New Security Risk? - Bluetooth device paired with Windows even though onboard Bluetooth is disabled in BIOS

Hi!

I had a really weird experience with my desktop computer. Even though Bluetooth was disabled in BIOS, I started hearing audio playback from Momentum 4 wireless Bluetooth headphones after connecting them to Samsung S23. I could also control YouTube playback (start & stop) with the headphones.

Background info (Desktop)

Windows 11 Pro: Latest updates installed
Asus Z790 Creator: Onboard Bluetooth disabled in BIOS (Bios version 0816)
Asus z790 Creator: Onboard WiFi disabled in Bios (I don't other WiFi devices, either)
Connected devices: Logitech Bolt (Mouse & Keyboard), RME Audio Interface, Kingston SD Reader
Monitor: LG 40WP95C-W, connected via mini Displayport - USB-C cable from RTX 4070 Ti

Background info (S23)

Latest firmware installed
Latest updates installed

What happened?

1) Paired Momentum 4 headphones with Samsung S23
2) Installed Sennheiser Smart control app on Samsung S23
3) Updated Momentum 4 firmware

4) Went to my desktop and wondered why I cannot hear the sound
5) Realized that audio playback is coming from Momentum 4 headphones

I don't know at which point Windows connected to Momentum 4 headphones

Findings

Asus Z790: Onboard Bluetooth still disabled
Asus Z790: Onboard WiFi still disabled
Windows 11: Bluetooth on-off switch not shown
Windows 11: Momentum 4 shown under "Bluetooth & Devices > Devices > Audio"
Windows 11: "System > Sound > Volume Mixer" Momentum 4 shown as Output device and Input device
Smart Control App (S23): "Momentum 4 > Connection Management" Only Galaxy S23 shown, Desktop not shown.

Thus, Sennhaiser Smart Control App doesn't know that Momentum 4 is connected to Windows 11.

Replication

4) Removed Momentum 4 from Windows 11 "Bluetooth & Devices > Devices > Audio"
5) Could not replicate steps 1-3

Notes

I should have removed Logitech Bolt receiver while the audio was playing from the headphones just to what happens. However, it was too late when I realized this. I also should have tested what happens if I put other Bluetooth devices in pairing mode.

Turning Bluetooth on

6) ASUS Z790: Enabled onboard Bluetooth
7) Restarted
8) Connected Momentum 4 to Desktop

Findings

Windows 11: Momentum 4 shown under "Bluetooth & Devices > Devices > Audio"
Windows 11: Bluetooth on-off switch is shown
Windows 11: "System > Sound > Volume Mixer" Momentum 4 shown as Output device and Input device
Smart Control App (S23): "Momentum 4 > Connection Management" Both Galaxy S23 and Desktop are shown
Windows 11: Audio playback from Momentum 4 headphones works fine

Possible diagnosis

The following devices don't have a Bluetooth connection: RME Audio Interface, Kingston SD Reader, LG 40WP95C-W1

Thus, there are pretty much only two of explanations that I can think of and all of them seem very unlikely.
a) The Bluetooth connection has been formed with Logitech Bolt receiver
b) The onboard Bluetooth device could be on even though it's disabled in BIOS

There are no other Bluetooth receivers connected to my desktop.
Samsung S23 and the desktop should not be connected in any other way, either.

a) Bolt receiver should not work with other Bluetooth peripherals. "Likewise, both Unifying and Bolt are proprietary technologies from Logitech. Therefore, they're not compatible with wireless peripherals from other brands." (makeuseof.com)
b) I've never heard that devices that are disabled in BIOS could work.

Security Risk

If peripherals are able to connect to Windows 11 even though Bluetooth is off, this sounds like a security risk.

Bios Update

I updated Z790 Bios from version 8016 to 0904. I'll be reinstalling Windows 11 in a few days. I will check if I'm able to replicate this issue.

Questions

1) Do you have any idea how Momentum 4 was able to connect to Windows 11? It there something obvious that I'm just missing?

