A PC searching technology on your laptop exposes your computer to big hack

According to research by Alfredo Ortega and Anibal Sacco with Boston-based Core Security Technologies, a piece of anti-theft software built into many laptops of the biggest PC makers creates a serious security hole. The "Computrace" software, made by Vancouver-based Absolute Software Corp., is part of a subscription service that's used to find lost or stolen computers. The software is included in a part of the computer known as the BIOS, which refers to programs used to boot the computer.

The service offered by Absolute can be valuable because sensitive data can be purged remotely from a stolen machine. The computer is still able to reach out to a specially designated Web site for instructions even if a criminal is tampering with the machine. The research presented Thursday at the Black Hat security conference reveals it can cut two ways. If a criminal has infected a computer that has the Computrace technology, he can take deep control of a machine. That's because he's able to modify the computer's settings to maintain a connection with that machine even if the operating software is uninstalled then reinstalled - an extreme way, but sometimes the only way, to make sure a computer is cleaned of viruses.

Nevertheless, Core Security's chief technology officer Ivan Arce said that Absolute can fix the problem with an update to the software that is then pushed out to affected computers. Besides, he added that users can disable the software's ability to be a problem on their own, although it takes some technical know-how.

The vulnerabilities, that Core Security found, could be a "pretty big challenge for the security community" if they're exploited, said a senior antivirus researcher with Kaspersky Lab, Roel Schouwenberg. But the special access a hacker can get is undermined somewhat by the fact malicious programs they try to download still have to come into the computer the same way they always do, and can be protected against, he added.