Computrace Backdoor Revisited
summary
Firmware‑resident RPCnetP/RPCnet instances persistently reinstall a Windows service, accept unauthenticated commands and implement simple memory read/write primitives that permit remote code execution; protocol uses an inefficient blob of 150 KB over hundreds of HTTP POSTs with a trivial XOR/1‑byte checksum and config in registry. A man‑in‑the‑middle demo uses Wireshark, netcat and patched configs to upload an executable that enables the webcam and another that triggers a BSOD; antivirus vendors white‑list the agent, an estimated >2 million devices ship with it, and Yara/Snort rules are provided to detect it.
AI-written summary · about
chapters (21)
- 0:00Intro
- 1:04Where is Computrace?
- 2:51Why this research?
- 4:24How does it work?
- 5:54Suspicious Behavior
- 6:51VT Detection Rate
- 10:47Attacks on Protocol
- 12:10Small Agent Protocol
- 13:51Communication explained
- 15:04Vulnerable Protocol Design
- 15:42Demo Environment
- 24:13Main Agent (rpcnet.exe)
- 26:05Main Agent Communication
- 26:56Vulnerable Protection Mechanism
- 35:15Local attacks - Configuration Block
- 52:01How to detect Computrace?
- 52:33How about network detection?
- 53:03Who activated Computrace?
- 56:41How to deactivate Computrace?
- 57:57Some advice
- 58:29Similar Case: Radmin
related talks
39mREDIScovering HeadCrab - A Technical Analysis of a Novel Malware and the Mind Behind It
42mMac-ing Sense of the 3CX Supply Chain Attack: Analysis of the macOS Payloads
49mThe Remote Malicious Butler Did It!
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
45mOutside the box: pwning IoT devices through their applications
45mPwning and Defending AI Agent Code Interpreters (Kinnaird McQuade)
44mCritical Zero Days Remotely Compromise the Most Popular Real-Time OS
29mMalware Development: Asynchronous Backdoor Built on Public APIs