QUESTION: Can an empty, but used, usb flash drive that has NO firmware within it be infected with malware?

I have been told by a networking and security expert that malware will only attach to (write to) firmware on an empty microsd card or empty usb-flash drive; that there is no where else for it to write to in this case (empty).

PLEASE NOTE: SANDISK rep just told me that none of their usb-flash drives or microsd cards have any firmware; actually 2 of the reps, one being very knowledgeable about the inner workings of media. this is not the "expert" I referenced above.

  • Is there a USB drive without firmware?
    – schroeder
    Commented Oct 27, 2020 at 18:08
  • I think you misunderstood the Sandisk rep. All USB drives have firmware. Not all firmware is writable.
    – schroeder
    Commented Oct 27, 2020 at 18:17
  • 1
    Technically every stick can be "infected" if electronic parts allow this, or hardware infected devices. Commented Oct 27, 2020 at 18:18
  • 2
    There has to be firmware. Something has to make sense of the stored bits to the OS that's reading them. Something has to tell the OS that there's a USB device and that it's a storage device. There is firmware. If you stick in a USB stick, and it shows up in File Explorer with a name; that's provided by the firmware on the stick.
    – schroeder
    Commented Oct 27, 2020 at 18:41
  • 1
    You cannot just connect the flash chips straight on the USB port and call it a day. Something must tell the computer that the device runs USB protocol (and it's not a charging cable), it's a mass storage device (not a webcam), is running USB 2 (not USB 5.2 update 123), things like that. And that something is the firmware.
    – ThoriumBR
    Commented Oct 27, 2020 at 22:22

2 Answers 2


Just to combine the several commented replies and add my own view:

  • There is NO usb device without Firmware (even if you call it something else).
  • There are usb devices where you can NOT update the firmware (it’s on a rom chip of worm memory chip). -There are more ways than just firmware to hide code.
  • The firmware on the usb chip of the flash drive has to hold Atleast the following :manufacturer id. Device id. Device version. Usb version, device type is. It must also interact with the host controller in the computer (which means running a program which means there is a firmware)
  • there are several different type of malware and malware delivery mechanisms. You can not assume any of them in general.
  • data can even be stored in “empty space” (especially on solid state storage) since malware can ignore normal operation limitations.
  • the rep from SANDISK does not know what he’s/she’s talking about if he / she really think there is no firmware. There is no user upgradable firmware maybe but that is not the same as no firmware.

As a final note. We are not doubting the rep said those things to you. We are doubting the validity of what the rep said. (Because it’s wrong technically)

Thanks to the following people for there amazing responses in comments:


I believe that there is a misunderstanding on the rep's part about what "firmware" means. ixpand has encryption built-in, so there would need to be extra functions on the device to make that work.

But regardless of what things are called, you are worried about malware infecting the USB device itself, and not files, like BadUSB does. BadUSB does not require fully-functioning, extra-featured firmware. It goes after, let's call it a "widget" on the device that allows the USB to communicate with the computer. And yes, all USB drives have this "widget".

So, the "widget" can have vulnerabilities that can be targeted. Not all of them are vulnerable, and there are so many different types of "widgets" that it can be difficult to predict which devices might end up being vulnerable.

Your security expert is also not quite right, or the phrasing is strange. Some malware will write new infected files on the drive. And, yes, if it is designed to, it could seek out vulnerable "widgets" to infect. This is not a normal function for malware and it would have to be specially written for this use case, and the USB would have to be vulnerable. It's not an automatic fallback for malware.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .