{"id":54851,"date":"2020-01-05T00:00:00","date_gmt":"2020-01-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/kak-ya-kupil-zablokirovannyj-noutbuk-na-ebay-i-poproboval-sdelat-svoj-antitheft-na-baze-intelamt"},"modified":"2020-02-18T14:02:54","modified_gmt":"2020-02-18T11:02:54","slug":"kak-ya-kupil-zablokirovannyj-noutbuk-na-ebay-i-poproboval-sdelat-svoj-antitheft-na-baze-intelamt","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/kak-ya-kupil-zablokirovannyj-noutbuk-na-ebay-i-poproboval-sdelat-svoj-antitheft-na-baze-intelamt","title":{"rendered":"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/9d9dd0f31e434bcf6127161f1baa8223.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>TL;DR<\/h3>\n<p>\nAbsolute Computrace is a technology that allows you to lock a machine, even if the operating system has been reinstalled or the hard drive replaced, for $15 a year. I bought a laptop on eBay that was locked with this feature. This article describes my experience battling it and trying to do the same with Intel AMT, but for free. <noindex><a rel=\"nofollow\" href=\"https:\/\/homeoffice.absolute.com\/products\/\">only<\/a><\/noindex>Let\u2019s agree right away: I\u2019m not breaking into open doors, nor am I giving a lecture on these remote technologies. I\u2019m sharing a little backstory and how to quickly set up remote access to your machine in any situation (if it's connected to the network via RJ-45). If it's connected via Wi-Fi, this applies only to Windows OS. You can even enter the SSID, username, and password for a specific access point directly in Intel AMT, enabling access over Wi-Fi without logging into the system. Moreover, if you install Intel ME drivers on GNU\/Linux, it should also work there. Ultimately, while I couldn't figure out if it's possible to remotely lock the laptop and display a message using this technology, access to the remote desktop and Secure Erase will be available, and that's what matters most.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nThe taxi driver left with my laptop, and I decided to buy a new one on eBay. What could possibly go wrong?<\/p>\n<p>From buyer to thief \u2014 in one launch<\/p>\n<h3>Upon bringing the laptop home from the post office, I began finishing the Windows 10 installation, and even managed to install Firefox, when suddenly:<\/h3>\n<p>\nI understood perfectly well that no one would modify the Windows distribution; if someone did, it wouldn\u2019t look so crude, and the lock would have occurred much faster. Plus, ultimately, it would make no sense to block anything, as everything could be fixed with a reinstall. Okay, let's reboot.<\/p>\n<p><img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/22c02538cd39467e7512ab1ad9a4dd8e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nRebooting into BIOS, and now things start to become clearer:<\/p>\n<p>And finally, it\u2019s completely clear:<\/p>\n<p><img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/6e60a658c5f70e8a125818e491fa6496.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nHow could it happen that my own laptop is holding me hostage? What is Computrace?<\/p>\n<p><img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/14ecc84d8537e9421bea9343713af3bf.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Strictly speaking, Computrace is a set of modules in your EFI BIOS that, after booting into Windows OS, injects its trojans, which communicate with a remote server operated by Absolute Software, allowing the system to be locked over the internet if needed. For more details, you can read here.<\/h3>\n<p>\nA deeper look can be found here. <noindex><a rel=\"nofollow\" href=\"https:\/\/securelist.ru\/ugroza-iz-bios\/19169\/\">here<\/a><\/noindex>With operating systems other than Windows, Computrace does not work. Moreover, if we connect a Windows device that is encrypted with BitLocker or any other software, Computrace will not function again \u2014 the modules simply won't be able to inject their files into our system.<\/p>\n<p>At first glance, such technologies may seem futuristic, but that's only until we discover that all of this is done on native UEFI with the help of one and a half dubious modules. <\/p>\n<p>It seems as if this thing is cold and all-powerful until we try, for example, to boot into GNU\/Linux:<\/p>\n<p><img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/f9e4ffb29a281d984b55850b77a5ba71.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Currently, Computrace lock is activated on this laptop.<\/i><\/p>\n<p>As they say,<\/p>\n<p><img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/43589a99dfaf18adc12ea0c092ccf059.