19 ms·

FTDI driver kills fake FTDI FT232s

342 points by stoey 12y ago

tdicola 12y ago
Ouch, something tells me the Arduino, Raspberry Pi, etc. forums are going to be full of people that are confused why they can't talk to their device anymore. IMHO it's pretty bad to target the consumers who probably don't even know or care that there's an FTDI chip in their device. Certainly am not condoning piracy of the chips, but wonder if there's a better way of handling the situation than breaking everyone.
- krapht 12y ago
  I suppose they could beg the Chinese government to enforce their IP rights and crack down on counterfeit manufacturers. Or they could crack down on end-users. Or let the counterfeit manufacturers free-ride off their driver development.
- alyandon 12y ago
  Wow. That is seriously uncool. I'd never even heard of FTDI before but they can rest assured that if I ever need a USB-to-UART chip that FTDI won't be the company I choose to buy. FTDI's drivers refusing to work with the fake parts is understandable, purposely reprogramming them to make them non-functional isn't.
  - wdewind 12y ago
    > purposely reprogramming them to make them non-functional isn't Dumb question maybe, but why?
    - sitharus 12y ago
      Because they're intentionally breaking your property. Sure it can be fixed, but it's the intent that's worrying. Simply refusing to work - perhaps logging something to the event log about counterfeit products - would be fine.
    - toomuchtodo 12y ago
      You're damaging someone's hardware without their consent? Its essentially vandalism.
      - wdewind 12y ago
        Sure, but the chips are illegal no? Where is the moral high ground coming from... I'm not a supporter of intellectual property laws, but we have them, so I'd also be curious of any legal ground fake chip users have to stand on.
        teraflop 12y ago
        "Illegal" is an extremely broad and imprecise way to describe a physical object. Imagine I buy a car from a dealership, and without my knowledge the dealer has swapped out the original radio for a cheap counterfeit. I guess technically you could argue that makes the car "illegal" but it would be absurd to suggest that the manufacturer has the right to come to my house and slash my tires. As I see it, it's not about whether "fake chip users" are obeying the laws; the burden should be on FTDI to justify its willful property damage.
        dragonwriter 12y ago
        To the extent that there is a violation of law involved in the manufacture, sale, or use of the chips (and such violations are much more likely in the first two cateories), there are legal remedies available for those violations, which generally require proving that a violation occurred and that the person against whom remedy is sought is the appropriate person against whom to seek a remedy. To the extent the violations are with manufacture and sale, the user is not generally the appropriate target, even if destruction of the device was an appropriate remedy.
        wtallis 12y ago
        The label printed on the outside of the plastic package of the chip is the only thing that's illegal, since it's depicting FTDI's trademark. Scrape that off and you've got a 100% legal compatible clone. Whoever decided to use the clones in any given device may be be in breach of a contract if the use of genuine FTDI chips was specified, but that may easily not be the case. (The clones also violate USB specs by using someone else's VID, but that only prevents them from labeling the product with the trademarked USB logo.) Also, possession of the fake chip as an end user is no more illegal than owning fake Louis Vuitton stuff. It's the sale under false pretenses that gets you in trouble.
    - tdicola 12y ago
      I could sort of understand it if the driver refused to work and popped up some dialog that said "You're using a counterfeit FTDI device, here's how to get an official device. Sorry this driver is not compatible with unofficial devices." However if it just silently bricks the chip then consumers will have no idea what's wrong. They'll think their Arduino clone is broken or they can't talk to their Raspberry Pi for some reason. I doubt they'll make the connection that the FTDI chip in their device is a clone and understand what to do to fix it.
    - jerf 12y ago
      In addition to the other posted replies, it's bad software engineering. You really can't be confident enough in your logic to ever start issuing DESTROY_HARDWARE() commands of any kind, short of the small set of very specialized programs that may be deliberately used for such things (FPGA programmers, etc). Any error whatsoever and you may end up nuking your real customer's hardware. Bad plan. Same reason why programs that think they are pirated shouldn't run around being actively destructive... some real customer will find some way to tickle that code, if only through bad hardware, and now you're in trouble. To a first approximation, all code eventually runs. Relatedly, never put an error message into your product you wouldn't want customers to see, because they will.
      - wdewind 12y ago
        Thanks, that's a great answer, but I guess I'm curious about legal/ethical considerations.
        Vendan 12y ago
        I can't find it anywhere, but I remember reading about a software company that wrote an office suite for early computers (like DOS or possibly even pre-DOS), that would detect if it was a legal copy, and if it wasn't a legal copy, would delete your data. I seem to recall that they got slammed by the legal system pretty hard, which is one possible reason for why software companies don't do it nowadays. I personally see this as an action on par with, or worse then, the software company I mentioned's actions.
    - alyandon 12y ago
      Making alterations to someone else's property without their consent for the express purpose of rendering it non-functional is commonly called vandalism.
      - wdewind 12y ago
        In a culture with intellectual property laws I'm not sure that's true. Is it legal to destroy counterfeit handbags commonly sold on the street? Honest question, the police seem to do it frequently.
        Vendan 12y ago
        Even if it is, there is a difference between the police doing it and the company doing it.
- makomk 12y ago
  Fortunately, most of the newer Arduinos have moved to firmware implementations of USB-to-serial that use one of the standard USB device classes and drivers, but there's all kinds of stuff out there with FTDI chips in.
dmitrygr 12y ago
IF this is on purpose and can be proven so, it is most definitely illegal!
- spiritplumber 12y ago
  All they have to say is "We write our drivers to support our chips, if it messes with other chips that incorrectly identify as ours, that's just the way it went, it'd cost us extra to support them and why should we help our competitors". Practically impossible to prove otherwise.
