6 ms·

Fake hardware could open the door to malicious malware and critical failures

54 points by jnord 10y ago

nraynaud 10y ago
remember that cheap clones also foster innovation, by spreading tools that would be completely inaccessible to people without money, that's how computers revolutionized the world. With some cheap fake arduinos, cheap fake Saleae, and cheap fake FTDI chips, you can start prototyping while others are still counting their money to buy a $35 arduino. When you've established your working capital, you will buy brand-name stuff.
- lelandbatey 10y ago
  Making a cheap clone isn't really morally problematic to me. If a consumer has more options AND can make effective judgments about the level of quality they're buying, then consumers are probably happy. What is problematic is deceptive labeling/marketing such as saying "why yes, this is of course a genuine pacemaker".
  - mikeash 10y ago
    And to be clear, the article is talking about that last kind. I think its terminology is rather off: I'd consider a "clone" to be something built to be similar, maybe compatible, but clearly marketed as its own thing, and the subject of the article would be "counterfeits." But for some reason they're using "clones" to describe stuff that's passed off as the original.
- ceejayoz 10y ago
  > When you've established your working capital, you will buy brand-name stuff. Whereupon the problem reasserts itself, as even attempting to pay a reasonable price on Amazon often winds up with a counterfeit.
  - nraynaud 10y ago
    For electronics you go to the old school distributors to get legit tools and chips.
    - mikeash 10y ago
      There have been many cases recently where counterfeit goods made it into genuine distribution channels, sometimes even being distributed by the original maker itself.
- tyingq 10y ago
  They don't have to make counterfeits to meet that goal though. For example, there are USB to serial chips like the ch340 that are genuine, but still cheap.
  - makomk 10y ago
    There's a certain amount of software out there that requires the non-standard bit banging features of the FTDI adapters. The cloners have done a really good job of implementing this (works better than the real thing, apparently).
- joshvm 10y ago
  Arduino is an example of open hardware. You can't sell a branded Arduino clone, but you are perfectly entitled take the schematic, build a clone board and sell it for peanuts. Fake FTDI is more of a problem because of the recent debacle where the drivers wouldn't work with counterfeit chips. I've often had Sparkfun boards fabbed via Oshpark, rather than buy and pay for expensive shipping from the States.
- Baeocystin 10y ago
  My cheap fake Saleae is what convinced me to buy a real one a year later. (Logic is a lot nicer than Sigrok.) I'm mostly a software/IT guy, and EE is new to me, and I did not have a large starting budget. Turns out it's a blast, but I quite simply would not have been able to buy what I needed to outfit a decent electronics bench if it wasn't for eBay and Shenzhen.
userbinator 10y ago
But they may also host unwanted or even malicious software, firmware, or hardware—and the buyer may not know the difference, or even know what to look for. Alternatively, the clones are often the ones which will omit the user-hostile DRM and such. Thus you get HDMI splitters which don't actually re-encrypt HDCP, DVD players which don't implement region restrictions or the "unskippable" bits (https://en.wikipedia.org/wiki/User_operation_prohibition https://en.wikipedia.org/wiki/User_operation_prohibition ) , Androids with unlocked bootloaders by default, etc. Of course, to an organisation like the IEEE, who have always appeared to be pro-DRM, pro-IP, pro-copyright, that would probably be considered "malicious"... The whole safety/security argument, while true, I think is somewhat overblown and these days increasingly used to justify an authoritarian agenda.
- jfoutz 10y ago
  I think the IEEE is just ethical. Faithfully build the thing you're paid to build. It's probably not fair to call the encryption free splitter an HDMI splitter. If you build it, call it something else so you don't dilute the standard. Of course, i don't have a lot of experience with IEEE, they may actually be super pro-DRM, and my opinion could be swayed.
  - Sunset 10y ago
    No. Call it exactly what it is encryption-free-HDMI-splitter.
    - mlonkibjuyhv 10y ago
      Non-technical users would think that was a lesser product. I'm thinking RLY-WORKS brand HDMI-splitter
      - mhb 10y ago
        Encryption-stripping HDMI Splitter
  - LeifCarrotson 10y ago
mjevans 10y ago
On the first pair I called it correctly... but I don't think I could have called it correctly without knowing there was only one fake. What if there were no fake, or both were fake, and they lied to see if anyone called them on it? Honestly all I was basing it on was the components being SLIGHTLY off (bad QC). That's why I couldn't pick out which of the second set were a fake, sure there were differences, but there wasn't any visually obvious detriment to those differences.