2) f I don't want my desktop to connect to Bluetooth devices automatically which one of these is a safer option?

a) Enable onboard Bluetooth device and disable Bluetooth from Windows.
b) Disable onboard Bluetooth and hope that this kind of situation doesn't happen again.

Thank you!
TK

This is one of those anyone can post anything posts. If BT is disabled, you can't get BT signals. Also, where in the BIOS is BT "disabled"?

Dru2 said:

This is one of those anyone can post anything posts. If BT is disabled, you can't get BT signals. Also, where in the BIOS is BT "disabled"?

Click to expand...

Asus Z790 Creator has an onboard Bluetooth device. However, it was disabled.

Check Device Manager for Bluetooth. You could also try these registry fixes here,

TK_248 said:

Asus Z790 Creator has an onboard Bluetooth device. However, it was disabled.

Click to expand...

BIOS bug? Could show as Disabled but actually be enabled. Check Windows Device Manager - is it showing there? If it is then it's a BIOS bug

BrianInEngland said:

BIOS bug? Could show as Disabled but actually be enabled. Check Windows Device Manager - is it showing there? If it is then it's a BIOS bug

Click to expand...

When the onboard Bluetooth device is disabled, it's not showing in Windows Device manager. This is why this has been a mystery for me.

I'm only taking a guess so I could be 100% wrong. Are you using the Phone link app to link your computer to your phone?

Winuser said:

I'm only taking a guess so I could be 100% wrong. Are you using the Phone link app to link your computer to your phone?

Click to expand...

I'm using Android. My phone and my desktop should not be connected

Have you disabled beacons?

TK_248 said:

I'm using Android. My phone and my desktop should not be connected

Click to expand...

I know the S23 uses Android. I have been using Samsung phones since MS canceled the Windows phones. Have you ever used the Phone Link App?

Here's the best explanation I've got:

"I think that what is happening is that when you disable it in BIOS, the firmware is like "okay, we won't tell windows about this device", so when windows boots and it asks the chipset "hey, what devices do you have?" it gives the whole list and leaves out the BT adapter. But it doesn't actually disable anything by, like, cutting power to it. And there is some watchdog in the firmware that basically watches for any incoming connections and when it sees one it doesn't even stop to check if the adapter is enabled or disabled, it just straight up forwards the handshake to the OS. Windows, being the helpful friendly neighborhood OS it is, say's "Oh cool, a handshake? I know what to do with those" and just establishes the connection and, it being a new audio device, starts using it."

TK_248 said:

Here's the best explanation I've got:

"I think that what is happening is that when you disable it in BIOS, the firmware is like "okay, we won't tell windows about this device", so when windows boots and it asks the chipset "hey, what devices do you have?" it gives the whole list and leaves out the BT adapter. But it doesn't actually disable anything by, like, cutting power to it. And there is some watchdog in the firmware that basically watches for any incoming connections and when it sees one it doesn't even stop to check if the adapter is enabled or disabled, it just straight up forwards the handshake to the OS. Windows, being the helpful friendly neighborhood OS it is, say's "Oh cool, a handshake? I know what to do with those" and just establishes the connection and, it being a new audio device, starts using it."

Click to expand...

If you understood it's the "motherboard" via BIOS settings that tells the OS what hardware is available for use, and not the other way around, you'd realize how wrong your assumption is. If you disable something in the BIOS, the OS can't see it, and therefore can't use it.

It's why I asked how you disabled BT in the BIOS? Meaning are your sure you did what you think you did?

Is the Samsung connected by WiFi to the same network your computer is hardwired to?
Do your headphones charge by a cable connected to a usb port on your computer?
Does the Bluetooth settings still show up when Bluetooth is disabled?
Have you recently done a motherboard update that could've reset your motherboard configuration to factory defaults?

I also have the Z790 Creator WiFi motherboard and can confirm that I also have the same issue. It took me a lot of searching before I found someone else with the same problem. I just contacted Asus and will let you know their response.