  - rainforest 12y ago
    They have a track record of trying to fingerprint and screwing with counterfeits, so it would appear there's evidence the driver doesn't happen to disable counterfeits, but actively disables them. To me there's a fuzzy distinction (possibly not reflected in law) between software that breaks when you make it do stuff you didn't design, versus having it attack things you don't want it to work with.
  - DannyBee 12y ago
    "All they have to say is "We write our drivers to support our chips, if it messes with other chips that incorrectly identify as ours, that's just the way it went, it'd cost us extra to support them and why should we help our competitors"." Buzz, thanks for playing. :) That won't get them out of discovery for various torts, and the discovery (emails, code, etc) is likely to show they did this on purpose. It's not practically impossible, it's trivially easy to disassemble and see if it does this on purpose. Then you argue it to a jury, and it's going to look really really bad for FTDI.
    - Tomte 12y ago
      I wish German civil law had something like your discovery process. Over here the claimant probably would not be able to peek into the defendant's stuff. Especially if he can't specifically claim "on march 10th, Mr. Meier sent an email to Mr. Schmidt discussing topic X". A simple "hand over your mails about the matter at hand" would be ruled a "fishing expedition", not admissible as a motion to discover.
dogecoinbase 12y ago
Hackaday has a good short summary of the situation: http://hackaday.com/2014/10/22/watch-that-windows-update-ftdi-drivers-are-killing-fake-chips/ http://hackaday.com/2014/10/22/watch-that-windows-update-ftd...
- adamfeldman 12y ago
  Elsewhere Hackaday links to a Russian microelectronics company's blog[1], where they decapped real and fake FTDI chips and found that: "It seems that in this case Chinese designers implemented protocol-compatible "fake" chip, using mask-programmable microcontroller. This way they only needed to redo 1 mask - this is much cheaper than full mask set, and explains a lot of redundant pads on the die. Fake chip was working kinda fine until FTDI released drivers update, which were able to detect fake chips via USB and send only 0's in this case. It was impossible to foresee any possible further driver checks without full schematic recovery and these hidden tricks saved FTDI profits." [1]: http://zeptobars.ru/en/read/FTDI-FT232RL-real-vs-fake-supereal http://zeptobars.ru/en/read/FTDI-FT232RL-real-vs-fake-supere...
- Someone1234 12y ago
  I am more entertained by that animation than I should be...
bri3d 12y ago
FTDI have been anti-consumer for years - their last several drivers have introduced intentional instability and Code 10 errors for suspected counterfeit devices. I think this is totally crappy. I see what they're trying to do (create market incentive for consumers to insist on real FTDI chips) but the reality is that it's just screwing over innocent consumers who buy a device.
- wrl 12y ago
  The FTDI OSX drivers will still randomly cause kernel panics when the device is unplugged and a program still holds an open file descriptor for the serial port. While working with a company which was developing and selling products with FTDI chips in them, we made FTDI aware of this issue and attached many panic logs. It's been about 5 years and they've still yet to actually fix it.
  - tcas 12y ago
    They luckily did fix this in a relatively recent version -- try updating your driver. Still crazy that it shipped in the first place like that. EDIT: just realized that I was thinking of the PL2303, which had a similar issue, not FTDI.
    - wyager 12y ago
      The newest version I can find on their site says it's from 2012. Link?
      - tcas 12y ago
        Oops, was dealing with a similar issue with the Prolific 2303, which was dealt with by using a newer driver, I haven't run into the issue yet with FTDI (which I don't as much).
        wyager 12y ago
        Bummer. The FTDI driver crashes my mac quite frequently.
Zizzle 12y ago
I foresee an arms race here. Next gen FTDI clones will work around this driver detection. Next FTDI driver has new detection code. Iterate until the counterfeit chips are indistinguishable from the real thing via software.
- Zikes 12y ago
  That's the arms race that's already in place. The new one will take place in a courtroom.
- mariuolo 12y ago
  > Iterate until the counterfeit chips are indistinguishable from the real thing via software. Will they still cost less?
  - TheLoneWolfling 12y ago
    Probably
    - jessaustin 12y ago
      But... innovation! Seriously, though, this just looks like extracting economic rents from the fact that their vendor ids come pre-installed in certain OSes.
mmagin 12y ago
As mentioned, Prolific's USB serial driver previously dropped support for counterfeit some Prolific chips, albeit not in quite as nasty of a way.
- seanp2k2 12y ago
  And I'm totally fine with that, even though that also creates a bad UX, especially for users who previously had a working thing, updated their driver / software, and now have a broken thing. Really hope everyone starts dumping FTDI and they end up in a class-action lawsuit. USB <-> serial converters are a commodity these days, regardless of what these goons think. If they can't compete in a free market, they should find something else to do or go out of business.
  - joezydeco 12y ago
    They're a commodity because they're all using counterfeit FTDI and Prolific chips.
    - makomk 12y ago
      The counterfeit FTDI chips are apparently reimplemented from scratch using a completely different design, one based around a USB microcontroller of some kind. They're a commodity because they're really easy to create.
      - rcxdude 12y ago
        Yeah, I never really understood how they justified the prices on their chips when you could literally code the same thing in a week or two on a micro which was half the price. About the only reason I see to use them is they have quite neat pre-made cable assemblies.
        bsder 12y ago
        The analog side. Being able to do the voltage regulation and oscillator operation without external components is actually non-trivial.
mey 12y ago
I haven't gotten into the DIY/Hacker/Arduino stuff but it seems like there would also be plenty of consumer devices that may be impacted that don't have correct supply chain control (or care about the source of their chips). I wonder if Windows will pull the driver.
- duncan_bayne 12y ago
  Microsoft has confirmed that they're aware of the issue, and are investigating. No news yet on what (if any) action they'll take. But I'd expect they'll do something, as it would appear to the end user that "Windows Update broke my $DEVICE".