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>What to do?<\/h3>\n<p>\nThere are four obvious vectors for resolving the problem that has arisen:<\/p>\n<ol>\n<li>Write to the seller on eBay<\/li>\n<li>Contact Absolute Software, the creator and owner of Computrace<\/li>\n<li>Dump the BIOS chip, send it to some shady types and ask them to send back a patched dump that deactivates all locks and changes the device ID<\/li>\n<li>Call Lazard<\/li>\n<\/ol>\n<p>\nLet's break them down one by one:<\/p>\n<ol>\n<li>Like all reasonable people, we first write to the seller who sold us this product and discuss the problem with the one responsible for it in the first place.\n<p>Done:<\/p>\n<p><img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/0f2c529e5d2676a7b57ae80dac44b8f7.png\" style=\"display:block;margin: 0 auto;\" \/><\/li>\n<li>According to advice found deep on the internet,<br \/>\n<blockquote><p>You need to contact Absolute Software. They will want the machine serial number and the motherboard serial number. You will also need to provide 'proof of purchase,' like a receipt. They will contact the owner they have on file and get the OK to remove it. Assuming it is not stolen, they will then 'flag it for delete.' After that, the next time you connect to the internet or have an open internet connection, a miracle will occur and it will be gone. Send the information I mentioned to TechSupport@absolute.com.<\/p><\/blockquote>\n<p>\nWe can write directly to Absolute and discuss unlocking with them directly. I didn't rush and decided to resort to this solution only closer to the end.<\/li>\n<li>Fortunately, a brutal solution to the problem was already available. Here are these <noindex><a rel=\"nofollow\" href=\"https:\/\/www.allservice.ro\/forum\/viewtopic.php?t=3044\">guys<\/a><\/noindex> and many other computer support experts on the same eBay and even Indians on Facebook promise to unlock our BIOS if we send them a dump and wait a couple of minutes.\n<p>The unlocking process is described as follows:<\/p>\n<blockquote><p>Unlocking solution is finally available and requires a SPEG programmer to be able to flash the BIOS.<\/p>\n<p>The process is:<\/p>\n<ol>\n<li>Reading the BIOS and creating a valid dump. In a ThinkPad, the BIOS is married to the internal TPM chip and contains a unique signature of it, so it is important that the original BIOS is correctly read for the success of the whole operation and to restore the BIOS afterward.<\/li>\n<li>Patching the BIOS binaries and injecting a small allservice.ro UEFI program. This program will read the secure EEPROM, reset the TPM certificate and password, write to the secure EEPROM, and reconstruct all data.<\/li>\n<li>Write the patched BIOS dump (this will only function in that TP btw), start the laptop and generate a Hardware ID. We will send you a unique key that will activate the Allservice BIOS, while the BIOS is loading it will execute the unlock routine and unlock the SVP and TPM.<\/li>\n<li>Finally, write the original BIOS dump back for normal operations and enjoy the laptop.<\/li>\n<\/ol>\n<p>\n We can also disable Computrace or change the SN\/UUID and reset RFID checksum error by using our UEFI program in the same manner, if necessary.<\/p>\n<p>The unlock service price is per machine (like we do for the Macbook\/iMac, HP, Acer, etc) For service price and availability please read the next post below. You may contact support@allservice.ro for any inquiry.\n<\/p><\/blockquote>\n<p>\n Seems legit! But this is also, for obvious reasons, an option for the most desperate situation, plus all this pleasure costs $80. We\u2019ll leave it for later.<\/li>\n<li>If Lazard has messed everything up for me and asks me to call back, I shouldn't refuse! It\u2019s a serious matter.<\/li>\n<\/ol>\n<p><\/p>\n<h3>Calling Lazard aka \u201cthe world\u2019s leading financial advisory and asset management firm, advises on mergers, acquisitions, restructuring, capital structure and strategy.\u201d<\/h3>\n<p>\nWhile waiting for the eBay seller to respond, I\u2019m adding a few bucks to my zadarma account and anticipating conversation with, perhaps, the most soulless interlocutor on the planet \u2014 the support of a gigantic financial corporation from New York. The girl quickly picks up the phone, listens to my somewhat hesitant explanation of how I bought this laptop, writes down its serial number, and promises to pass it to the admins who will call me back. This process repeats exactly twice with a one-day gap. On the third time, I intentionally waited until evening, so it would be 10 AM in New York, and called, quickly reading my now-familiar script about my purchase. Two hours later, the same woman called me back and began to read the instructions:<br \/>\n \u2014 Press escape.