FTDI driver kills fake FTDI FT232s

Post by coldpie » Thu, Oct 23, 2014, 1:10 PM UTC

gioele wrote: post #69

0x0 wrote: post #19

I hope this causes a major and publicly visible malfunction in some important device/installation/machinery, of course with no harm done to any persons, but enough of an embarrasment to really set an example, so no vendor will think of pulling tricks like these in the future. Takeaway lesson: End users should never touch anything remotely FTDI-like, since it's probably impossible to verify if the device is genuine or…

My takeaway lesson is that end users should never trust closed source drivers. Can you picture a Linux or *BSD driver in which there is an intentional if (counterfeit) { do_damage(); }

Post by tlrobinson » Thu, Oct 23, 2014, 3:39 PM UTC

wtallis wrote: post #235

tlrobinson wrote: post #233

Earlier quoted context omitted.

If the counterfeit FTDI chips are using FTDI's registered USB vendor ID (I assume they are, otherwise the driver wouldn't recognize them?) I think the blame falls solely on the counterfeit chip makers.

Why? The counterfeits aren't seeking USB compliance certification, they're just trying to provide 100% compatibility. Are you saying that reverse engineering and spoofing for the sake of compatibility is wrong? Or do you think that USB vendor IDs are covered by some trademark?

Post by namdnay » Thu, Oct 23, 2014, 4:46 PM UTC

npsimons wrote: post #124

simias wrote: post #104

Earlier quoted context omitted.

Come on, take a deep breath. We're talking about bricking a serial to USB chip, not something worth shedding blood really. As far as unethical behavior by corporation is concerned I really not think it's even noteworthy.

We're talking about bricking a serial to USB chip, not something worth shedding blood really. We're talking infrastructure: if this was a civil engineer designing a road to spontaneously create potholes that would flatten tires on certain brands of vehicles, they'd be put in the slammer post haste. FDTI has no idea where their chips and drivers will end up, and as designers of such low-level infrastructure type devic…

Post by ja27 » Thu, Oct 23, 2014, 6:03 PM UTC

markrages wrote: post #71

ja27 wrote: post #47

Earlier quoted context omitted.

It's quite possibly a violation of U.S. Code 1030(a)(5)(A), a federal felony: (5) (A) [Whoever] knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; Now "protected computer" and the [ab]use of the Interstate Commerce Clause mean that the device with the FTDI would likely need to be co…

FTDI is not a US company.

Post by mey » Thu, Oct 23, 2014, 6:31 PM UTC

duncan_bayne wrote: post #193

mey wrote: post #11

I haven't gotten into the DIY/Hacker/Arduino stuff but it seems like there would also be plenty of consumer devices that may be impacted that don't have correct supply chain control (or care about the source of their chips). I wonder if Windows will pull the driver.

Microsoft has confirmed that they're aware of the issue, and are investigating. No news yet on what (if any) action they'll take. But I'd expect they'll do something, as it would appear to the end user that "Windows Update broke my $DEVICE".