  - mey 12y ago
    Yeah, Microsoft has a pretty robust hardware lab as part of WHQL certification. I would expect there would be some off brand devices containing this chip in their lab.
    - duncan_bayne 12y ago
      Or on-brand. One of the things that makes FTDIs decision so bad is that even a reputable manufacturer could be caught out by fraud somewhere in their supply chain.
orik 12y ago
Me and my buddy were going to work on a couple of projects last weekend and got bit by this. The workaround once your chip has been flashed by the new driver is modifying the driver to communicate with devices that have a PID of 0.
deleted 12y ago
[deleted]
0x0 12y ago
I hope this causes a major and publicly visible malfunction in some important device/installation/machinery, of course with no harm done to any persons, but enough of an embarrasment to really set an example, so no vendor will think of pulling tricks like these in the future. Takeaway lesson: End users should never touch anything remotely FTDI-like, since it's probably impossible to verify if the device is genuine or not. Wonder if FTDI thought this through.
- gioele 12y ago
  My takeaway lesson is that end users should never trust closed source drivers. Can you picture a Linux or *BSD driver in which there is an intentional if (counterfeit) { do_damage(); }
  - dalke 12y ago
    Yes, I can. I can picture a product vendor using a modified Linux kernel with that code in a driver, or at least a moral equivalent. Eg, a NAS box which is "only compatible with brand X drives". Just because the code is available doesn't mean it does no damage. Only that you have the ability to find and fix the code.
    - pb2au 12y ago
      A NAS box "only compatible with brand X drives" is nowhere near a NAS box that intentionally bricks non-brand X drives when attached. As a side note, are there any known cases where a vendor has released open source code that intentionally bricks a device? I'd be surprised if they were not found legally liable if the intent was spelled out so clearly.
      - dalke 12y ago
        Sorry, I wasn't clear. My "only compatible ..." left out "and does naughty things if otherwise." Perhaps you'll like this example better? https://www.google.com/patents/US4577289 https://www.google.com/patents/US4577289 "Hardware key-on-disk system for copy-protecting magnetic storage media" There are physical holes on the disk. "The test program writes the sections with a test pattern which generates a change in the pattern of magnetic domains of the medium, a subsection at a time, with a subsection responding to the test pattern only in the absence of indicia thereon, to form a stored pattern on the given section. An expected pattern and the stored pattern are compared at least a subsection at a time to determine if corresponding subsections have a predetermined pattern of magnetic domains." If you have "insert key disk now", followed by a write to the disk, and then a verification, then a standard disk/non-key disk will get corrupted. That 'bricks' non-brand floppies by design, under the aegis of copy protection. There's been open source with back doors in it. Eg, Firebird had one that took about 6 months to detect, after source code release. In listening to the various accounts of GPL enforcement, it isn't always easy to track down the actual vendor. Quoting from http://www.infoworld.com/article/2617579/open-source-software/why-the-gpl-licensing-cops-are-the-good-guys.html http://www.infoworld.com/article/2617579/open-source-softwar...: > Always keen to shave the last few cents from their bill of materials, these manufacturers tend to procure their firmware from low-cost suppliers that have in turn delivered open source software without passing on its licensing terms. It can come as a surprise to the hardware manufacturer to discover a violation of the license terms. While that's about incorrect use of licensing terms, it shows there's no reason why the manufacturers are aware of all of the code in the software they sell.
fn42 12y ago
Thanks for the heads up, this will probably affect us car nerds too (I'm sure my cheapo KWP2000 cable has a fake FT232)
- stinos 12y ago
  heads up indeed, might even get some heads rolling.. The FTDI chip is the sole means of communication in a major product of a startup I know. If the chips are fakes and customers are left with useless devices that's going to seriously hurt reputation and income.
JasuM 12y ago
I wonder if anti-virus and anti-malware companies will add this to their black lists.
- jessaustin 12y ago
  Can they do that to Windows Update stuff? That would be amusing...
ChuckMcM 12y ago
Interesting situation. Given that "drivers" for USB serial ports are now boiler plate, why not just have some Chinese company buy the USB VID code from the USB Consortium and then agree that everyone will make chips that export that?
amckenna 12y ago
If anyone is curious what a real vs fake FTDI chip looks like under the hood (de-capped chip) this is a great analysis and some beautiful pictures. http://zeptobars.ru/en/read/FTDI-FT232RL-real-vs-fake-supereal http://zeptobars.ru/en/read/FTDI-FT232RL-real-vs-fake-supere... Exerpt: "What's the economic reason of making software fake of well-known chip instead of making new one under your own name? This way they don't need to buy USB VID, sign drivers in Microsoft, no expenses on advertisement. This fake chip will be used right away in numerous mass-manufactured products. New chip will require designing new products (or revisions) - so sales ramp up will happen only 2-3 years later. Die manufacturing cost is roughly the same for both dies (~10-15 cents)."
- danesparza 12y ago
  +1 for the fake chip name. "Supereal" takes the cake
  - cesarb 12y ago
    "Supereal" might not be the name of the fake itself, it might be just the name of the mask-programmable microcontroller they used. "It seems that in this case Chinese designers implemented protocol-compatible "fake" chip, using mask-programmable microcontroller. This way they only needed to redo 1 mask - this is much cheaper than full mask set, and explains a lot of redundant pads on the die."
- tmp26 12y ago
  What is the HN crowd's preferred way of dealing with that kind of parasite?
  - Dylan16807 12y ago
    If someone makes a compatible chip from scratch then they are not a parasite, they are a competitor.
    - sigterm 12y ago
Someone1234 12y ago
Microsoft should revoke the driver's signature via their next CRL update, so that it refuses to install (effectively making the drivers unsigned). It is acting maliciously and will break consumer's hardware, even hardware which doesn't contain any FTDI chips. If FTDI have an issue with a company ripping off their IP then go sue that company. But what they're doing is catching consumers in the firing line, who will wind up with multiple dead USB devices. There's no reasonable way a consumer can know they are buying something with a fake chip and this could kill devices years old, which will be outside of warranty. I am totally serious that Microsoft should step in. FTDI's driver is so defective that it is literally killing hardware, if they won't step in for this then what will they step in for?