- qb45 10y ago
  > That's why I couldn't pick out which of the second set were a fake, sure there were differences, but there wasn't any visually obvious detriment to those differences. Cheap knockoffs quite often skimp on laser engraving, which seems to be the case here too.
  - deleted 10y ago
    [deleted]
rebootthesystem 10y ago
Everyone posting comments either defending clones or saying they are not bothered by them (or that they are cool because they foster innovation) has obviously never taken everything they owned, quit their job and even gone as far as mortgaging their family home to develop a product in pursuit of an idea. Do that. Then come back and tell me how it feels to have some fucker in China clone your product. I've had the experience of having a company out of Korea do a product that copied 75% of one of ours and introduce it into the US at half the price. Nearly fucking killed my business after investing nearly a million dollars and a year of R&D. The "D" part is much easier than the "R" part, which is where reverse engineering has a huge advantage. You do all the "R" and then they copy and do some "D". Not only that, you also identified a market opportunity for a product, which is massive. Ideas are worth shit. Opportunities are worth gold.
- defined 10y ago
  To amplify your point, cloning in the sense used in this discussion is intellectual property theft. It doesn't matter whether it deliberately attempts to pass itself off as the genuine article (i.e. a counterfeit item) or attempts to capitalize on the name brand by making the article visually almost identical (e.g. Sharpie vs Shoupie pens - a knockoff). A sobering fact is that about $653 billion worldwide is lost from counterfeit goods[1]. The FBI takes this position[2]: > legitimate businesses lose billions of dollars in revenue and suffer damaged reputations, consumer prices go up, the U.S. and global economies are robbed of jobs and tax revenue, product safety is reduced, and sometimes lives are even put at risk. As much as I am not a fan in particular of the FBI, I agree with this statement. In fact, the USA is hit the hardest by far, losing $225 billion annually to counterfeiting[3]. Bottom line: a person or company should be able to profit from their ideas, research and development, productization, licensing and marketing, without having these things stolen by others and used to make money off their sweat. [1]: http://www.havocscope.com/category/counterfeit-goods/ http://www.havocscope.com/category/counterfeit-goods/ [2]: https://www.fbi.gov/investigate/white-collar-crime/piracy-ip-theft https://www.fbi.gov/investigate/white-collar-crime/piracy-ip... [3]: http://www.havocscope.com/losses-to-counterfeit-goods-by-country/ http://www.havocscope.com/losses-to-counterfeit-goods-by-cou...
PhantomGremlin 10y ago
I deeply empathize with people who've had their IP stolen by offshore entities. But, especially with big manufacturers like Cisco (mentioned in the article), a lot of the problems are of their own doing. There is an ancient proverb: as you sow, so shall you reap. So, what the fuck did those big companies think would happen to their designs once they shipped them off to China to manufacture? Or, even better, after they subcontracted the actual design of their products to offshore entities? Surprise ... surprise ... surprise ... there are plenty of smart engineers and plenty of greedy capitalists to be found all over Asia. Why did you give them such a head start with your products? The stories are legion of factories making legitimate products during the day and counterfeits of those very same products at night. Cloning electronics is hard compared to consumer goods. Why is it that a Coach handbag can be purchased so cheaply in China? Maybe because Coach does their manufacturing in Asia? Maybe because if a handbag can be made in Asia for $50, there are plenty of people who would be happy to purchase it for $100 instead of the $1000 that Coach is selling it for?
louithethrid 10y ago
Not exactly fake hardware, but also quite commone- reused hardware- you desolder SOCs from defunct old scrap hardware and reapply them to "new" or "faked" hardware. Suddenly the invetible bitrot - by material migration or allready done flash-writes sets in way earlier.
RichardHeart 10y ago
I think fake detection could occur by including a sim card of authenticity. I guess you'd need to insert the sim into something to authenticate. As long as sim cards aren't cracked, the manufacturer doesn't lose their private key, or customers aren't convinced to authenticate against the wrong signature, 1 sim/signature per device should work. I guess this is similar to dongles for software?
cs2818 10y ago
Incorporating plant DNA is certainly an interesting approach to the problem. The chip or PCB fingerprinting methods make me slightly concerned about potential privacy implications. Would the fingerprint be shared among a batch of chips/PCBs or would each piece be uniquely fingerprinted?

