Just to combine the several commented replies and add my own view:
- There is NO usb device without Firmware (even if you call it something else).
- There are usb devices where you can NOT update the firmware (it’s on a rom chip of worm memory chip). -There are more ways than just firmware to hide code.
- The firmware on the usb chip of the flash drive has to hold Atleast the following :manufacturer id. Device id. Device version. Usb version, device type is. It must also interact with the host controller in the computer (which means running a program which means there is a firmware)
- there are several different type of malware and malware delivery mechanisms. You can not assume any of them in general.
- data can even be stored in “empty space” (especially on solid state storage) since malware can ignore normal operation limitations.
- the rep from SANDISK does not know what he’s/she’s talking about if he / she really think there is no firmware. There is no user upgradable firmware maybe but that is not the same as no firmware.
As a final note. We are not doubting the rep said those things to you. We are doubting the validity of what the rep said. (Because it’s wrong technically)
Thanks to the following people for there amazing responses in comments: