Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FTDI removes counterfeit-bricking driver from Windows Update

eevblog.com

Post reply on HN
Print view View original

51–60 of 131 posts

Re: FTDI removes counterfeit-bricking driver from Windows Update

#51

Post by welterde »

bri3d wrote: post #49
userbinator wrote: post #39

It's also important to keep in mind that the driver bricked not only counterfeits that were illegally marked with FTDI's name, but legal clones (reverse-engineered reimplementations which are not marked as being from FTDI) that had the same slight difference in behaviour from the original.

The reverse-engineered reimplementations / clones would have to have been programmed with an FTDI VID (or included modified FTDI drivers) in order for the FTDI drivers to claim them, so I'm not so sure about the "not marked as being from FTDI" bit.

As far as I know that's perfectly legal.. you are just not allowed to put the USB logo onto the device if you clone the VID from another vendor.

And you seemingly can buy FTDI clones that are not marked as FTDI on the casing.

Re: FTDI removes counterfeit-bricking driver from Windows Update

#52

Post by otikik »

expr- wrote: post #12

I disagree with the consensus. It's their driver, it operates in a specific way, perhaps responding to possible device output. Using it with non-compatible parts advertising themselves as compatible and any resulting behaviour, including unwanted, is the responsibility of the user. To play it safe, don't use any drivers with incompatible hardware.

What is the limit there, then? Would it be ok for the chip to, say, install spyware to look for my credit card data and steal money from me? That is also "unwanted behavior".

I would be ok if the driver simply refused to work. But making hardware unusable on purpose is too much.

Re: FTDI removes counterfeit-bricking driver from Windows Update

#53

Post by learc83 »

nraynaud wrote: post #41

That's a good lesson for people always wanting the famous brands. FTDI chips are more expensive and not better than the other ones, they need a special driver and they are subject to counterfeiting. You take a no-name one, and you have a standard stuff. It's a stupid USB to RS232, not a rocket control system, there should be no famous brand, it's the lowest of the commodities. That said, I do have an FTDI USB to seri…

With the no name brands (at least the ones that aren't just using FTDI's drivers) you are more likely to have to install a driver.

Re: FTDI removes counterfeit-bricking driver from Windows Update

#54

Post by HCIdivision17 »

kabdib wrote: post #47
HCIdivision17 wrote: post #20

Earlier quoted context omitted.

You'd be right if this weren't just a chip buried in a device. To properly implement that, we'd need to be able to safely scan and verify devices on the chip-level. That's not really an option. The end user is only ever going to be informed by the driver telling them it's invalid; in this case the notification is the silent crippling of the gizmo, with no feed back or diagnostics. As many have noted, all that's neede…

Alerting the user from a driver is a bad, bad thing. I believe it is not allowed by WHQL certified drivers. (It's also non-trivial to do in a Windows kernel driver. You can't call MessageBox(), you can't process user input, you can't even get a context to draw on the screen. Basically you have to rely on a user-mode helper app that gets launched at boot time, which is one of the reasons you see so many device-tweakin…

Oh absolutely. To me, it's just choosing the lesser of two evils.

Like, I'd rather go to jail and be inconvenienced instead of shot on sight, but I feel both are overkill for a parking ticket.

Re: FTDI removes counterfeit-bricking driver from Windows Update

#55

Post by HCIdivision17 »

serf wrote: post #34
HCIdivision17 wrote: post #27

Earlier quoted context omitted.

I'm not an expert on USB protocol, so I'm not sure how your suggestion would work. The driver bricks it in the sense that the Product ID of the device is wiped (zero'd). As a result, the OS doesn't know what to do with it or what drivers to connect it with. Is there some signature to the USB device that would allow the OS to know what to do with the affected gizmos? Or do you have to explicitly tell the system "no, r…

It's an eight step process. http://www.reddit.com/r/arduino/comments/2k0i7x/watch_that_w...