- 0x0 12y ago
  Isn't the WHQL process supposed to vet for malware like this?
  - Someone1234 12y ago
    They may not be WHQL certified, per Wikipedia: > A company can choose to sign their own drivers rather than go through the WHQL testing process. These drivers would not qualify for the "Certified for Windows" logos, but they would install on 64-bit versions of Windows and install without a warning message on 32-bit versions of Windows Vista or Windows 7. However, it will not install without a warning message on Windows XP. If they are, I don't know enough about how rigorous Microsoft's certification process is now to comment. It used to be just looking for things that would cause kernel instability but it seems the standards have increase a lot since its exception.
    - 0x0 12y ago
      But they are pushed through Windows Update? Doesn't everything there have to be WHQL?
      - rwmj 12y ago
        Correct. To use the non-MSFT signed approach, the driver has to add the cert to the registry beforehand somehow (eg. using certutil -addstore -f TrustedPublisher), which obviously rules out a straight install using Windows Update.
deleted 12y ago
[deleted]
chrissnell 12y ago
This reminds me of the Sony music CDs that came with a rootkit to prevent theft of their IP: http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootki... There were lawsuits and Sony ended up having to distribute a removal tool.
jjoonathan 12y ago
Does anyone know of good FTDI alternatives? Are there any clone makers that are relatively legit (i.e. they put their actual brand name on the chip, they support drivers, etc)? At $4.50 a pop for bog-standard bit-banging in a day and age where you can get ARM M4 SoCs for $2.75 a pop (n=1 prices) I would think FTDI would have more above-the-table competition than they do. Is the subterfuge required for illegitimate cloning really that much easier than getting a website, writing docs, and supporting drivers?!
- smilekzs 12y ago
  Didn't see your post when I was posting mine, but anyway -- CP210x.
  - FigBug 12y ago
    Do you know if it supports non-standard baud rates on OS X> (Maybe Linux too?) I use FTDI because I can easily run comm ports at 3 Mbit/s. OSX (and I think Linux too) does support comm ports at non common baud rates. I'm looking for a way to add decently quick USB comms to a device without writing my own drivers. FTDI seems like the only option. Using HID is limited to 64KB/s.
    - a1k0n 12y ago
      You could always just use libusb to talk to your device (e.g., an AVR w/ V-USB or another microcontroller with actual USB support) from user space, instead of fooling around with fake COM ports.
      - FigBug 12y ago
        That's probably what I should do. I bought a book on usb and started learning a bit about the protocol. Are there any good Libusb projects that would be a good example? Most I was were for using libusb to talk to an existing device class. I'd like a sample that contains both device and host?
smilekzs 12y ago
FT232 isn't very stable to begin with. CP210x is a much better alternative from my experience with FT232, PL2303 and CP210x.
- nitrogen 12y ago
  Does the CP210x support operation at exactly 250kbaud? I've previously recommended FTDI-based adapters for DMX-512 control of lights. The other adapters I tried can only do 232k or 256k or some fixed number, not 250k.
  - msandford 12y ago
    Looks like it: http://www.silabs.com/products/interface/usbtouart/Pages/usb-to-uart-bridge.aspx http://www.silabs.com/products/interface/usbtouart/Pages/usb... USB 2.0 compliant, full-speed (12 Mbps) No external crystal required Up to 1024 Bytes of EEPROM or OTP ROM User-programmable custom Baud rates Supports all modem interface signals Baud Rates: up to 2 Mbps Industrial temperature –40 to +85 °C Datasheet: http://www.silabs.com/Support%20Documents/TechnicalDocs/CP2101.pdf http://www.silabs.com/Support%20Documents/TechnicalDocs/CP21... UPDATE: On this PDF (page 18) it talks about how to set the baud rates. I think it defaults to "normal" serial baud rates but there's a way to modify the baud rate choices. At least that's how it reads to me. http://www.silabs.com/Support%20Documents/TechnicalDocs/AN144.pdf http://www.silabs.com/Support%20Documents/TechnicalDocs/AN14...
    - tmm 12y ago
      The CP2102 - CP2104 will do 250k; the CP2101 will not. Also, the CP2102 and CP2103 have a fixed table of rates (one of which is 250k) while the CP2104 can do arbitrary rates (within reason, see section 6.1 for details: http://www.silabs.com/Support%20Documents/TechnicalDocs/cp2104.pdf http://www.silabs.com/Support%20Documents/TechnicalDocs/cp21...).
      - msandford 12y ago
        Thanks for correcting me!
qnaal 12y ago
The real world is a lot like cyberpunk except instead of exciting it's frustrating.
beagle3 12y ago
Does this qualify as a CFAA violation? I think so and for monetary gain, no less. I would like to hear why wouldn't the DA that leaned so hard on Swartz wouldn't do the same FTDI's CEO.
- jrockway 12y ago
  Technically the counterfeit devices should have never been allowed into the country. So it should be interesting how this plays out.
  - beagle3 12y ago
    Are they actually counterfeit? Legally, I'd be surprised. They are re-implementing the FTDI protocol, which is completely legal. They are reusing FTDI's PID/VID, which might or might not be a violation of the USB specs or USB recommendations -- I'm not sure about that -- but I'd be really surprised if that matches the legal definition of "counterfeit" for which customs has the right (and duty) to stop imports.
