2

All answered questions seem to relate to peripherals only. Can BadUSB infect the port pcb chip within a laptop or internal desktop hub (i.e. the strip of usb ports along side a laptop or atop a desktop)? Don't some internal hubs use reprogrammable controller chips too?

Seems the answer is probably yes: Hubs

Stix
  • 21
  • 2

1 Answers1

1

No.

Just because a hub's IC is programmable doesn't mean it's up-gradable by the USB interface it hosts. The common interfaces (SPI, ISP) typically used to update firmware are physically distinct from the USB lines. While you can smash open a hub and parasitically rewrite its flash (a lot of manufactures leave the programming/test pads exposed), there's no built in "firmware update mode" to do so over USB, no matter what you stick in the slot.

In theory, it's perfectly feasible to include a USB host interface into the hub's logic board. The hub would insertion-ding twice in windows and show up in device manager if so... But, it would cost extra to build an adapter into the design to provide such an un-wanted and frankly dangerous capability, so a mass-market manufacture would be highly un-likely to do so.

dandavis
  • 2,693
  • 11
  • 16
  • Lots of devices have upgradeable firmware through the operating system. You are right in that it's not probable, or in most cases physically possible, to update a bus or hub directly from a usb device, i.e. a flash drive. However, doesn't BadUSB run at kernel/system level? Kernel level allows for infection of peripheral firmware through the operating system. The blackhat talk stated that it was capable of infecting the bios, which implies infecting everything attached. – Stix May 16 '17 at 04:32
  • @Stix: no, there's no way for the computer to update it either; you need a physically distinct connection – dandavis May 16 '17 at 13:11