54 points by jnord 10y ago

remember that cheap clones also foster innovation, by spreading tools that would be completely inaccessible to people without money, that's how computers revolutionized the world. With some cheap fake arduinos, cheap fake Saleae, and cheap fake FTDI chips, you can start prototyping while others are still counting their money to buy a $35 arduino. When you've established your working capital, you will buy brand-name stuff.

lelandbatey 10y ago
Making a cheap clone isn't really morally problematic to me. If a consumer has more options AND can make effective judgments about the level of quality they're buying, then consumers are probably happy. What is problematic is deceptive labeling/marketing such as saying "why yes, this is of course a genuine pacemaker".
- mikeash 10y ago
  And to be clear, the article is talking about that last kind. I think its terminology is rather off: I'd consider a "clone" to be something built to be similar, maybe compatible, but clearly marketed as its own thing, and the subject of the article would be "counterfeits." But for some reason they're using "clones" to describe stuff that's passed off as the original.
ceejayoz 10y ago
> When you've established your working capital, you will buy brand-name stuff. Whereupon the problem reasserts itself, as even attempting to pay a reasonable price on Amazon often winds up with a counterfeit.
- nraynaud 10y ago
  For electronics you go to the old school distributors to get legit tools and chips.
  - mikeash 10y ago
    There have been many cases recently where counterfeit goods made it into genuine distribution channels, sometimes even being distributed by the original maker itself.
tyingq 10y ago
They don't have to make counterfeits to meet that goal though. For example, there are USB to serial chips like the ch340 that are genuine, but still cheap.
- makomk 10y ago
  There's a certain amount of software out there that requires the non-standard bit banging features of the FTDI adapters. The cloners have done a really good job of implementing this (works better than the real thing, apparently).
joshvm 10y ago
Arduino is an example of open hardware. You can't sell a branded Arduino clone, but you are perfectly entitled take the schematic, build a clone board and sell it for peanuts. Fake FTDI is more of a problem because of the recent debacle where the drivers wouldn't work with counterfeit chips. I've often had Sparkfun boards fabbed via Oshpark, rather than buy and pay for expensive shipping from the States.
Baeocystin 10y ago
My cheap fake Saleae is what convinced me to buy a real one a year later. (Logic is a lot nicer than Sigrok.) I'm mostly a software/IT guy, and EE is new to me, and I did not have a large starting budget. Turns out it's a blast, but I quite simply would not have been able to buy what I needed to outfit a decent electronics bench if it wasn't for eBay and Shenzhen.

userbinator 10y ago

But they may also host unwanted or even malicious software, firmware, or hardware—and the buyer may not know the difference, or even know what to look for. Alternatively, the clones are often the ones which will omit the user-hostile DRM and such. Thus you get HDMI splitters which don't actually re-encrypt HDCP, DVD players which don't implement region restrictions or the "unskippable" bits (https://en.wikipedia.org/wiki/User_operation_prohibition https://en.wikipedia.org/wiki/User_operation_prohibition ) , Androids with unlocked bootloaders by default, etc. Of course, to an organisation like the IEEE, who have always appeared to be pro-DRM, pro-IP, pro-copyright, that would probably be considered "malicious"... The whole safety/security argument, while true, I think is somewhat overblown and these days increasingly used to justify an authoritarian agenda.

jfoutz 10y ago
I think the IEEE is just ethical. Faithfully build the thing you're paid to build. It's probably not fair to call the encryption free splitter an HDMI splitter. If you build it, call it something else so you don't dilute the standard. Of course, i don't have a lot of experience with IEEE, they may actually be super pro-DRM, and my opinion could be swayed.
- Sunset 10y ago
  No. Call it exactly what it is encryption-free-HDMI-splitter.
  - mlonkibjuyhv 10y ago
    Non-technical users would think that was a lesser product. I'm thinking RLY-WORKS brand HDMI-splitter
    - mhb 10y ago
      Encryption-stripping HDMI Splitter
- LeifCarrotson 10y ago

mjevans 10y ago

On the first pair I called it correctly... but I don't think I could have called it correctly without knowing there was only one fake. What if there were no fake, or both were fake, and they lied to see if anyone called them on it? Honestly all I was basing it on was the components being SLIGHTLY off (bad QC). That's why I couldn't pick out which of the second set were a fake, sure there were differences, but there wasn't any visually obvious detriment to those differences.