<br \/>\nI press it, but nothing happens.<br \/>\n \u2014 Something isn\u2019t working, nothing is changing.<br \/>\n \u2014 Keep pressing.<br \/>\n \u2014 I'm pressing.<br \/>\n \u2014 Now enter: 72406917.<br \/>\nI enter it. Nothing happens.<br \/>\n \u2014 You know, I\u2019m afraid this won\u2019t help... One moment...<br \/>\nThe laptop suddenly reboots, the system loads, that annoying white screen has disappeared. Just to be sure, I check the BIOS, Computrace is not activated. It seems, that's it. Thank you for the support, I write to the seller that I solved all the issues myself and relax.<\/p>\n<h3>OpenMakeshift Computrace Intel AMT based<\/h3>\n<p>\nWhat happened left me stunned, but I liked the idea; my phantom pain for the talentlessly lost was looking for some outlet, and I wanted to protect my new laptop as if that would bring back the old one. If someone uses Computrace, then I can use it too, right? After all, there was Intel Anti-Theft, which, by description, is a wonderful technology that works as it should, but it was killed by market inertia; however, there must be an alternative. It turned out that this alternative began where it ended \u2014 only Absolute Software managed to establish itself in this field.<\/p>\n<p>Let's start by recalling what Intel AMT is: it is a set of libraries that is part of Intel ME, embedded in the EFI BIOS, so that an admin in some office can operate machines on the network without getting out of their chair, even if they do not boot, by remotely connecting ISO images, managing through remote desktop, etc.<\/p>\n<p>This all runs on Minix and at about this level:<\/p>\n<blockquote><p>Invisible Things Lab suggested calling the functionality of the Intel vPro \/ Intel AMT technology a protection ring -3. Within this technology, chipsets that support vPro contain an independent microprocessor (ARC4 architecture), have a separate interface to the network card, exclusive access to a dedicated section of RAM (16 MB), and DMA access to the main RAM. Programs on it run independently of the central processor, the firmware is stored along with BIOS codes or on similar SPI flash memory (the code has a cryptographic signature). An embedded web server is part of the firmware. By default, AMT is off, but some code still operates in this mode even with AMT turned off. The ring -3 code is active even in S3 Sleep power mode.<\/p><\/blockquote>\n<p> It sounds tempting because it seems that if we can establish a reverse connection to some admin panel using Intel AMT, we can have access no worse than Computrace (actually, it's not true).<\/p>\n<h3>Let's activate Intel AMT on our machine.<\/h3>\n<p>\nFirst, some of you would surely like to get your hands on this AMT, and that\u2019s where the nuances begin. First: you need a processor that supports it. Fortunately, there are no problems with that (unless you have an AMD), as vPro has been added to almost all Intel i5, i7, and i9 processors (you can check). <noindex><a rel=\"nofollow\" href=\"https:\/\/ark.intel.com\/content\/www\/ru\/ru\/ark\/search\/featurefilter.html?productType=873&amp;0_VProTechnology=True\">here<\/a><\/noindex>) starting from 2006, while a proper VNC was only introduced in 2010. Secondly, if you have a desktop, you need a motherboard that supports this functionality, specifically with a Q chipset. In laptops, however, we only need to know the processor model. If you find that you support Intel AMT, that's a good sign, and you can apply the installations provided here. If not, either you were unlucky or intentionally chose a processor or chipset without support for this technology, or you wisely saved money by choosing an AMD, which is also a reason to celebrate. <\/p>\n<p>According to the documents<\/p>\n<blockquote><p> In non-secure mode, Intel AMT devices listen on port 16992.<br \/>\n In TLS mode, Intel AMT devices listen on port 16993.<\/p><\/blockquote>\n<p>\nIntel AMT accepts connections on ports 16992 and 16993. Let's proceed there. <\/p>\n<p>It is necessary to check that Intel AMT is enabled in the BIOS:<\/p>\n<p><img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/ba013cdea7e318b445ff8eb61f0a9819.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNext, we need to reboot and press Ctrl + P during startup<\/p>\n<p><img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/2aec2f10833956d42f271c0376c8fb33.