BIOS updated by itself...?

[gitkeeper]

Hey all,

Trying to understand if there is any way the bios on my 703GS Scar laptop would update itself without prompt.

I ask because:

I left my house today for 3 hours, leaving the laptop in the lock screen
I came back to find my bios password prompt, indicating the machine had restarted
After putting the password in, the machine restarted, and re-asked for the password
After entering it a second time, I progress bar and bios updating message came up
After two more bios passwords (self reset in between), windows is back up and running.


I haven't installed the Asus bios flash windows utility on this fresh windows install. Nor did I ever download a bios update for this machine.

I'm like 90% sure my roommate's been messing with my lappy - this kind of confirms it...I was just hoping someone might point out that our laptops just reflash their bios by themselves sometimes so I can stop worrying here.

Thanks in advance for any advice.
k

[gitkeeper]

Hey all,

Further to my post, the current BIOS version is now 307
The support page for my machine GL703GS only lists 305 and 306 for download.
I downloaded WinFlash which lists 306 (11/14/2018) as the latest version.
The build date is apparently 10/17/2018 for this 307 version, while the build date for the downloadable 306 version is 11/14/2018
WinFlash will not update back to 306, claiming it is 'older' despite having a later build date than 307


Does anyone know of any way this is legit, ASUS or Windows behavior?

Please, any insight here is greatly appreciated.

k

[gitkeeper]

So I contacted Asus support. They informed me that Windows Update will install BIOS updates. ..crazy right?

Also, they confirmed that the 307 version is theirs, but has not been pushed to the support site yet.


Im a bit surprised Windows Update can start a firmware upgrade like that!

[thr23]

i'm just curious, but can you see the relevant entry in your Windows Update history?

[gitkeeper]

Yup, I did end up finding it in the windows update history.

Asus also confirmed that Windows can do this, and that it's normal for UEFI updates to be pushed before they're available on the Asus support page.

Not fully convinced the UEFI wasn't compromised though. Hoping to find some insights on cleanly wiping and reinstalling a known-good asus version.

[JustinThyme]

Please list the update. Ive personally not seen this and such an update would kill my machine and corrupt data. The only machine I know of that does this is Microsoft Surface which stands to reason as there is nothing you an do in their firmware. Other machines that require specific set up cannot just be done by pushing it, it could cause a bricked machine and loss of data.
List KB number so we can research it.

I just researched it on M$ and the only way its done through updates is CFU which is basically an admin function so if you got it somone did it, not automatic windows updates. Good for corporate IT

https://blogs.windows.com/buildingap...rmware-update/

[gitkeeper]

Justin, I really appreciate your insight.


The machine is an GL703GS laptop. After having some accounts hacked and noticing a lot of CPU and network usage at idle, I replaced the M.2 drive with a Samsung evo 970 and a fresh installation of Windows. There were no ASUS Live or other update programs on the machine...in fact after the install, everything ran amazingly without having to download a single driver.

As my OP reads, I came home one night to the computer which had been reset (a common occurrence at this point). It prompted the BIOS password, which I enabled recently. After entering it and it immediately restarting, I entered it again and it "updated" the firmware.

Opening UEFI read:
Version 307
86.04.7C.00.24 N098GL703GS.001
FOCF0901.00B


I do remember looking at the windows update list and seeing something along the lines of "system firmware" with a corresponding timestamp.

Asus said (paraphrasing)
It is quite likely for Windows automatic updates to prompt a BIOS update if not the Asus live update tool. I also see that BIOS version 307 is not yuet updated on our support site for a manual update. This is actually normal. At a later date, our site will be updated as well.


If anyone knows how to set the lock bit to prevent software from accessing the SPI flash writer, I'd be so thankful.

[gitkeeper]

Please list the update. Ive personally not seen this and such an update would kill my machine and corrupt data. The only machine I know of that does this is Microsoft Surface which stands to reason as there is nothing you an do in their firmware. Other machines that require specific set up cannot just be done by pushing it, it could cause a bricked machine and loss of data.
List KB number so we can research it.

I just researched it on M$ and the only way its done through updates is CFU which is basically an admin function so if you got it somone did it, not automatic windows updates. Good for corporate IT

https://blogs.windows.com/buildingap...rmware-update/

When the machine gets back in a couple days, I'll put the EVO970 back in, load up windows and hopefully get the KB number and screenshots of the update history.

[ThrashZone]

Hi,
The only report of bios getting flashed by windows was someone that did it manually in device manager on the firmware
Not exactly the same as windows doing it automatically.

Always interested though in reports since I use older bios on both my systems they work better and cooler.
x99=2101 really old
x299=1301

[gitkeeper]

https://www.techpowerup.com/248827/a...s-installation


Whoa....so UEFI can install a virus to your windows installation...as it installs?