FTDI driver kills fake FTDI FT232s • Hacker News Board

Re: FTDI driver kills fake FTDI FT232s

#161

Post by greglindahl » Wed, Oct 22, 2014, 11:09 PM UTC

nsxwolf wrote: post #134

geographomics wrote: post #107

Earlier quoted context omitted.

Can we be sure that FTDI has programmed their driver with malicious intent? It may be that this an accidental side-effect of using counterfeit hardware with a genuine driver. Without access to the source code or a well-reversed disassembly of the FTDI driver, and a good grasp of the logic used in the counterfeit chip, one cannot be certain about this. And surely not to the extent of urging Microsoft to revoke driver…

They basically admit it on their license page: http://www.ftdichip.com/Drivers/FTDriverLicenceTerms.htm "Use of the Software as a driver for, or installation of the Software onto, a component that is not a Genuine FTDI Component, including without limitation counterfeit components, MAY IRRETRIEVABLY DAMAGE THAT COMPONENT."

It appears that from @FDTIChip's twitter stream that in fact they do think that this ambiguous license clause makes it OK to deliberately destroy hardware. https://twitter.com/FTDIChip/status/524918979840585729

Re: FTDI driver kills fake FTDI FT232s

#162

Post by Dylan16807 » Wed, Oct 22, 2014, 11:10 PM UTC

tmp26 wrote: post #135

swamp40 wrote: post #97

Earlier quoted context omitted.

Nobody would fault FTDI for releasing new drivers that don't work with counterfeit parts. That alone would cause enough inconvenience to manufacturers to make sure they use legitimate parts. It's the (unethical) bricking of the parts that has everybody up in arms.

"bricking" doesn't seem to be the right word. FTDI is making it so that the counterfeit chips don't work with any FTDI drivers, old or new. (Per the thread, all that happens is the PID is changed to a PID that no FTDI driver will recognize)

Or any other drivers, because it breaks it at the USB level, doesn't it?

Re: FTDI driver kills fake FTDI FT232s

#163

Post by tmp26 » Wed, Oct 22, 2014, 11:12 PM UTC

swamp40 wrote: post #156

tmp26 wrote: post #135

Earlier quoted context omitted.

"bricking" doesn't seem to be the right word. FTDI is making it so that the counterfeit chips don't work with any FTDI drivers, old or new. (Per the thread, all that happens is the PID is changed to a PID that no FTDI driver will recognize)

Hey, an FTDI employee! I'm surprised you found time away from scrubbing your Facebook page clean of all the disparaging comments. My advice: Skip breakfast tomorrow morning - you're going to be eating quite a bit of crow for lunch.

Right, I forgot, anyone who isn't part of the lynch mob is a shill.

I rarely eat breakfast in the first place, sadly.

Re: FTDI driver kills fake FTDI FT232s

#164

Post by duncan_bayne » Wed, Oct 22, 2014, 11:22 PM UTC

duncan_bayne wrote: post #158

I tried reporting this to Microsoft; their handling of calls to report security vulnerabilities was just horrendous. ===== Hi, I've been advised to email this address by 'XXXX' at Microsoft Support. FTDI is shipping a malware driver for Windows; if it detects what it thinks is a counterfeit device plugged in by USB, it bricks it. Details here: http://www.eevblog.com/forum/reviews/ftdi-driver-kills-fake-... I've also…

An update to this: the security folks have told me it’s not a security issue, but they’re forwarding it to the appropriate team.

Perhaps I’m biased, but I’d have thought that a Windows Update that ships malware that bricks thousands of consumer devices without warning would constitute a security issue.

But hey … at least they’re actioning it, and they responded so quickly. So, FYI: if you have a security issue to report to Microsoft, do it by email. Phone staff are utterly, completely useless for this.

Re: FTDI driver kills fake FTDI FT232s

#165

Post by tmp26 » Wed, Oct 22, 2014, 11:23 PM UTC

Dylan16807 wrote: post #162

tmp26 wrote: post #135

Earlier quoted context omitted.

"bricking" doesn't seem to be the right word. FTDI is making it so that the counterfeit chips don't work with any FTDI drivers, old or new. (Per the thread, all that happens is the PID is changed to a PID that no FTDI driver will recognize)

Or any other drivers, because it breaks it at the USB level, doesn't it?