    - jrockway 12y ago
      I'm guessing they intended to go after devices sold as FT232s with the FTDI logo on them. If there's collateral damage, that could be a problem. Then again, the users _did_ agree to let that happen in the clickwrap agreement, so it's still uncertain. Either way, I'm readying the popcorn. This should be interesting.
swamp40 12y ago
I think FTDI might be shooting themselves in the foot here. Plugging in a USB is messy, and you will sometimes get an "Unrecognized Device" error, which you simply fix by unplugging and replugging. I could see a similar hiccup causing their driver to sometimes "brick" a legitimate device. Then this false positive ripples back to a manufacturer who bought 50,000 of those chips on the last run, and thinks they might all be fake... It turns everything into a huge mess. Very poor management decision, and shame on the engineers for implementing it.
andmarios 12y ago
This is one of the many reasons to use Linux and free software on your desktop. :)
JasuM 12y ago
This seems to be reversible: http://www.reddit.com/r/arduino/comments/2k0i7x/watch_that_windows_update_ftdi_drivers_are/clgviyl http://www.reddit.com/r/arduino/comments/2k0i7x/watch_that_w...
cschneid 12y ago
Can somebody give me the background here? What is a FTDI FT232s? It appears to be a fairly low level USB controller chip? Is this chip (or its ilk) in every kind of usb device? What is the impact of this? Most of this article dives in with a fair bit of preexisting knowledge - can somebody fill me in?
- sdrothrock 12y ago
  It's a USB-serial chip. The most common device I can think of that it shows up in is USB modems.
- dfox 12y ago
  FT232 is USB to serial port adapter chip. Typical application of these chips is anything that has to be connected to USB but does not warrant full-featured USB implementation. This includes various interface cables and converters, (low-cost or specialized) test and measurement equipment and large amounts of various (semi-)custom electronics (both hobbyist and industrial). In essence, FTDI's chips are the go to solution for adding USB support when you don't want to spend too much time on it. I would argue that today there are better and cheaper alternatives, but FTDI was probably the first vendor of such chips with reasonable documentation and software support.
noonespecial 12y ago
Absolutely everything with an FTDI logo on it in the wild is now suspect. They didn't preserve their brand with this action, they just destroyed it.
JackC 12y ago
It's interesting to consider from a legal perspective exactly why this isn't something a company is allowed to do. (Assuming the company did in fact intentionally damage people's chips, reversibly or not -- sounds like we don't know for sure yet?) - Intentionally sabotaging someone's stuff, legally, is more or less the same as intentionally taking it. Keying a car and driving it away might have different names but are on the same scale. - There ain't no self help. If you think someone else's stuff should actually be your stuff, your path is through a court. - We don't fix things with injunctive relief that can be fixed with money. When Apple proves that Samsung violated a patent or vice versa, we don't collect and burn all the infringing phones, we just make someone cut a check. Because we are not idiots. - The "someone" who cuts the check is Samsung or Apple, not their customers. As far as I know no one's managed to go after end users, even in extreme cases like a $10 designer handbag where the buyer obviously knows it's not real. (And it's at best unclear whether going after the buyers would make any sense, even in those extreme cases -- if someone pays knockoff prices for a knockoff product, it's the seller and not the buyer who has ill-gotten gains. There might be some additional reputation damage and lost profits that the buyer is complicit in, but it makes a lot more sense to me -- and apparently everyone else -- to make the seller pay for those as well.) - When you do go after the seller of trademarked goods and want to seize those goods, we actually have a procedure for that -- Section 34 of the Lanham Act.[1] Which includes a whole bunch of protections like swearing out an affidavit, getting permission from a judge, informing the attorney general, posting a bond to cover damages, conducting the seizure through government agents, and keeping the seized items in the custody of the court. It's very much unlike showing up at someone's house and breaking their stuff. (I am a lawyer; I am not a trademark lawyer; I just googled some stuff based on vague memories from law school to write this.) [1] http://www.bitlaw.com/source/15usc/1116.html http://www.bitlaw.com/source/15usc/1116.html
- JackFr 12y ago
  One could argue that using the official driver with counterfeit chips is outside intended purpose of the official driver, at which point the user is proceeding at his or her own risk.
  - 12y ago
SunboX 12y ago
Official response from @FTDIChip: https://twitter.com/mikelectricstuf/status/524917368154492929 https://twitter.com/mikelectricstuf/status/52491736815449292...
- drzaiusapelord 12y ago
  This is so incredibly tone-deaf and borderline childish, its shocking how badly FTDI as a company is run. It sounds like its run by a handful of pissed off neckbeards who don't know how bad publicity and a class action suit could destroy their company.
- guyzero 12y ago
  This is the worst response possible.
- analog31 12y ago
  From that page: "FTDI is definitely not targeting end users - if you're unsure if ICs are genuine then please don't use the drivers." This is where I think they are mistaken, because end users may be downloading and installing the drivers themselves. I have done this on more than one occasion: Some gadget has a USB port and I find that it uses the FTDI chip, so I go to the web page and download the FTDI drivers for it. This may happen quite frequently, for instance when an end user moves a gadget from one PC to another, and (mistakenly assumes that) they want the latest driver. I'm disappointed because I was a big fan of FTDI and use them in a lot of my projects. I won't just go and burn all of my FTDI chips, but I am sufficiently motivated to look for an alternative. Looks like SparkFun has a couple of breakout boards for the Silicon Labs chips.
- nishonia 12y ago
  Have they contracted PR out to Ocean Marketing?
swamp40 12y ago
They are getting pummeled on Twitter now, as well. My guess is an 8am meeting in Glasgow (about 8.5 hours from now), followed by an apology and an updated driver announcement at 10am.
jhallenworld 12y ago
The real problem here is that USB does not define a standard interface for an RS-232 adapter. Proprietary drivers should never have been required for these. Same deal for Centronics printer adapters.
- userbinator 12y ago
  It does, it's called CDC and there are plenty of other adapters that use it. Which is why I think the popularity of FTDI adapters is surprising in some ways.
