7 ms·

Manufacturer 'make worthless' users devices after some stolen from a warehouse

45 points by infosecrf 8y ago

pavel_lishin 8y ago
> Those that do and assist us in tracking down the thieves will be treated VERY sympathetically. Does that mean they'll unbrick their hardware? That's about the only sympathy I'd expect after purchasing a product in good faith, and discovering that it was bricked or disabled by the manufacturer.
- Azeolus 8y ago
  https://blogs.findlaw.com/blotter/2014/08/can-you-get-arrested-for-buying-stolen-goods.html https://blogs.findlaw.com/blotter/2014/08/can-you-get-arrest... If you buy stolen good, you don't get to keep them. These are stolen goods, why would you ever expect the company to simply allow you to use it?
  - pbhjpbhj 8y ago
    The company gets to prevent future thefts, they've most likely written off the loss already (they're not going to reuse those goods as new items at v. least), they can get PR and more "column inches" on a new story about buyers helping them and then getting gifted the device.
  - pavel_lishin 8y ago
    I take issue with the fact that the company has any say in the matter at all, tbh. I dislike devices that phone home and can be disabled remotely as a matter of principle. But you're right, in the end they are stolen goods.
    - Azeolus 8y ago
      > I take issue with the fact that the company has any say in the matter at all, tbh. What? How does that make any sense. Someone stole their property, it's still theirs, of course they have a say in what happens to it. "Finders Keepers" is not how the world works...
      - pavel_lishin 8y ago
        But they can also brick non-stolen equipment. I don't want a company to be able to remotely disable a device I own.
- jandrese 8y ago
  Buying the discounted hardware on eBay is somewhat marginal as "good faith". That said, RTL-SDR hardware barely exists in the normal supply chain so consumers often have little choice but to roll the dice on eBay. The one I bought came delivered in a plastic baggie in a padded envelope. It could have been stolen for all I know. Is there a way to check which serial numbers were stolen? Can I demand a seller post a picture of the device with the serial number so I can check? How can I be sure they won't lie?
  - pavel_lishin 8y ago
    Kind of; they posted the list on a forum and appear to have tweeted about it: https://www.sdrplay.com/community/viewtopic.php?f=6&t=3225 https://www.sdrplay.com/community/viewtopic.php?f=6&t=3225 There isn't really a centralized or standardized way to do this, though. I guess if I'm buying some smart-ish hardware, I just have to google around for the company and hope I did a good job.
malik9 8y ago
Previously owned devices sales next? If they are including blacklisting code like this their software simply cannot be trusted.
- M_Bakhtiari 8y ago
  That's the case with any device with non-free firmware.
- rtkwe 8y ago
  Unlikely it'd run into all sorts of first sale doctrine issues if they blocked resale of hardware components.
- Azeolus 8y ago
  No. There is a simple explanation too. Once a valid sale happens ownership changes. They still own these devices, because they were stolen. That means they can do whatever they please, the devices are still theirs.
  - icebraining 8y ago
    Ownership change doesn't magically disable their remote control, though.
huhtenberg 8y ago
Sounds like a reasonable thing for any manufacturer to do if your supply pipeline is prone to large-scale theft and your goal is to deter further incidents. The best option obviously is to fix the pipeline, but that takes time and not always doable in practical terms. Caveat emptor. Buying from a 3rd party and presumably at a deep discount always carries a risk of goods being stolen. PS. FTDI case is of no relevance here - they were bricking devices of _other_ vendors, not their own.
- smitherfield 8y ago
  Yeah, the burden is on the buyer not to purchase stolen goods. The manufacturer is certainly under no obligation to support them. In many states even unknowing possession of stolen goods is a crime, so many of the "users" here are in fact getting off lightly.
  - unit91 8y ago
    > In many states even unknowing possession of stolen goods is a crime I've never heard of this. Source?
    - dexen 8y ago
