181–190 of 315 posts
I tried reporting this to Microsoft; their handling of calls to report security vulnerabilities was just horrendous. ===== Hi, I've been advised to email this address by 'XXXX' at Microsoft Support. FTDI is shipping a malware driver for Windows; if it detects what it thinks is a counterfeit device plugged in by USB, it bricks it. Details here: http://www.eevblog.com/forum/reviews/ftdi-driver-kills-fake-... I've also…
Earlier quoted context omitted.
You're damaging someone's hardware without their consent? Its essentially vandalism.
Sure, but the chips are illegal no? Where is the moral high ground coming from... I'm not a supporter of intellectual property laws, but we have them, so I'd also be curious of any legal ground fake chip users have to stand on.
To the extent the violations are with manufacture and sale, the user is not generally the appropriate target, even if destruction of the device was an appropriate remedy.
Earlier quoted context omitted.
The counterfeit FTDI chips are apparently reimplemented from scratch using a completely different design, one based around a USB microcontroller of some kind. They're a commodity because they're really easy to create.
Yeah, I never really understood how they justified the prices on their chips when you could literally code the same thing in a week or two on a micro which was half the price. About the only reason I see to use them is they have quite neat pre-made cable assemblies.
Earlier quoted context omitted.
Making alterations to someone else's property without their consent for the express purpose of rendering it non-functional is commonly called vandalism.
In a culture with intellectual property laws I'm not sure that's true. Is it legal to destroy counterfeit handbags commonly sold on the street? Honest question, the police seem to do it frequently.
I'm designing an Arduino-compatible board[1] that supposed to have an FTDI chip for ease of design. This whole thing makes me reconsider it, what would be the best way to replace it some other solution? Do I have any real option if I want to stay within the Open Parts Library[2]? [1]: https://www.hwtrek.com/product_preview/VTZUZV9k [2]: http://www.seeedstudio.com/wiki/Open_parts_library
It's interesting to consider from a legal perspective exactly why this isn't something a company is allowed to do. (Assuming the company did in fact intentionally damage people's chips, reversibly or not -- sounds like we don't know for sure yet?) - Intentionally sabotaging someone's stuff, legally, is more or less the same as intentionally taking it. Keying a car and driving it away might have different names but ar…
I think in the FTDI case, though, it would be really hard to argue that the end users should (or even could) know that the chip they have is counterfeit.
Earlier quoted context omitted.
They change the PID to zero, which means Windows won't associate it with FTDI or any other driver. You have to jump through some manual hoops to undo it, which is something most people can't do. So for all intents and purposes it is bricked, a.k.a "locked out".
Most HN'ers seem to agree it is OK for FTDI to prevent their own drivers from working with the fakes, right? The fact that there are no OTHER drivers that are compatible (no matter what the pid is) with the fakes isn't their problem, is it?
They are not entitled to break the hardware by changing the PID so it doesn't work with any drivers.
There are other drivers that work when the PID is left intact.
Earlier quoted context omitted.
Nobody would fault FTDI for releasing new drivers that don't work with counterfeit parts. That alone would cause enough inconvenience to manufacturers to make sure they use legitimate parts. It's the (unethical) bricking of the parts that has everybody up in arms.
"bricking" doesn't seem to be the right word. FTDI is making it so that the counterfeit chips don't work with any FTDI drivers, old or new. (Per the thread, all that happens is the PID is changed to a PID that no FTDI driver will recognize)
The new Windows driver changes the PID to 0, and then the driver won't
recognize the device (even if you edit the INF file), and you can't use
the config tool. The workaround is to use a Windows XP or Linux system to
change the PID back, and then don't use the new driver.
This is really skirting the ethical line and I'm not sure I can agree with their methods. I'm fine with them writing a driver that fails to work with counterfeit chips, but not actively disabling the chip. What if the device is attached to more expensive equipment that will also fail? We can't ensure that these chips are knowingly purchased after all.
This motivation reminds me of when the U.S. and Syrian governments disseminated sabotaged munitions that explode in the weapon, killing/maiming the operator, among their opponents. The danger is that they will find their way back to friendlies.
I tried reporting this to Microsoft; their handling of calls to report security vulnerabilities was just horrendous. ===== Hi, I've been advised to email this address by 'XXXX' at Microsoft Support. FTDI is shipping a malware driver for Windows; if it detects what it thinks is a counterfeit device plugged in by USB, it bricks it. Details here: http://www.eevblog.com/forum/reviews/ftdi-driver-kills-fake-... I've also…
I don't think MSRC is supposed to handle this kind of stuff.
If anyone is curious what a real vs fake FTDI chip looks like under the hood (de-capped chip) this is a great analysis and some beautiful pictures. http://zeptobars.ru/en/read/FTDI-FT232RL-real-vs-fake-supere... Exerpt: "What's the economic reason of making software fake of well-known chip instead of making new one under your own name? This way they don't need to buy USB VID, sign drivers in Microsoft, no expenses on…
What is the HN crowd's preferred way of dealing with that kind of parasite?