Sudden automatic BIOS update.

newbiedan · 2021-09-25 20:14:18

Greetings.

So here's the story. I've rebooted my PC a couple of minutes ago and saw a message on screen about BIOS being updated. I have no idea how that happened. I didn't install any BIOS update utilities and this was actually the first time I saw that message. I've read that ASUS used to make forced automatic updates for their motherboards and I happen to be using ASUS motherboard. But that was mostly related to Windows. Not to Linux. I also read that some hackers used to use that forced update option as a backdoor.

So here is the question. Should I search for rescue USB stick to rollback my BIOS (I remember it came with the motherboard) and reinstall OS as soon as possible or this actually could be a real BIOS update and there is a way to check that?

Uname shows version 5.13.13-arch1-1. In bios_version file there stands 1401. Motherboard has Intel X299 chipset on it.

Thanks in advance.

graysky · 2021-09-25 20:15:50

That sounds fishy to me and a little scary. I would roll it back or update it yourself using an official image from the vendor.

Ammako · 2021-09-25 20:34:50

ASUS fucking sucks, btw. Mine (G46VW) was designed to just go into a built-in bios flash utility and automatically proceed with reflashing the bios (without any confirmation prompts whatsoever!), just by a certain F key (F4?) being held on boot. I wouldn't be surprised if their desktop motherboards were just as terribly designed and you just happened to accidentally trigger this function when you rebooted.

Redownloading latest bios image and reflashing it by yourself might not hurt, but I doubt it would prevent this from happening again, whether it was something malicious or not.

Last edited by Ammako (2021-09-25 20:36:38)

seth · 2021-09-25 20:51:07

@newbiedan, do you have a wired ethernet connection (I don't see how the BIOS could connect to the WiFi for an update) and of course most importanly: do you have a windows installation (because than the process is fairly normal and the linux reboot might have confused the BIOS in case windows is hibernating)

leonavis · 2021-09-25 21:39:26

because than the process is fairly normal

It's normal for PCs to just install Bios-updates without user consent?

I've never heard of that.

So I searched for it. And indeed, Asus seems to roll out UEFI-firmware-updates over Windows Updates. That's kinda nuts. They also seem to install stuff to Windows without confirmation. Feels hard to believe that they would also do that on Linux-systems, but who knows...

seth · 2021-09-25 22:09:07

I don't see how this would be possible on (arch, the kernel itself isn't relevant)linux - on windows it's the mainboard drivertoolupdatethingy that now comes straight out of the nvram, but I guess they don't have a similar tool for POSIX systems and it wouldn't come out of WPBT either (so ASUS would essentially have to place Linux malware into the UEFI…)

What is probably more likely is to have a windows installation, the windows update scheduling a BIOS update for the next reboot, hibernating windows ("fast start" enabled shutdown), rebooting into linux, the BIOS sitting this one out because if the hibernation, linux rebooting and at this point the BIOS figures that it's now ok to run the patch because it forgets about the S4.

Windows hibernating while booting another OS has reports for all sorts of weird issues, hence the 3rd link in my signature…

leonavis · 2021-09-25 22:22:45

Yeah, I don't really see any other way how this could've happened either.

ASUS would essentially have to place Linux malware into the UEFI

Doesn't seem likely to me, for sure.

Then again, this whole thing didn't seem likely to me till I just found out about it. Placing bloatware in the system that gets automatically installed on a fresh system without user confirmation? Force-flashing the UEFI? Weird.

Then again, that Dragon-Center from MSI can also flash the Bios from Windows - though it does recommend not to do that, and also doesn't do it automatically.

Last edited by leonavis (2021-09-25 22:23:19)

merlock · 2021-09-25 22:55:45

I think @Seth is correct. I have an ASUS board (never had windows on this machine, not even in a VM), and that (OP's issue) has never happened to me in 3 years.

newbiedan · 2021-09-26 05:41:20

Thank you all for your responses

@Ammako I usually keep my hands away from keyboard while booting but still I could just fail to notice.

@seth Yes, I do have wired connection. No, I don't have any other OS installed on this PC and never had.

USB stick that I remembered turned out to be a sort of wireless dongle so I couldn't rollback anything. Upgrading BIOS to the latest version right now is a problem since I have an outdated CPU that's incompatible with it. Well, anyway I was going to get a new CPU and a new storage device so it seems I am going to do that sooner. Once I have a new CPU updating BIOS to the latest won't be a problem.

Big thanks to all of you.

seth · 2021-09-26 06:26:50

For a wired connection, the UEFI could do this w/o the OS or any interaction at all…

If you're concerned about that and don't want to un/plug the cable around every boot to prevent the BIOS from network access, you could implement a MAC filter in the router and spoof the MAC in the OS so that the UEFI won't know it.
https://wiki.archlinux.org/title/MAC_address_spoofing

Though at this point it becomes a ridiculous fight against your own HW and I'd expect any responsible vendor to have at least an opt-out switch (check your board config?)

Lone_Wolf · 2021-09-26 10:31:32

I think asus uses fwupd / LVFS to update efi on atleast some motherboards.

is fwupd installed ?

Slithery · 2021-09-26 11:23:47

Are you running a heavyweight DE like KDE or Gnome?
Some of their GUI updaters hook into fwupd to automatically provide firmware updates as well.

newbiedan · 2021-09-26 11:34:51

@seth I've checked that already and couldn't find any sort of update scheduler in motherboard config. Though I could just fail to spot it.

@Lone_Wolf No, fwupd is not installed.

@Slithery Yes, I'm using Gnome.

Arch Linux

#1 2021-09-25 20:14:18

Sudden automatic BIOS update.

#2 2021-09-25 20:15:50

Re: Sudden automatic BIOS update.

#3 2021-09-25 20:34:50

Re: Sudden automatic BIOS update.

#4 2021-09-25 20:51:07

Re: Sudden automatic BIOS update.

#5 2021-09-25 21:39:26

Re: Sudden automatic BIOS update.

#6 2021-09-25 22:09:07

Re: Sudden automatic BIOS update.

#7 2021-09-25 22:22:45

Re: Sudden automatic BIOS update.

#8 2021-09-25 22:55:45

Re: Sudden automatic BIOS update.

#9 2021-09-26 05:41:20

Re: Sudden automatic BIOS update.

#10 2021-09-26 06:26:50

Re: Sudden automatic BIOS update.

#11 2021-09-26 10:31:32

Re: Sudden automatic BIOS update.

#12 2021-09-26 11:23:47

Re: Sudden automatic BIOS update.

#13 2021-09-26 11:34:51

Re: Sudden automatic BIOS update.

Board footer