      Possession of stolen goods[1] is a crime USA-wide, and in many other countries. The rationale behind is ability to prosecute fences[2] - people who act as intermediaries and a layer of security between thieves and end-users, providing the thieves with option for easy cash-out. Edit: As a counter-point, at least in Poland, while obtaining stolen goods is an offense ("paserstwo"[3]), the buyer of any good or service that has a "legal defect" - including having been stolen, IIRC - has a valid legal case to demand recourse from the seller. The goods are nonetheless subject to forfeiture. [1] https://en.wikipedia.org/wiki/Possession_of_stolen_goods https://en.wikipedia.org/wiki/Possession_of_stolen_goods [2] https://en.wikipedia.org/wiki/Fence_(criminal) https://en.wikipedia.org/wiki/Fence_(criminal) [3] https://pl.wikipedia.org/wiki/Paserstwo https://pl.wikipedia.org/wiki/Paserstwo
      - 8y ago
Robadob 8y ago
Is this really that different from blocking stolen mobile phones from connecting to mobile networks via their IMEI number? The database behind that is apparently shared internationally between mobile networks, and most people would find a phone unable to connect to anything but WiFi useless.
- tankenmate 8y ago
  There's a big difference, the owner requested the bricking not the manufacturer.
  - alibarber 8y ago
    If they were stolen from the manufacturer, then surely the manufacturer is the owner - and is therefore entitled to block them?
  - nsxwolf 8y ago
    Isn't the manufacturer the owner at this stage?
vilda 8y ago
Sony offers to block stolen PlayStations. It's a similar case - you may buy a used item that may suddenly stop working. Moreover, Sony does cooperate with authorities re locating those devices. You may have a surprising visit.
kizer 8y ago
I had to re-read each sentence three times.
- kortex 8y ago
  I'm glad I'm not the only person who found this piece weirdly dense/obtuse.
post_break 8y ago
Wasn't this the same company who banned users for leaving bad reviews?
huevo5050 8y ago
I imagine this standardized in a supply chain blockchain
- jandrese 8y ago
  Yeah. I mean nobody has ever managed to steal a Bitcoin right?
shawnz 8y ago
Seems totally acceptable to me. The comparison with the FTDI incident is not really applicable here because those were not stolen parts, just replica/clone parts.
djrogers 8y ago
People who receive stolen goods have always been kinda screwed over - it's been part of our laws forever. Even if one isn't charged with a crime, one will lose the goods, and likely never recover their money. The reasons for this are obvious - to make it as hard as possible to sell stolen goods. The effects encourage the innocent purchasers to have some level of caution when looking at buying goods.
fencepost 8y ago
I can't bring myself to be bothered by this - and wouldn't be even if I were using these devices. For crying out loud, equipment with unique recorded serial numbers was stolen, so the company is blocking the specific stolen devices. That makes perfect sense to me. Objecting to how they do it (bulking up software with a list of serials, requiring software to phone home, whatever) is fine and their customers have a legit basis to be unhappy if it's impacting their use, but people with the stolen devices? Those aren't SDRPlay's customers because SDRPlay hasn't been paid for those devices. Quoting from the article: In a PR disaster the manufacturer gives "Because we can" as an explanation to make end user devices worthless. I'll note that this complaint very carefully leaves out a key word: STOLEN. I'm not seeing the PR disaster except that it's going to seriously hurt their image in the community of people who steal stuff from warehouses. tiny violin plays sad music If you've purchased one of these, as I said above you're not a customer of SDRPlay or one of its distributors because payment is part of a vendor-customer relationship. You're someone who bought "Bose" speakers out of the back of a white van in a parking lot. Get your money back from the seller - you may even be able to get the police report from SDRPlay if you need it for a chargeback - and tell SDRPlay where you bought it so they can try to track down the thieves. Edit: reading the original SDRPlay forum posts, they ID the specific ebay sellers, note that this is the third time they've had things stolen like this and sold by the same accounts, and note that "We will NOT penalise innocent people so that assumption that this is our intent is frankly WRONG!!" Basically they're likely looking for anything like saved packaging, shipping return addresses, etc. to be turned over to the police. Also, this whole thing is about (in this case at least) a total of 39 devices. We're not talking about thousands of people affected. SDRPlay: https://www.sdrplay.com/community/viewtopic.php?f=6&t=3225 https://www.sdrplay.com/community/viewtopic.php?f=6&t=3225
- tinus_hn 8y ago
  In other news, try using a stolen iPhone (since the last 6 years). I came across this article: https://www.cultofmac.com/246755/why-ios-7s-activation-lock-is-a-disaster-waiting-to-happen/ https://www.cultofmac.com/246755/why-ios-7s-activation-lock-... Which in typical Apple whining style complains how the sky will fall due to this new feature. And then it didn’t.