  - jhallenworld 12y ago
    Very interesting. I've been reading all about it: http://www.recursion.jp/avrcdc/driver.html http://www.recursion.jp/avrcdc/driver.html
  - dfox 12y ago
    The problem is that on Windows you still need .inf file with correct VID/PID (this is the case for eg. MCP2200). So for typical user there is not much of an difference between CDC and proprietary driver.
duncan_bayne 12y ago
I tried reporting this to Microsoft; their handling of calls to report security vulnerabilities was just horrendous. ===== Hi, I've been advised to email this address by 'XXXX' at Microsoft Support. FTDI is shipping a malware driver for Windows; if it detects what it thinks is a counterfeit device plugged in by USB, it bricks it. Details here: http://www.eevblog.com/forum/reviews/ftdi-driver-kills-fake-ftdi-ft232/ http://www.eevblog.com/forum/reviews/ftdi-driver-kills-fake-... I've also attempted to report this by phone as suggested by XXXX. I've never experienced such difficulty trying to report a security issue; I'd have expected that you'd have processes in place, but apparently not. My first attempt was met by a CSR who informed me that he knew of no protocol for reporting security issues, and that he couldn't help me because it wasn't directly effecting my computer. He then hung up on me when I asked to speak to a supervisor. Second call got me a much more helpful chap, who after conferring with a supervisor, transferred me to professional services. The person I spoke with there said they also didn't have any security reporting protocol, or if they did, he didn't know about it. When I said the issue could effect thousands of devices, he transferred me through to 'corporate'. I ended up going through an IVR system to an operator, who was no help whatsoever. She was entirely the wrong person to speak to; she was also completely ignorant of any security reporting process, and didn't know who to transfer me to. Could you please call me on +61 XXX XXX XXX to acknowledge receipt of this report, and to discuss it? Thanks. =====
- duncan_bayne 12y ago
  An update to this: the security folks have told me it’s not a security issue, but they’re forwarding it to the appropriate team. Perhaps I’m biased, but I’d have thought that a Windows Update that ships malware that bricks thousands of consumer devices without warning would constitute a security issue. But hey … at least they’re actioning it, and they responded so quickly. So, FYI: if you have a security issue to report to Microsoft, do it by email. Phone staff are utterly, completely useless for this.
  - azernik 12y ago
    Bureaucratically, it probably isn't a security issue for Microsoft; they have a separate department (probably legal, although maybe a separate hardware vendor relations group) that is much better at dealing with a named, legal organization like FTDI.
imrehg 12y ago
I'm designing an Arduino-compatible board[1] that supposed to have an FTDI chip for ease of design. This whole thing makes me reconsider it, what would be the best way to replace it some other solution? Do I have any real option if I want to stay within the Open Parts Library[2]? [1]: https://www.hwtrek.com/product_preview/VTZUZV9k https://www.hwtrek.com/product_preview/VTZUZV9k [2]: http://www.seeedstudio.com/wiki/Open_parts_library http://www.seeedstudio.com/wiki/Open_parts_library
- Vendan 12y ago
  not sure, but shouldn't you be able to use the ATMEGA32U4-AU as the microcontroller and get usb for free? Here's a good place to start for a bootloader that'll do your usb setup for you... http://forum.arduino.cc/index.php?topic=124459.15 http://forum.arduino.cc/index.php?topic=124459.15
  - Vendan 12y ago
    Just looked at your product idea, see you already had planned a good microcontroller. Maybe replace the FTDI with the ATMEGA and make a firmware that'll allow in circuit programming so you really can't brick the main microcontroller?
    - imrehg 12y ago
      Yeah, people suggested something similar before[1], and definitely will research it. Using two of the ATmegas might not work (the miniPCIe form factor is tiny!), I wonder if a single chip could do that, at the expense of maybe some storage? The current setup needs almost no custom work, and for the proof-of-concept version I'd rather not do firmware programming if I can avoid it (but then maybe I can't be picky about the FTDI:) Thanks for the suggestion! [1]: http://www.reddit.com/r/arduino/comments/2ehosj/pcieduino_feedback_on_arduino_clone_design_on_a/ http://www.reddit.com/r/arduino/comments/2ehosj/pcieduino_fe...
      - Vendan 12y ago
        Look at the datasheet, it's got a usb DFU bootloader loaded by default. :) Biggest issue would just be making sure it can switch over to serial mode, but that's already done in arduino's, so should be pretty easy.
swimfar 12y ago
How is this much different from what is done with other counterfeit goods[1-4]? Is it because they aren't going through legal channels to do it? But these all are counterfeit, so the end result is the same, right? When counterfeit goods are found, they are seized and destroyed. I can see people getting upset about this, but I'm surprised at the unanimous response to it. [1]Car bodies: http://autoweek.com/article/car-news/mercedes-and-daimler-crush-300sl-gullwing-imposter http://autoweek.com/article/car-news/mercedes-and-daimler-cr... [2]Guitars: http://thehub.musiciansfriend.com/bits/feds-seize-over-185-counterfeit-guitars-in-nj http://thehub.musiciansfriend.com/bits/feds-seize-over-185-c... [3]Carrying bags: http://www.hamm.eu/en/aktuelles-und-presse/news/2009/2009-04_Reisenthel_Plagiate.html http://www.hamm.eu/en/aktuelles-und-presse/news/2009/2009-04... [4]Clothing: http://www.nytimes.com/2014/01/31/nyregion/trademark-trumps-charity-so-us-will-destroy-bogus-nfl-jerseys.html?_r=0 http://www.nytimes.com/2014/01/31/nyregion/trademark-trumps-...