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nThe default password, as usual, <i>admin<\/i>.<\/p>\n<p>Immediately change the password in Intel ME General Settings. Then, in Intel AMT Configuration, enable Activate Network Access. Done. You are now officially backdoored. Let's boot into the system. <\/p>\n<p>Now an important nuance: logically, we should be able to access Intel AMT from localhost and remotely, but that's not the case. Intel states that local connections and configuration changes can be made using <noindex><a rel=\"nofollow\" href=\"https:\/\/downloadcenter.intel.com\/download\/25616\">Intel AMT Configuration Utility<\/a><\/noindex>, but mine refused to connect outright, so my connection only worked remotely. <\/p>\n<p>Take any device and connect via <noindex><a rel=\"nofollow\" href=\"http:\/\/yourIP\">yourIP<\/a><\/noindex>:16992<\/p>\n<p>It looks like this:<\/p>\n<p><img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/29617a31566ed5d349568d063ebb7ca6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/34e40d39cddb624e56cbeea57383ecff.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nWelcome to the standard Intel AMT interface! Why 'standard'? Because it is stripped down and totally useless for our purposes, and we will use something more serious.<\/p>\n<h3>Let's get acquainted with MeshCommander<\/h3>\n<p>\nAs is often the case, big companies do something, and end users adapt it for themselves. This is what happened here. <\/p>\n<p><img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/7357011d7aa2ec354a5245bb714a1885.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nThis modest (not an exaggeration: its name is absent from its own website, had to Google it) man named Ylian Saint-Hilaire developed some wonderful tools for working with Intel AMT.<\/p>\n<p>I would like to draw attention to his <noindex><a rel=\"nofollow\" href=\"https:\/\/www.youtube.com\/channel\/UC2B142NLMQwACfTRxrHoYTQ\">YouTube channel<\/a><\/noindex>, in his videos, he clearly and understandably demonstrates in real-time how to perform various tasks related to Intel AMT and its software.<\/p>\n<p>Let's start with <noindex><a rel=\"nofollow\" href=\"https:\/\/www.meshcommander.com\/meshcommander\">MeshCommander<\/a><\/noindex>. Download it, install it, and try to connect to our machine:<\/p>\n<p><img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/d1b2cfc76250db2719b916dcb21fca4b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nThe process is not instantaneous, but in the end, we will get a screen like this:<\/p>\n<p><img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/fe2f5d27545a933a2d5f1b760bd784ce.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>It's not that I'm paranoid, but I do handle sensitive data; please forgive me this flirtation.<\/i><\/p>\n<p>The difference, as they say, is obvious. I don't know why the Intel control panel lacks such a feature set, but the fact remains: Ylian Saint-Hilaire gets significantly more out of life. Moreover, you can install his web interface directly into the firmware, allowing you to utilize all functions without the utility.<\/p>\n<p>Here's how it works:<\/p>\n<p><img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/10e634aed394a1d3f8c18135908cf603.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nI must note that I haven't used this functionality (Custom web interface) and can't speak to its effectiveness or functionality, as it's not needed for my purposes.<\/p>\n<p>You can play around with the functionality; it's unlikely you'll ruin anything, since the starting and ending point of this whole festival is the BIOS, where you can reset everything by disabling Intel AMT.<\/p>\n<h3>Deploying MeshCentral and implementing BackConnect<\/h3>\n<p>\nAnd this is where it gets mind-blowing. The guy not only created the client but also an entire admin panel for our Trojan! And not just created it, but <noindex><a rel=\"nofollow\" href=\"https:\/\/meshcentral.com\/\">launched it for everyone on his server.<\/a><\/noindex>.<\/p>\n<blockquote><p>Get started by installing a MeshCentral server of your own or, if you're not familiar with MeshCentral, you can try the public server at your own risk at MeshCentral.com. <\/p><\/blockquote>\n<p>\nThis positively speaks to the reliability of his code, as I couldn't find any news about hacks or leaks during the service's operation.