- 8y ago
codedokode 8y ago
Those who bought stolen devices should return them and ask for a refund from EBay. You are generally not allowed to resell stolen goods, although I am not sure if EBay is liable here. > Back in October 2014, the FDTI manufacturer shipped a device driver that ... would make any operating system stop seeing the device by setting its USB product ID to 0 , basically killing the USB device. Well, if that id can be set to 0, it can also be set back to original value, isn't it?
- Jonnax 8y ago
  If I recall correctly, it didn't get recognised as a USB device anymore so you couldn't reflash it.
  - crankylinuxuser 8y ago
    Linux was able to allow connections to VID:0 PID:0 for usbserial.h about 3 days after the initial reports. From there, it was possible to rewrite the FTDI firmware to restore functionality.
chatmasta 8y ago
Wouldn’t it be pretty trivial to remove the blacklisting code? It’s not like this is a cellphone sold to my mom. It’s an extremely specialist product aimed at a group of users with vast electronics and reverse engineering knowledge. Probably won’t be long before one of them reverse engineers the device and releases the code to ignore the blacklisting. Anyone know the technical details of how the blacklisting works?
- discreditable 8y ago
  If you unintentionally buy a blacklisted phone online, do you try to break the blacklist or report the seller and get a refund?
  - deleted 8y ago
    [deleted]
  - chatmasta 8y ago
    The blacklisting code is in every device, even those sold legitimately. That is, the device “phones home.” Some users may not be okay with that. In my experience, the kind of person who buys an SDR is (a) unlikely to appreciate a $400 device that phones home on boot, and (b) likely to reverse engineer the blacklisting code simply for the fun of it.
crankylinuxuser 8y ago
If they can do this before it is sold (eg: theft) and remotely prevent the device from working, how do users defend against having this done later for more capricious reasons? Everything I've learned, is that for capabilities like this, the good reasons are the justifications, and then the owners migrate to less good reasons. The overall distrust I have with these kinds of systems are that they are Treacherous Software/Hardware. This capability is something that shouldn't be implemented. No user in their right mind would - but the companies that wish to retain ownership rights after sale do. I would also object to this 'hacking of these devices' as violations of CFAA. Yes, the devices had lost chain of custody, and were reported as stolen. That doesn't allow any entity to then engage in more illegal behaviors exigent to the initial situation. If I am being robbed, I am allowed to defend myself and my goods. However I cannot stalk the robber, and then bash his/her kneecaps in after the fact. 2 wrongs, separated by time, do not make a right.
dazhbog 8y ago
I used to always be pro-consumer in cases where the manufacturer does something like that to clones (Salae and FTDI cases) After slowly getting into the manufacturing game myself and after USPS auctioned some of my cute early engineering samples that ended up on ebay, I definitely think this is totally reasonable from the manufacturer. Also the title of the article is already attacking the manufacturer. If you brick the devices, you hurt the person stealing and indeed it seems that this wasn't the first time it happened to them. On the consumer side maybe a discount would also be a nice gesture.
- woodrowbarlow 8y ago
  i'm curious to hear more about your story! if i'm understanding you correctly, the postal service somehow ended up in possession of your early prototypes and they sold them to somebody who then re-listed them on ebay. was this a lost parcel situation?
  - dazhbog 8y ago
    We sent the prototypes with USPS, within US, and down the line they said they couldnt deliver and we asked them to re-route it to another address because of that. They even gave us a tracking number. After a month went by (adding to the already another month of delay) they said its on its way, etc. We randomly searched ebay with our brand name and saw an active listing with our prototypes in it. Other things in the box like our gopro were gone, but at least we found the prototypes and contacted the seller. The seller said that she got the items at an auction for items that couldnt be delivered a MONTH earlier, while USPS was telling us it was on the way. Seller ended up giving us the prototypes for a small fee.

