had accomodations for in the BIOS. I forget what they were off the top of my head but that just goes to show how much of a problem they aren't when you disable them from the get-go.

[@nkolvek32]

The problem with simply writing it out of the update flash is hash checking. If it doesn't match it will brick the laptop. I found an easier way around the problem back in 2010 and still have a partial write-up on how I went about detecting it and disabling it but can still recount everything i did from start to finish. Took me 4 days to find a way around the problem when nothing really existed in the public domain about doing it. Not even POC code or tools from the 2 groups that defeated it before me. All 3 of us took different directions in attacking the system. Yet you are correct, I had looked at using junk code within the option.rom to corrupt the area in the bios it was written to or using and editor and simply removing the option.rom from the bios update all together. Since I'm not a coder I had decided on another route in case either the bios flash didn't work, bricked the laptop or just removing the option.rom from the bios update didn't remove or disable the system.

[@albertlagerman]

lol my first laptop was a dell inspiron n5110, and when I was messing around in the bios, I was like wtf is compute-race? Well now like 5 years later, I know lol.

[@DerpProductionz]

6:47 "faptop"

[@JacobTechShit]

once you enable computrace, it is permanently enabled so that if it is stolen, the robber can't disable it

[@herrfaust2020]

Exactly. I don't know what this guy (the video author) is complaining about. If Computrace can be deactivated by anyone, what would be the point of it?

[@Slot1Gamer]

apparently computrace can exploited " Computrace does not enforce encryption when it communicates and it does not verify the identity of the remote server from which it receives commands. "

[@FFcossag]

+Slot1Gamer Well, that's lovely.

[@Slot1Gamer]

FFcossag have you tried dumping the bios using a programmer

[@FFcossag]

Slot1Gamer No, I haven't. I'm not good enough a software hacker to be playing with that kind of stuff.

[@Slot1Gamer]

FFcossag neither am I haha :) I wonder what would happen if you simply erased the bios externally and wrote back on a fresh copy. Maybe poked around with a hex editor and zero'd out all serial numbers. Surely computrace just pairs board serial numbers with accounts.. You could also block connections to all known computrace IP's using the windows hosts file (there is a small .net application that automatically does this)

[@alfoncejean8826]

Slot1Gamer WHAT???? "dose not verify the identity of the remote server" that has to not be true! How can they even exist anymore.

[@charlesturner897]

"Faptop" well well well, you've been rumbled

[@FFcossag]

+charles turner I must disappoint, that's just my crude sense of humour in lack of imagination - FAPTOP the 2003-ish era Dell Inspiron that I use for various industrial stuff around the shop. It has way too good connectivity to be wasted on porn.

[@EvilTurkeySlices]

Thanks for telling me about this, just disabled computrace from my Dell computer.(it was deactivated, but I put it on disabled)

[@4833504F]

relevant recent 32c3 talk: kzbin.info/www/bejne/fmfFe2iYbamapcU

[@windows2keverything641]

i have one of these to and the side things pop off

[@RupertHandford]

May be a hardware fault with current sensing if anything like a MacBook

[@FFcossag]

+rupert handford In relation to the battery not being identified? I'd wager those issues mostly have to do with the very poorly implemented battery out of China. Not even the percentage counter works, and the discharge power is stuck at 11 mW - which does cause the amusing effect of letting the computer think it's about to run for a few hundred days on battery.

[@kwils6685]

If you didn't like Computrace you must love Windows 10!

[@stvpls]

i love windows 7 not that crappy Windows 10

[@JohnGotts]

Laptop keyboards are really cheap. When they get grungy, just get a new one.

[@FFcossag]

+John Gotts As the guy who keeps picking stuff out of the trash, replacing things isn't really my preferred solution to a problem - although you probably do have a point.

[@irrisorie]

my 2 free optiplexes have computrace disabled! :D

[@FFcossag]

Computrace can't be properly disabled if it's in the system. It's still there, it still loads its malware into RAM, it's merely instructed not to do anything. Think of it as a burglar who's asked nicely not to steal your shit.

[@irrisorie]

FFcossag :/

[@volodumurkalunyak4651]

have you tried installing sypervisor password in bios settings, than reboot and changing computrance stuatus to disable in same bios settings? After that supervisor password is no needed anymore, it can be removed. I remember not seeing computrance (it launches 32bit svchost.exe that is easy to detect in 64 bit os) in windows os after that. I can't remember if I removed it's executables from hard drive after that

[@FFcossag]

Volodumur Kalunyak The trick to killing it is to tamper with the executables and change permissions so that Computrace can't overwrite them.

[@volodumurkalunyak4651]

FFcossag if it is possible to block starting prcnet.exe and rpcnetp.exe in registry. Like that www.howtogeek.com/180803/how-to-block-an-application-or-.exe-from-running-in-windows/

[@zac1976]

Hello brother can you show us or tell us how to slove HP Error (90D) please like good video and channel

[@ballykaur8310]

you are so funny where are you from

[@FFcossag]

Glad to entertain, I'm from Finland.

[@ballykaur8310]

wow, i am from uk and love your show and i love i am doing my A+ do you think it's good

[@Al-zr4qx]

Hey

[@ballykaur8310]

hi just like the way you talk really posh

[@alexramos2568]

Install Linux

[@bufferjoetommas]

y2021: i have predator helios 300. somehow behaves VERY strange. malwarebytes says everythings ok, but it isnt. intel chipsec tells me old computracce backdoor looks fishy....so what happened? Putin himself did stealthaction into my bios and opened up russian disco, so lots of people in tracksuits drinking wodka in my spi-flash now and wont go. the guy i hired to watch that backdoor, called intel sgx, fell asleep and is still sleeping. now i have linux-only gaming laptop...hallelujah