<\/p>\n<p>Personally, I run MeshCentral on my server because I unfoundedly believe it's more reliable, but there's nothing but fuss and spiritual longing in that. If you want to do the same, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.meshcommander.com\/meshcentral2\">here<\/a><\/noindex> there are documents and <noindex><a rel=\"nofollow\" href=\"https:\/\/hub.docker.com\/search?q=meshcentral&amp;type=image&amp;sort=updated_at&amp;order=desc\">here<\/a><\/noindex> a container with MeshCentral. The documents explain how to link all of this in NGINX, so the implementation easily integrates into your home servers.<\/p>\n<p>Sign up at <noindex><a rel=\"nofollow\" href=\"https:\/\/meshcentral.com\">meshcentral.com<\/a><\/noindex>, log in, and create a Device Group, choosing the 'no agent' option:<\/p>\n<p><img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/e51ad94a50d087ef4ad7a175298c2011.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nWhy 'no agent'? Because why would we want it to install something unnecessary; it's unclear how it behaves and how it will function.<\/p>\n<p>Click 'Add CIRA':<\/p>\n<p><img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/27e19f539ead5b27a7cf8dcce3b51d3d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDownload cira_setup_test.mescript and use it in our MeshCommander like this:<\/p>\n<p><img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/8fa2bac09717d9cc54ad7cca91986102.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVoil\u00e0! After a while, our machine will connect to MeshCentral, and we can do something with it.<\/p>\n<p>First of all, you should know that our software will not simply connect to a remote server on its own. This is due to the fact that Intel AMT has two connection options \u2014 through a remote server and directly locally. They cannot work simultaneously. Our script has already configured the system for remote operation, but you may need to connect locally. To enable local connection, you need to write here<\/p>\n<p><img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/add90d713d951a638074c56537d0b2ec.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\na line that represents your local domain (note that our script has already input some random string there for remote connection to occur) or completely clear all lines (but then remote connection will be unavailable). For example, in my OpenWrt, the local domain is lan:<\/p>\n<p><img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/f10668970b117745aba15a02eb4c0ca4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAccordingly, if we input lan there, and if our machine is connected to a network with this local domain, remote access will be unavailable, and local ports 16992 and 16993 will open and accept connections. In short, if there's something random that has no relation to your local domain, the software will try to connect; if not, you will need to connect to it yourself via cable, that's all.<\/p>\n<p>Secondly:<\/p>\n<p><img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/20df68ba7d60ee01625787460e1337d1.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAll set!<\/p>\n<p>You may ask \u2014 where is the AntiTheft here? As I said initially \u2014 Intel AMT is not really suited for combating thieves. Managing an office network is one thing, but fighting against individuals unlawfully seizing property over the internet is another. Let's consider tools that theoretically could help us in the fight for private ownership: <\/p>\n<ol>\n<li>The mere presence of access to the machine, if it is connected by cable, or, if it has Windows installed, then also via WiFi. Yes, it's childish, but using such a laptop is already very difficult for an ordinary person even if someone suddenly takes control. Moreover, despite not being able to figure out the scripts, there is surely a way to creatively remove some functionality from them for blocking or issuing notifications.<\/li>\n<li>Remote Secure Erase with Intel Active Management Technology\n<p><img decoding=\"async\" alt=\"How I bought a locked laptop on eBay and tried to build my AntiTheft based on IntelAMT\" src=\"\/wp-content\/uploads\/2020\/01\/f073d5aeadca6b21e0725f7d5dbdb538.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nWith this option, you can erase all data from the machine in seconds. It is unclear whether it works on SSDs other than Intel. Here <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/kingston_technology\/blog\/448624\/\">here<\/a><\/noindex> you can read more about this feature. You can admire its operation <noindex><a rel=\"nofollow\" href=\"https:\/\/webm.red\/view\/hPIy.webm\">here<\/a><\/noindex>The quality is terrible, but it's only 10 megabytes and the main point is clear.