Dang. If a person's not familiar with the ins and outs of USB protocol, I'm going to bet they're not going to be able to think up or through that procedure. At best it'd just be some incantation to recite in the hopes the gizmo comes back to life. And if you're using the FTDI chip specifically because it abstracts away serial to USB communication stuff, well, hopefully the device is cheap enough to just replace.

Still, perhaps it could be automated somehow via a responding Windows Update? That's the thing that gets me - it was autmatically propagated, it oughtta be automatically fixed.

Nice find though.

Re: FTDI removes counterfeit-bricking driver from Windows Update

#56

Post by wpietri »

Someone1234 wrote: post #2

Good for them. I mean that. If they want to redesign their driver so it fails to work with non-genuine FTDI chips, go for it. Nobody will judge them. Heck if they want to show a message that informs the user they're using a fake, that's fine too. I think most people seemed to agree that bricking fakes was too far (and also could be considered illegal in some countries/areas). It also negatively impacted innocent part…

> and also could be considered illegal in some countries/areas

Is there some country where it's legal to break somebody's property because you have a beef with a third party?

Certainly in the US if somebody produced a virus that did this nobody would even blink at a federal prosecution. That FTDI slipped a bit of text into a document nobody reads doesn't strike me as relevant. If a piece of malware also popped up an innocuous dialog with a terms link and a user clicked ok, nobody sane would say that the malware-writer was legally in the clear.

If FTDI doesn't end up prosecuted over this, I think it's less about the relevant laws and more about how prosecutors view people with money and status who commit crimes in pursuit of profit. Versus, of course, somebody like Aaron Swartz, who not only failed to wear a suit, but was engaged in a political act against the status quo. Crime that improves profits is currently more acceptable than crime that harms profits.

Re: FTDI removes counterfeit-bricking driver from Windows Update

#58

Post by raverbashing »

bri3d wrote: post #22
Someone1234 wrote: post #2

Good for them. I mean that. If they want to redesign their driver so it fails to work with non-genuine FTDI chips, go for it. Nobody will judge them. Heck if they want to show a message that informs the user they're using a fake, that's fine too. I think most people seemed to agree that bricking fakes was too far (and also could be considered illegal in some countries/areas). It also negatively impacted innocent part…

What I don't understand is why they don't make the messaging more clear. In their pre-bricking drivers, FDTI caused the counterfeits to fail in confusing and counterintuitive ways, rather than just telling the user that the chip is fake. As a user, if my device stops working randomly, my first thought is certainly not "there was a counterfeit chip in the supply chain for this hardware and the drivers must be rejectin…

" In their pre-bricking drivers, FDTI caused the counterfeits to fail in confusing and counterintuitive ways, rather than just telling the user that the chip is fake."

Or maybe because the fake chip is not working in some corner case exactly as the original chip?

It's probably not something deliberate.

Edit: Do you really think the manufacturer should test their driver agains all fake chips and see how they behave? Really?

They test their chips and their software first and foremost. What happens outside of that is not their responsibility.

Re: FTDI removes counterfeit-bricking driver from Windows Update

#59

Post by Vendan »

JoeAltmaier wrote: post #21
expr- wrote: post #12

I disagree with the consensus. It's their driver, it operates in a specific way, perhaps responding to possible device output. Using it with non-compatible parts advertising themselves as compatible and any resulting behaviour, including unwanted, is the responsibility of the user. To play it safe, don't use any drivers with incompatible hardware.

That's reasonable, until they start deliberately destroying my property. Then its a civil case. Do we have any evidence either way, deliberate or accidental?

https://twitter.com/marcan42/status/525202516816842752

They figured out how to program the clones without programming their own chips. Looks freaking intentional to me, I don't know any reason to send commands to write to an eeprom and do a pre-image attack on a checksum just on opening a connection. Also explains why just the PID is changed, not the VID. It would have affected their chips if they tried changing the VID.

Post reply on HN