qb45 10y ago
> That's why I couldn't pick out which of the second set were a fake, sure there were differences, but there wasn't any visually obvious detriment to those differences. Cheap knockoffs quite often skimp on laser engraving, which seems to be the case here too.
- deleted 10y ago
  [deleted]

rebootthesystem 10y ago

Everyone posting comments either defending clones or saying they are not bothered by them (or that they are cool because they foster innovation) has obviously never taken everything they owned, quit their job and even gone as far as mortgaging their family home to develop a product in pursuit of an idea. Do that. Then come back and tell me how it feels to have some fucker in China clone your product. I've had the experience of having a company out of Korea do a product that copied 75% of one of ours and introduce it into the US at half the price. Nearly fucking killed my business after investing nearly a million dollars and a year of R&D. The "D" part is much easier than the "R" part, which is where reverse engineering has a huge advantage. You do all the "R" and then they copy and do some "D". Not only that, you also identified a market opportunity for a product, which is massive. Ideas are worth shit. Opportunities are worth gold.

defined 10y ago
To amplify your point, cloning in the sense used in this discussion is intellectual property theft. It doesn't matter whether it deliberately attempts to pass itself off as the genuine article (i.e. a counterfeit item) or attempts to capitalize on the name brand by making the article visually almost identical (e.g. Sharpie vs Shoupie pens - a knockoff). A sobering fact is that about $653 billion worldwide is lost from counterfeit goods[1]. The FBI takes this position[2]: > legitimate businesses lose billions of dollars in revenue and suffer damaged reputations, consumer prices go up, the U.S. and global economies are robbed of jobs and tax revenue, product safety is reduced, and sometimes lives are even put at risk. As much as I am not a fan in particular of the FBI, I agree with this statement. In fact, the USA is hit the hardest by far, losing $225 billion annually to counterfeiting[3]. Bottom line: a person or company should be able to profit from their ideas, research and development, productization, licensing and marketing, without having these things stolen by others and used to make money off their sweat. [1]: http://www.havocscope.com/category/counterfeit-goods/ http://www.havocscope.com/category/counterfeit-goods/ [2]: https://www.fbi.gov/investigate/white-collar-crime/piracy-ip-theft https://www.fbi.gov/investigate/white-collar-crime/piracy-ip... [3]: http://www.havocscope.com/losses-to-counterfeit-goods-by-country/ http://www.havocscope.com/losses-to-counterfeit-goods-by-cou...

PhantomGremlin 10y ago

I deeply empathize with people who've had their IP stolen by offshore entities. But, especially with big manufacturers like Cisco (mentioned in the article), a lot of the problems are of their own doing. There is an ancient proverb: as you sow, so shall you reap. So, what the fuck did those big companies think would happen to their designs once they shipped them off to China to manufacture? Or, even better, after they subcontracted the actual design of their products to offshore entities? Surprise ... surprise ... surprise ... there are plenty of smart engineers and plenty of greedy capitalists to be found all over Asia. Why did you give them such a head start with your products? The stories are legion of factories making legitimate products during the day and counterfeits of those very same products at night. Cloning electronics is hard compared to consumer goods. Why is it that a Coach handbag can be purchased so cheaply in China? Maybe because Coach does their manufacturing in Asia? Maybe because if a handbag can be made in Asia for $50, there are plenty of people who would be happy to purchase it for $100 instead of the $1000 that Coach is selling it for?

louithethrid 10y ago

Not exactly fake hardware, but also quite commone- reused hardware- you desolder SOCs from defunct old scrap hardware and reapply them to "new" or "faked" hardware. Suddenly the invetible bitrot - by material migration or allready done flash-writes sets in way earlier.

RichardHeart 10y ago

I think fake detection could occur by including a sim card of authenticity. I guess you'd need to insert the sim into something to authenticate. As long as sim cards aren't cracked, the manufacturer doesn't lose their private key, or customers aren't convinced to authenticate against the wrong signature, 1 sim/signature per device should work. I guess this is similar to dongles for software?

cs2818 10y ago

Incorporating plant DNA is certainly an interesting approach to the problem. The chip or PCB fingerprinting methods make me slightly concerned about potential privacy implications. Would the fingerprint be shared among a batch of chips/PCBs or would each piece be uniquely fingerprinted?