- jessaustin 12y ago
  [EDIT: redacted unnecessary aspersion.] In none of the links you provide are authorities taking or destroying property that consumers already bought. Rather, they're taking property from distributors who theoretically could have known better than to purchase the "counterfeits" in the first place. Can you think of any interesting way that LEOs taking property from distributors is similar to a private party destroying the property of consumers?
  - swimfar 12y ago
    It was an honest question, and that's the kind of answer I was looking for. So maybe once it's been sold nothing can be done about it(unlike stolen goods, which is obviously a different case). edit: According to a professor at the Fashion Law Institute at Fordham University, buying counterfeit goods is only illegal in France and Italy[1]. US customs even allow people to knowingly bring one counterfeit good into the country. [1] http://bucks.blogs.nytimes.com/2010/10/28/the-legality-of-buying-knockoffs/ http://bucks.blogs.nytimes.com/2010/10/28/the-legality-of-bu...
duncan_bayne 12y ago
FTDIs own website says their chips are used on medical devices: https://twitter.com/JohnnySoftware/status/525092883125506048 https://twitter.com/JohnnySoftware/status/525092883125506048 Let's hope that all the manufacturers are 100% certain of their supply chains, from top to bottom. And that there are no bugs in the driver that might cause inadvertent bricking. Way to go, FTDI.
dammitcoetzee 12y ago
FTDI Makes fantastic chips though.
rasz_pl 12y ago
Those devices are NOT bricked/broken! They are ABSOLUTELY FINE. You just need to use proper driver straight from the _real_ manufacturer - Supereal Microelectronics (or whatever). Feel free to ask "Suzhou Supereal Microelectronics" for a working driver for your counterfeit device.
- deelowe 12y ago
  You realize reverse engineering is legal and actually protected by law right? Tampering with other vendors' computer systems is not (in the software world that's called maleware). The "counterfeiting" issue is a trademark problem only. In other words, the only thing wrong here is that the Chinese manufacturer stamped FTDI on their chips. There's nothing in trademark law that says it's OK to use these tactics to combat the issue. Why would there be? The two are completely orthogonal to each other. If there are chips out there that emulate FTDI and do not have the logo, FTDI has most certainly broken the law. As others have pointed out, this would be like Intel damaging AMD chips simply because they identify themselves in a similar manner. (again, minus the bit about trademark which is again, orthogonal to what FTDI has done here).
  - rasz_pl 12y ago
    Someone reverse engineered FTDI driver on the EEVBlog forum and its not specifically detecting fakes. Its doing EXACTLY SAME procedure without discrimination - it is issuing illegal (and ignored on real chip) write to eeprom. There is no detection, just some fuzzing with illegal instructions.
cnvogel 12y ago
Here's someone claiming to have found the responsible function in a driver. PLEASE NOTE: ALL NAMES HAVE BEEN CHOSEN FREELY BY THE PERSON WHO MADE THE SCREENSHOT! So there's no name "BrickCLoneDevices()", it's probably called UpdateEEPromChksum or something like that in the original code, because it looks like that's what it does. http://www.eevblog.com/forum/reviews/ftdi-driver-kills-fake-ftdi-ft232/msg535270/#msg535270 http://www.eevblog.com/forum/reviews/ftdi-driver-kills-fake-... Assuming that this disassembly/decompiled code indeed is genuine, the interesting thing is explained in the 2nd comment block: A genuine FTDI device seems to be designed such that a write only to the offset that stores the PID is ignored, hence for a genuine part this code will only update the word at offset 62, and that would be matching the functionality to just update the eeprom checksum. For comparison, here's a random mainling-list post which includes a dump of the 232 eeprom. The VID/PID is stored at word 1 and 2 of the eeprom, something that could be a checksum is down at the word with offset 0x7f (word 0x3f = 63? There's probably a off-by-one here). http://developer.intra2net.com/mailarchive/html/libftdi/2009/msg00306.html http://developer.intra2net.com/mailarchive/html/libftdi/2009...
- makomk 12y ago
  Neither write has any effect on a genuine FTDI chip because both writes are to even addresses. That's also why they write to word 62 even though the checksum is in word 63 - they can't modify the checksum directly because that'd affect genuine devices, so instead they modify word 62 so that the data has the same checksum as before their changes. The entire thing has no purpose other than bricking clones.
voltagex_ 12y ago
If anyone's still reading - here's annotated disassembly: https://pbs.twimg.com/media/B0mf-pmCIAAoPxS.png:large https://pbs.twimg.com/media/B0mf-pmCIAAoPxS.png:large
- AlyssaRowan 12y ago
  I confirm this is an accurate analysis of the code - and that it's definitely intentional, malicious copy-protection software. Wow. I haven't seen something this spectacularly dumb in a while. Should be entertaining! :)
igmac 12y ago
Sounds like a company about to loose very badly in court, and who will shortly have to write out an apology on their cheque book. Intentionally sabotaging customer equipment will lead to all sorts of data loss and consequential damages issues. As @Someone1234 said below, FTDI needs to pursue legitimate channels to protect their IP. Ouch... Time for the CEO to reach for that third envelope and write to his successor.
Aissen 12y ago
So how does this work ? Hector Martin gives us a glimpse: Commented reverse engineering assembly: https://twitter.com/marcan42/status/525126731431038977 https://twitter.com/marcan42/status/525126731431038977 So they are rewriting the USB Product ID in EEPROM, only on "fake" chips, hence the Windows USB driver doesn't recognize the device anymore. It should be reprogrammable using the right tools. (https://twitter.com/marcan42/status/525134266112303104 https://twitter.com/marcan42/status/525134266112303104) What allows them to do things differently on different chips: "Figured out the real/clone FTDI difference: EEPROM is written in 32bit units. Even writes are ignored (buffered), odds write both halves." https://twitter.com/marcan42/status/525194603746426881 https://twitter.com/marcan42/status/525194603746426881 And some wisdom: "For those unfamiliar with embedded engineering: most USB (and other) devices can be bricked if maliciously attacked." "Assume ALL devices are brickable by evil code unless proven otherwise. This isn't news. Most devices make no attempt to protect themselves." (https://twitter.com/marcan42/status/525137221431463937 https://twitter.com/marcan42/status/525137221431463937 https://twitter.com/marcan42/status/525137463107272704 https://twitter.com/marcan42/status/525137463107272704)
stuaxo 12y ago
People should be complaining to microsoft to get these malicious drivers blocked and older non-malicious ones reinstated.