45 points by infosecrf 8y ago

> Those that do and assist us in tracking down the thieves will be treated VERY sympathetically. Does that mean they'll unbrick their hardware? That's about the only sympathy I'd expect after purchasing a product in good faith, and discovering that it was bricked or disabled by the manufacturer.

Azeolus 8y ago
https://blogs.findlaw.com/blotter/2014/08/can-you-get-arrested-for-buying-stolen-goods.html https://blogs.findlaw.com/blotter/2014/08/can-you-get-arrest... If you buy stolen good, you don't get to keep them. These are stolen goods, why would you ever expect the company to simply allow you to use it?
- pbhjpbhj 8y ago
  The company gets to prevent future thefts, they've most likely written off the loss already (they're not going to reuse those goods as new items at v. least), they can get PR and more "column inches" on a new story about buyers helping them and then getting gifted the device.
- pavel_lishin 8y ago
  I take issue with the fact that the company has any say in the matter at all, tbh. I dislike devices that phone home and can be disabled remotely as a matter of principle. But you're right, in the end they are stolen goods.
  - Azeolus 8y ago
    > I take issue with the fact that the company has any say in the matter at all, tbh. What? How does that make any sense. Someone stole their property, it's still theirs, of course they have a say in what happens to it. "Finders Keepers" is not how the world works...
    - pavel_lishin 8y ago
      But they can also brick non-stolen equipment. I don't want a company to be able to remotely disable a device I own.
jandrese 8y ago
Buying the discounted hardware on eBay is somewhat marginal as "good faith". That said, RTL-SDR hardware barely exists in the normal supply chain so consumers often have little choice but to roll the dice on eBay. The one I bought came delivered in a plastic baggie in a padded envelope. It could have been stolen for all I know. Is there a way to check which serial numbers were stolen? Can I demand a seller post a picture of the device with the serial number so I can check? How can I be sure they won't lie?
- pavel_lishin 8y ago
  Kind of; they posted the list on a forum and appear to have tweeted about it: https://www.sdrplay.com/community/viewtopic.php?f=6&t=3225 https://www.sdrplay.com/community/viewtopic.php?f=6&t=3225 There isn't really a centralized or standardized way to do this, though. I guess if I'm buying some smart-ish hardware, I just have to google around for the company and hope I did a good job.

malik9 8y ago

Previously owned devices sales next? If they are including blacklisting code like this their software simply cannot be trusted.

M_Bakhtiari 8y ago
That's the case with any device with non-free firmware.
rtkwe 8y ago
Unlikely it'd run into all sorts of first sale doctrine issues if they blocked resale of hardware components.
Azeolus 8y ago
No. There is a simple explanation too. Once a valid sale happens ownership changes. They still own these devices, because they were stolen. That means they can do whatever they please, the devices are still theirs.
- icebraining 8y ago
  Ownership change doesn't magically disable their remote control, though.

huhtenberg 8y ago

Sounds like a reasonable thing for any manufacturer to do if your supply pipeline is prone to large-scale theft and your goal is to deter further incidents. The best option obviously is to fix the pipeline, but that takes time and not always doable in practical terms. Caveat emptor. Buying from a 3rd party and presumably at a deep discount always carries a risk of goods being stolen. PS. FTDI case is of no relevance here - they were bricking devices of _other_ vendors, not their own.

smitherfield 8y ago
Yeah, the burden is on the buyer not to purchase stolen goods. The manufacturer is certainly under no obligation to support them. In many states even unknowing possession of stolen goods is a crime, so many of the "users" here are in fact getting off lightly.
- unit91 8y ago
  > In many states even unknowing possession of stolen goods is a crime I've never heard of this. Source?
  - dexen 8y ago
    Possession of stolen goods[1] is a crime USA-wide, and in many other countries. The rationale behind is ability to prosecute fences[2] - people who act as intermediaries and a layer of security between thieves and end-users, providing the thieves with option for easy cash-out. Edit: As a counter-point, at least in Poland, while obtaining stolen goods is an offense ("paserstwo"[3]), the buyer of any good or service that has a "legal defect" - including having been stolen, IIRC - has a valid legal case to demand recourse from the seller. The goods are nonetheless subject to forfeiture. [1] https://en.wikipedia.org/wiki/Possession_of_stolen_goods https://en.wikipedia.org/wiki/Possession_of_stolen_goods [2] https://en.wikipedia.org/wiki/Fence_(criminal) https://en.wikipedia.org/wiki/Fence_(criminal) [3] https://pl.wikipedia.org/wiki/Paserstwo https://pl.wikipedia.org/wiki/Paserstwo
    - 8y ago