<\/li>\n<\/ol>\n<p>\nThe problem of delayed execution remains unsolved, in other words: we need to watch for when the machine connects to the network to establish a connection. I believe there is a solution to this as well.<\/p>\n<p>Ideally, we should lock the laptop and display a message, but in our case, we just have unavoidable access, and how to proceed next is a matter of imagination. <\/p>\n<p>Perhaps you can find a way to block the machine or at least display a message, let me know if you do. Thank you!<\/p>\n<p>Don't forget to set a password on the BIOS.<\/p>\n<p><i>Thanks to the user <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/berez\/\" class=\"user_link\">berez<\/a><\/noindex> for proofreading!<\/i><br \/>\n<br \/>Source: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/482870\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>TL;DR Absolute Computrace \u2014 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043c\u0430\u0448\u0438\u043d\u0443(\u0438 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e), \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u043d\u0430 \u043d\u0435\u0439 \u043f\u0435\u0440\u0435\u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438\u043b\u0438 \u0434\u0430\u0436\u0435 \u0437\u0430\u043c\u0435\u043d\u0438\u043b\u0438 \u0436\u0435\u0441\u0442\u043a\u0438\u0439 \u0434\u0438\u0441\u043a, \u0437\u0430 $15 \u0432 \u0433\u043e\u0434. \u042f \u043a\u0443\u043f\u0438\u043b \u043d\u043e\u0443\u0442\u0431\u0443\u043a \u043d\u0430 eBay, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u0437\u0430\u043b\u043e\u0447\u0435\u043d \u044d\u0442\u043e\u0439 \u0448\u0442\u0443\u043a\u043e\u0439. \u0412 \u0441\u0442\u0430\u0442\u044c\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043c\u043e\u0439 \u043e\u043f\u044b\u0442, \u043a\u0430\u043a \u044f \u0441 \u043d\u0435\u0439 \u0431\u043e\u0440\u043e\u043b\u0441\u044f \u0438 \u043f\u044b\u0442\u0430\u043b\u0441\u044f \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0442\u043e \u0436\u0435 \u0441\u0430\u043c\u043e\u0435 \u043d\u0430 \u0431\u0430\u0437\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-54851","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\".\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/kak-ya-kupil-zablokirovannyj-noutbuk-na-ebay-i-poproboval-sdelat-svoj-antitheft-na-baze-intelamt\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u044f \u043a\u0443\u043f\u0438\u043b \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043d\u043e\u0443\u0442\u0431\u0443\u043a \u043d\u0430 eBay \u0438 \u043f\u043e\u043f\u0440\u043e\u0431\u043e\u0432\u0430\u043b \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0441\u0432\u043e\u0439 AntiTheft \u043d\u0430 \u0431\u0430\u0437\u0435 IntelAMT | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\".\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/kak-ya-kupil-zablokirovannyj-noutbuk-na-ebay-i-poproboval-sdelat-svoj-antitheft-na-baze-intelamt\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-01-04T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:02:54+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47How I Bought a Locked Laptop on eBay and Tried to Create My AntiTheft Based on Intel AMT | ProHoster","description":".","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/kak-ya-kupil-zablokirovannyj-noutbuk-na-ebay-i-poproboval-sdelat-svoj-antitheft-na-baze-intelamt","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u044f \u043a\u0443\u043f\u0438\u043b \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043d\u043e\u0443\u0442\u0431\u0443\u043a \u043d\u0430 eBay \u0438 \u043f\u043e\u043f\u0440\u043e\u0431\u043e\u0432\u0430\u043b \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0441\u0432\u043e\u0439 AntiTheft \u043d\u0430 \u0431\u0430\u0437\u0435 IntelAMT | ProHoster","og:description":".","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/kak-ya-kupil-zablokirovannyj-noutbuk-na-ebay-i-poproboval-sdelat-svoj-antitheft-na-baze-intelamt","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-04T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54851","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 12:57:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:56:25","updated":"2026-01-24 12:57:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/54851","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=54851"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/54851\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=54851"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=54851"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=54851"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}