3 ms·

Read the article. They're not bricking things this time, just refusing to talk to them. And quite frankly, why should they be responsible for any of those thin

by st3v3r 11y ago

Read the article. They're not bricking things this time, just refusing to talk to them. And quite frankly, why should they be responsible for any of those things? Shouldn't the fault be on the people who used fake chips?

orclev 11y ago
Not quite, failing to talk to them would be not sending anything, what they're actually doing is much worse. Based on what people have seen it's sending random data to the device. E.G. I send it something like "Hello World" and it sends the device "Launch Nuke". If it actually failed to talk to the device that wouldn't be too bad, it would just look like the chip was defective. What it's doing is massively dangerous because it's basically performing fuzzing on the underlying device and who knows what that might trigger.
- ohazi 11y ago
  > What it's doing is massively dangerous because it's basically performing fuzzing on the underlying device and who knows what that might trigger. Yes, this exactly. Most of the systems these chips are attached to are tiny embedded processors with very little RAM and no memory protection. It's almost a given that a non-negligible number of these systems will crash on this kind of input. The FTDI chip wouldn't even need to be in a critical signal path if it's spewing garbage all over memory.
tyingq 11y ago
Actually, no. Refusing to talk to them would result in the "Error 10", and the driver not loading. What they are doing is allowing the driver to attach, and then sending arbitrary random crap down the line. >>Shouldn't the fault be on the people who used fake chips? It doesn't appear that the problem is people buying fake chips on purpose. All of the large chip distributors have unwittingly sent out fakes. This approach punishes - the end users, who likely had no role in this at all - manufacturers of devices who thought they were buying legit chips

by st3v3r 11y ago

orclev 11y ago

Not quite, failing to talk to them would be not sending anything, what they're actually doing is much worse. Based on what people have seen it's sending random data to the device. E.G. I send it something like "Hello World" and it sends the device "Launch Nuke". If it actually failed to talk to the device that wouldn't be too bad, it would just look like the chip was defective. What it's doing is massively dangerous because it's basically performing fuzzing on the underlying device and who knows what that might trigger.

ohazi 11y ago
> What it's doing is massively dangerous because it's basically performing fuzzing on the underlying device and who knows what that might trigger. Yes, this exactly. Most of the systems these chips are attached to are tiny embedded processors with very little RAM and no memory protection. It's almost a given that a non-negligible number of these systems will crash on this kind of input. The FTDI chip wouldn't even need to be in a critical signal path if it's spewing garbage all over memory.

tyingq 11y ago

Actually, no. Refusing to talk to them would result in the "Error 10", and the driver not loading. What they are doing is allowing the driver to attach, and then sending arbitrary random crap down the line. >>Shouldn't the fault be on the people who used fake chips? It doesn't appear that the problem is people buying fake chips on purpose. All of the large chip distributors have unwittingly sent out fakes. This approach punishes - the end users, who likely had no role in this at all - manufacturers of devices who thought they were buying legit chips