I don't think so. There was at least one guy in the thread who reprogrammed the PID back, and the chip worked with the old FTDI drivers again, which means the USB interface was working just fine (or else how could he access it to change it back).

Re: FTDI driver kills fake FTDI FT232s

#166

Post by wtallis » Wed, Oct 22, 2014, 11:25 PM UTC

michaelt wrote: post #148

wtallis wrote: post #128

Earlier quoted context omitted.

Right. That would be the trademark infringement I mentioned. But aside from that, the fakes get the job done . Aside from who ends up getting the revenue, it's basically no different than if FTDI started producing a new revision of the product that had a different internal layout. Accidental second-sourcing doesn't really hurt anyone other than the first source. Everyone downstream of whoever bought the counterfeits…

Accidental second-sourcing doesn't really hurt anyone other than the first source. It hurts the entire electronics industry industry if I can't trust that a part is what it's labelled as, or if I can't trust a supplier not to deliver fake parts. If your suppliers can substitute a fake FTDI part, why not label 10% precision resistors as 1% precision, or label 1,000-operating-hour capacitors as 30,000-operating-hour, o…

None of that corner-cutting is being alleged here. Nobody but FTDI has been complaining about the counterfeits. This has every indication of being more like a big pharmaceutical company complaining about generic drugs. If these clones are actually deficient in some way, then they're a much bigger problem, but that doesn't seem to be the case here.

Re: FTDI driver kills fake FTDI FT232s

#167

Post by duncan_bayne » Wed, Oct 22, 2014, 11:27 PM UTC

duncan_bayne wrote: post #158

I tried reporting this to Microsoft; their handling of calls to report security vulnerabilities was just horrendous. ===== Hi, I've been advised to email this address by 'XXXX' at Microsoft Support. FTDI is shipping a malware driver for Windows; if it detects what it thinks is a counterfeit device plugged in by USB, it bricks it. Details here: http://www.eevblog.com/forum/reviews/ftdi-driver-kills-fake-... I've also…

Another update: Microsoft had already been made aware of the issue, and were investigating. I've lodged a formal compliment over the way their security team responded to my report (once I found them). Prompt, helpful, efficient and reassuring.

Re: FTDI driver kills fake FTDI FT232s

#168

Post by jhallenworld » Wed, Oct 22, 2014, 11:32 PM UTC

userbinator wrote: post #151

jhallenworld wrote: post #147

The real problem here is that USB does not define a standard interface for an RS-232 adapter. Proprietary drivers should never have been required for these. Same deal for Centronics printer adapters.

It does, it's called CDC and there are plenty of other adapters that use it. Which is why I think the popularity of FTDI adapters is surprising in some ways.

Very interesting. I've been reading all about it: http://www.recursion.jp/avrcdc/driver.html

Re: FTDI driver kills fake FTDI FT232s

#169

Post by wtallis » Wed, Oct 22, 2014, 11:33 PM UTC

tmp26 wrote: post #165

Dylan16807 wrote: post #162

Earlier quoted context omitted.

Or any other drivers, because it breaks it at the USB level, doesn't it?

I don't think so. There was at least one guy in the thread who reprogrammed the PID back, and the chip worked with the old FTDI drivers again, which means the USB interface was working just fine (or else how could he access it to change it back).

Having to write custom driver-level code to repair something falls pretty well inside the accepted usage of "bricked". It's only marginally easier than just hooking up a JTAG interface.

Re: FTDI driver kills fake FTDI FT232s

#170

Post by bravo22 » Wed, Oct 22, 2014, 11:33 PM UTC

tmp26 wrote: post #165

Dylan16807 wrote: post #162

Earlier quoted context omitted.

Or any other drivers, because it breaks it at the USB level, doesn't it?

I don't think so. There was at least one guy in the thread who reprogrammed the PID back, and the chip worked with the old FTDI drivers again, which means the USB interface was working just fine (or else how could he access it to change it back).

They change the PID to zero, which means Windows won't associate it with FTDI or any other driver. You have to jump through some manual hoops to undo it, which is something most people can't do. So for all intents and purposes it is bricked, a.k.a "locked out".