Robadob 8y ago

Is this really that different from blocking stolen mobile phones from connecting to mobile networks via their IMEI number? The database behind that is apparently shared internationally between mobile networks, and most people would find a phone unable to connect to anything but WiFi useless.

tankenmate 8y ago
There's a big difference, the owner requested the bricking not the manufacturer.
- alibarber 8y ago
  If they were stolen from the manufacturer, then surely the manufacturer is the owner - and is therefore entitled to block them?
- nsxwolf 8y ago
  Isn't the manufacturer the owner at this stage?

vilda 8y ago

Sony offers to block stolen PlayStations. It's a similar case - you may buy a used item that may suddenly stop working. Moreover, Sony does cooperate with authorities re locating those devices. You may have a surprising visit.

kizer 8y ago

I had to re-read each sentence three times.

kortex 8y ago
I'm glad I'm not the only person who found this piece weirdly dense/obtuse.

post_break 8y ago

Wasn't this the same company who banned users for leaving bad reviews?

huevo5050 8y ago

I imagine this standardized in a supply chain blockchain

jandrese 8y ago
Yeah. I mean nobody has ever managed to steal a Bitcoin right?

shawnz 8y ago

Seems totally acceptable to me. The comparison with the FTDI incident is not really applicable here because those were not stolen parts, just replica/clone parts.

djrogers 8y ago

People who receive stolen goods have always been kinda screwed over - it's been part of our laws forever. Even if one isn't charged with a crime, one will lose the goods, and likely never recover their money. The reasons for this are obvious - to make it as hard as possible to sell stolen goods. The effects encourage the innocent purchasers to have some level of caution when looking at buying goods.

fencepost 8y ago

I can't bring myself to be bothered by this - and wouldn't be even if I were using these devices. For crying out loud, equipment with unique recorded serial numbers was stolen, so the company is blocking the specific stolen devices. That makes perfect sense to me. Objecting to how they do it (bulking up software with a list of serials, requiring software to phone home, whatever) is fine and their customers have a legit basis to be unhappy if it's impacting their use, but people with the stolen devices? Those aren't SDRPlay's customers because SDRPlay hasn't been paid for those devices. Quoting from the article: In a PR disaster the manufacturer gives "Because we can" as an explanation to make end user devices worthless. I'll note that this complaint very carefully leaves out a key word: STOLEN. I'm not seeing the PR disaster except that it's going to seriously hurt their image in the community of people who steal stuff from warehouses. tiny violin plays sad music If you've purchased one of these, as I said above you're not a customer of SDRPlay or one of its distributors because payment is part of a vendor-customer relationship. You're someone who bought "Bose" speakers out of the back of a white van in a parking lot. Get your money back from the seller - you may even be able to get the police report from SDRPlay if you need it for a chargeback - and tell SDRPlay where you bought it so they can try to track down the thieves. Edit: reading the original SDRPlay forum posts, they ID the specific ebay sellers, note that this is the third time they've had things stolen like this and sold by the same accounts, and note that "We will NOT penalise innocent people so that assumption that this is our intent is frankly WRONG!!" Basically they're likely looking for anything like saved packaging, shipping return addresses, etc. to be turned over to the police. Also, this whole thing is about (in this case at least) a total of 39 devices. We're not talking about thousands of people affected. SDRPlay: https://www.sdrplay.com/community/viewtopic.php?f=6&t=3225 https://www.sdrplay.com/community/viewtopic.php?f=6&t=3225

