The New BIOS Hack That Bypasses Every Antivirus/

Edward78 · 10 Mar 2024 at 13:19

The New BIOS Hack That Bypasses Every Antivirus

Sponsored: Stop data brokers from exposing your personal information. Go to https://aura.com/thiojoe to get a 14-day free trial and see how much of yours ...

www.youtube.com

Can't get rid of it.

adidan · 10 Mar 2024 at 13:23

Edward78 said:
The New BIOS Hack That Bypasses Every Antivirus

Sponsored: Stop data brokers from exposing your personal information. Go to https://aura.com/thiojoe to get a 14-day free trial and see how much of yours ...

www.youtube.com

Can't get rid of it.

Think it's actually been around since the end of last year

Update your bios. Did my gigabyte board yesterday and it specifically lists LogoFail.

My MSI doesn't but then there's talk that MSI may not be affected. Not sure about that though.

E: Ah, don't think you can actually inject your own logo with MSI boards so the only way would be via an unofficial bios update. Would like 100% clarification on that though.

Edward78 · 10 Mar 2024 at 13:27

then I am safe.

Tetras · 10 Mar 2024 at 13:28

adidan said:
My MSI doesn't but then there's talk that MSI may not be affected. Not sure about that though.

From what I can recall, some manufacturers hardcode their logo into the BIOS, so they're not re-writable, but if they offer OEMs support to change the logo, then they are vulnerable.

If the BIOS has an option to disable firmware updates (mine does), then that may disable the option.

Pulseammo · 10 Mar 2024 at 16:59

Folks should be aware that updating their BIOS for security patches may cause your hardware IDs to change and invalidate your windows activation if you're relying on a windows 7 / 8 digital license upgraded to windows 10 or 11, as I recently found out after updating bios for this very reason. Not saying don't install security patches, but just something for people to be aware of which might cause a simple mundane bios flash to become a headache.

nlel1975 · 10 Mar 2024 at 17:14

Pulseammo said:
Folks should be aware that updating their BIOS for security patches may cause your hardware IDs to change and invalidate your windows activation if you're relying on a windows 7 / 8 digital license upgraded to windows 10 or 11, as I recently found out after updating bios for this very reason. Not saying don't install security patches, but just something for people to be aware of which might cause a simple mundane bios flash to become a headache.

I was able to reactivate my Windows 11 license after changing the motherboard as it was linked to my Microsoft account. It offered me a reactivation option, if a BIOS update deactivated it again surely the option to reactivate would be there again. I didn’t notice it at first and it wouldn’t activate until I noticed the reactivate due to hardware change option.

Pulseammo · 10 Mar 2024 at 17:16

nlel1975 said:
I was able to reactivate my Windows 11 license after changing the motherboard as it was linked to my Microsoft account. It offered me a reactivation option, if a BIOS update deactivated it again surely the option to reactivate would be there again. I didn’t notice it at first and it wouldn’t activate until I noticed the reactivate due to hardware change option.

As mentioned in the other thread, I tried that. This information only applies after around October 2023 when MS decided to stop allowing W7 licenses to activate 10 and 11, if it was before then that you tried this off a Windows 7 or 8 key you should have no issue, perhaps that's why?

Edit: That's to say if you tried it again today that button "I've changed hardware" would no longer work for you.

nlel1975 · 10 Mar 2024 at 17:22

Pulseammo said:
Edit: That's to say if you tried it again today that button "I've changed hardware" would no longer work for you.

I did this only two weeks ago, on the 22nd February and it allowed me to reactivate due to hardware change as my license was linked to my Microsoft account.

Pulseammo · 10 Mar 2024 at 17:23

nlel1975 said:
I did this only two weeks ago, on the 22nd February and it allowed me to reactivate due to hardware change as my license was linked to my Microsoft account.

And this is with a Windows 7 license? :/

nlel1975 · 10 Mar 2024 at 17:24

Pulseammo said:
And this is with a Windows 7 license? :/

Don’t know about that maybe not.

Pulseammo · 10 Mar 2024 at 17:25

nlel1975 said:
Don’t know about that maybe not.

It'll work fine if it is originally a Windows 10 or Windows 11 license, you'll not have an issue with hardware change there afaik.

It's a specific interaction now with Windows 7 and 8 keys linked to an MS account.

FredFlint · 11 Mar 2024 at 12:56

Pulseammo said:
Folks should be aware that updating their BIOS for security patches may cause your hardware IDs to change and invalidate your windows activation if you're relying on a windows 7 / 8 digital license upgraded to windows 10 or 11, as I recently found out after updating bios for this very reason. Not saying don't install security patches, but just something for people to be aware of which might cause a simple mundane bios flash to become a headache.

I have updated the BIOS 100+ times on lots of PC's and laptop's and Windows 7/8/10 and 11 has never been de-activated. The hardware ID is generally frozen into the chip so firmware should not change it, if it does, that is ****** up.

Tetras · 11 Mar 2024 at 13:26

FredFlint said:
I have updated the BIOS 100+ times on lots of PC's and laptop's and Windows 7/8/10 and 11 has never been de-activated. The hardware ID is generally frozen into the chip so firmware should not change it, if it does, that is ****** up.

The recent changes Microsoft made to activation make what happened in the past not applicable. I think the gist is, if your hardware deactivates due to a hardware change and you try to reactivate and your key is not 10 or 11, you're out of luck. If they made any subsequent changes to this, I don't know.

FredFlint · 11 Mar 2024 at 13:30

Tetras said:
The recent changes Microsoft made to activation make what happened in the past not applicable. I think the gist is, if your hardware deactivates due to a hardware change and you try to reactivate and your key is not 10 or 11, you're out of luck. If they made any subsequent changes to this, I don't know.

A firmware update should not be seen as a hardware change as it's not a hardware change. MS really does suck.

Tetras · 11 Mar 2024 at 13:43

FredFlint said:
A firmware update should not be seen as a hardware change as it's not a hardware change. MS really does suck.

Yep! I suspect they have somehow tied the TPM / secure boot stuff in to activation and that might be part of why it deactivates when it never did before, but I don't know.

Pulseammo · 11 Mar 2024 at 14:12

FredFlint said:
A firmware update should not be seen as a hardware change as it's not a hardware change. MS really does suck.

I agree, but it seems to be happening. It's happened to a friend as well, slightly different circumstances though, he was on an OEM key and updating his BIOS deactivated his install, it was unrelated to the more current issue where an install activated off a W7 key won't re-activate the same install because the upgrade period has passed.

I'm not sure if Windows takes some kind of hash of the BIOS and includes it as part of the hardware ID or what, but it is happening, just not in 100% of cases.

Conversely I've updated the bios on my previous PC (an old X99) a bunch and never had it deactivate once!

It's a piece of nonsense you're possibly having to choose between security patches or retaining an install activated during the grace period, MS needs to sort that but I doubt they care.