No external flash/eeprom, but footprint available on PCB.Supports configuration data on external EEPROM.GetDigital 7 Port USB2.0 Hub with switches ¶ Installation of update utility results in 20 KiB firmware file, contains 8051 code and USB descriptors.File Usb3HubFWUpgrade_Setup_V0.41_VL810_0960.exe looks like it is an installer.The VIA VL810 from VIA Labs is the industry's first fully integrated single chip solution => Very early USB3 hub.VIA Labs VL810 with Pm25LD512 SPI Flash (512 Kbit / 64 KiB):.=> Most likely vulnerable, but practical attacks may be difficult due to unknown instruction set Support full in-system programming firmware upgrade by SPI-flash.With 256-byte RAM, 16K-byte internal ROM & 16K-byte SRAM.Often used on Motherboards, may allow persistent infection of board even if BIOS/UEFI only accepts signed upgrades.G元520 HUB (No physical device available, found while searching for USB Hub firmwares) ¶ External EEPROM for configuration data possible.8-bit RISC processor with 2K ROM and 64 bytes RAM => Not reprogrammable, very few resources for programming an attack.Device built from two GL850G hubs, no external Flash/EEPROM chips present.File Usb3HubFWUpgrade_Setup_V0.46_VL811_0972.exe is a windows installer, installation results in a 16 KiB firmware file, which contains 8051 code and USB descriptorsħ Port noname USB2 Hub ¶.Official firmware upgrade tools available from VIA:.Exe file contains an area with a valid device descriptor, two valid USB configuration descriptors and various string descriptors.this one), so a persistent infection of a computer, may be possible Uploadable Firmware & configuration via upstream port:.SPI flash support for customized firmware.Integrated 8-bit RISC microprocessor => Probably not 8051.Disassembled Hubs ¶ ASMedia ASM1074 usb3 hub ¶ If the hub is reprogrammable (which is often the case for USB3.0 hubs), this allows persistent infection of the main board even if the BIOS/UEFI is protected against unauthorized/unsigned upgrades. One interesting point about hubs, however, is that many main boards (and Notebooks) contain a USB hub. This - and the fact that hubs are not terribly mobile usb devices in general - make this whole category relatively unexciting for BadUSB.

The majority of controllers found in web searches appear not to feature firmware upgradable microcontrollers. They are required by specification to have EP0/ctrl and EP1/int. Hubs are in principle a viable target for BadUSB style attacks.

Logilink ua0091