tinus_hn 8y ago
In other news, try using a stolen iPhone (since the last 6 years). I came across this article: https://www.cultofmac.com/246755/why-ios-7s-activation-lock-is-a-disaster-waiting-to-happen/ https://www.cultofmac.com/246755/why-ios-7s-activation-lock-... Which in typical Apple whining style complains how the sky will fall due to this new feature. And then it didn’t.
8y ago

codedokode 8y ago

Those who bought stolen devices should return them and ask for a refund from EBay. You are generally not allowed to resell stolen goods, although I am not sure if EBay is liable here. > Back in October 2014, the FDTI manufacturer shipped a device driver that ... would make any operating system stop seeing the device by setting its USB product ID to 0 , basically killing the USB device. Well, if that id can be set to 0, it can also be set back to original value, isn't it?

Jonnax 8y ago
If I recall correctly, it didn't get recognised as a USB device anymore so you couldn't reflash it.
- crankylinuxuser 8y ago
  Linux was able to allow connections to VID:0 PID:0 for usbserial.h about 3 days after the initial reports. From there, it was possible to rewrite the FTDI firmware to restore functionality.

chatmasta 8y ago

Wouldn’t it be pretty trivial to remove the blacklisting code? It’s not like this is a cellphone sold to my mom. It’s an extremely specialist product aimed at a group of users with vast electronics and reverse engineering knowledge. Probably won’t be long before one of them reverse engineers the device and releases the code to ignore the blacklisting. Anyone know the technical details of how the blacklisting works?

discreditable 8y ago
If you unintentionally buy a blacklisted phone online, do you try to break the blacklist or report the seller and get a refund?
- deleted 8y ago
  [deleted]
- chatmasta 8y ago
  The blacklisting code is in every device, even those sold legitimately. That is, the device “phones home.” Some users may not be okay with that. In my experience, the kind of person who buys an SDR is (a) unlikely to appreciate a $400 device that phones home on boot, and (b) likely to reverse engineer the blacklisting code simply for the fun of it.

crankylinuxuser 8y ago

If they can do this before it is sold (eg: theft) and remotely prevent the device from working, how do users defend against having this done later for more capricious reasons? Everything I've learned, is that for capabilities like this, the good reasons are the justifications, and then the owners migrate to less good reasons. The overall distrust I have with these kinds of systems are that they are Treacherous Software/Hardware. This capability is something that shouldn't be implemented. No user in their right mind would - but the companies that wish to retain ownership rights after sale do. I would also object to this 'hacking of these devices' as violations of CFAA. Yes, the devices had lost chain of custody, and were reported as stolen. That doesn't allow any entity to then engage in more illegal behaviors exigent to the initial situation. If I am being robbed, I am allowed to defend myself and my goods. However I cannot stalk the robber, and then bash his/her kneecaps in after the fact. 2 wrongs, separated by time, do not make a right.

dazhbog 8y ago

I used to always be pro-consumer in cases where the manufacturer does something like that to clones (Salae and FTDI cases) After slowly getting into the manufacturing game myself and after USPS auctioned some of my cute early engineering samples that ended up on ebay, I definitely think this is totally reasonable from the manufacturer. Also the title of the article is already attacking the manufacturer. If you brick the devices, you hurt the person stealing and indeed it seems that this wasn't the first time it happened to them. On the consumer side maybe a discount would also be a nice gesture.

woodrowbarlow 8y ago
i'm curious to hear more about your story! if i'm understanding you correctly, the postal service somehow ended up in possession of your early prototypes and they sold them to somebody who then re-listed them on ebay. was this a lost parcel situation?
- dazhbog 8y ago
  We sent the prototypes with USPS, within US, and down the line they said they couldnt deliver and we asked them to re-route it to another address because of that. They even gave us a tracking number. After a month went by (adding to the already another month of delay) they said its on its way, etc. We randomly searched ebay with our brand name and saw an active listing with our prototypes in it. Other things in the box like our gopro were gone, but at least we found the prototypes and contacted the seller. The seller said that she got the items at an auction for items that couldnt be delivered a MONTH earlier, while USPS was telling us it was on the way. Seller ended up giving us the prototypes for a small fee.