Aissen 12y ago
Finally ! Someone made a proper Linux to guarantee genuine FTDI products: https://lkml.org/lkml/2014/10/23/129 https://lkml.org/lkml/2014/10/23/129
cgtyoder 12y ago
So what are the actual products that are getting bricked? Curious about the end result of all this.
jbagel2 12y ago
I threw together a little util for correcting the PID you still have to fix the driver yourself, but I put info in the readme.. Since most of the issues are on Windows systems, its a little WPF app. https://github.com/jbagel2/FIX_BROKEN_FTDI_PID https://github.com/jbagel2/FIX_BROKEN_FTDI_PID

342 points by stoey 12y ago

Ouch, something tells me the Arduino, Raspberry Pi, etc. forums are going to be full of people that are confused why they can't talk to their device anymore. IMHO it's pretty bad to target the consumers who probably don't even know or care that there's an FTDI chip in their device. Certainly am not condoning piracy of the chips, but wonder if there's a better way of handling the situation than breaking everyone.

krapht 12y ago
I suppose they could beg the Chinese government to enforce their IP rights and crack down on counterfeit manufacturers. Or they could crack down on end-users. Or let the counterfeit manufacturers free-ride off their driver development.
alyandon 12y ago
Wow. That is seriously uncool. I'd never even heard of FTDI before but they can rest assured that if I ever need a USB-to-UART chip that FTDI won't be the company I choose to buy. FTDI's drivers refusing to work with the fake parts is understandable, purposely reprogramming them to make them non-functional isn't.
- wdewind 12y ago
  > purposely reprogramming them to make them non-functional isn't Dumb question maybe, but why?
  - sitharus 12y ago
    Because they're intentionally breaking your property. Sure it can be fixed, but it's the intent that's worrying. Simply refusing to work - perhaps logging something to the event log about counterfeit products - would be fine.
  - toomuchtodo 12y ago
    You're damaging someone's hardware without their consent? Its essentially vandalism.
    - wdewind 12y ago
      Sure, but the chips are illegal no? Where is the moral high ground coming from... I'm not a supporter of intellectual property laws, but we have them, so I'd also be curious of any legal ground fake chip users have to stand on.
      - teraflop 12y ago
        "Illegal" is an extremely broad and imprecise way to describe a physical object. Imagine I buy a car from a dealership, and without my knowledge the dealer has swapped out the original radio for a cheap counterfeit. I guess technically you could argue that makes the car "illegal" but it would be absurd to suggest that the manufacturer has the right to come to my house and slash my tires. As I see it, it's not about whether "fake chip users" are obeying the laws; the burden should be on FTDI to justify its willful property damage.
      - dragonwriter 12y ago
        To the extent that there is a violation of law involved in the manufacture, sale, or use of the chips (and such violations are much more likely in the first two cateories), there are legal remedies available for those violations, which generally require proving that a violation occurred and that the person against whom remedy is sought is the appropriate person against whom to seek a remedy. To the extent the violations are with manufacture and sale, the user is not generally the appropriate target, even if destruction of the device was an appropriate remedy.
      - wtallis 12y ago
        The label printed on the outside of the plastic package of the chip is the only thing that's illegal, since it's depicting FTDI's trademark. Scrape that off and you've got a 100% legal compatible clone. Whoever decided to use the clones in any given device may be be in breach of a contract if the use of genuine FTDI chips was specified, but that may easily not be the case. (The clones also violate USB specs by using someone else's VID, but that only prevents them from labeling the product with the trademarked USB logo.) Also, possession of the fake chip as an end user is no more illegal than owning fake Louis Vuitton stuff. It's the sale under false pretenses that gets you in trouble.
  - tdicola 12y ago
    I could sort of understand it if the driver refused to work and popped up some dialog that said "You're using a counterfeit FTDI device, here's how to get an official device. Sorry this driver is not compatible with unofficial devices." However if it just silently bricks the chip then consumers will have no idea what's wrong. They'll think their Arduino clone is broken or they can't talk to their Raspberry Pi for some reason. I doubt they'll make the connection that the FTDI chip in their device is a clone and understand what to do to fix it.
  - jerf 12y ago
    In addition to the other posted replies, it's bad software engineering. You really can't be confident enough in your logic to ever start issuing DESTROY_HARDWARE() commands of any kind, short of the small set of very specialized programs that may be deliberately used for such things (FPGA programmers, etc). Any error whatsoever and you may end up nuking your real customer's hardware. Bad plan. Same reason why programs that think they are pirated shouldn't run around being actively destructive... some real customer will find some way to tickle that code, if only through bad hardware, and now you're in trouble. To a first approximation, all code eventually runs. Relatedly, never put an error message into your product you wouldn't want customers to see, because they will.
    - wdewind 12y ago
      Thanks, that's a great answer, but I guess I'm curious about legal/ethical considerations.
      - Vendan 12y ago
        I can't find it anywhere, but I remember reading about a software company that wrote an office suite for early computers (like DOS or possibly even pre-DOS), that would detect if it was a legal copy, and if it wasn't a legal copy, would delete your data. I seem to recall that they got slammed by the legal system pretty hard, which is one possible reason for why software companies don't do it nowadays. I personally see this as an action on par with, or worse then, the software company I mentioned's actions.
  - alyandon 12y ago
    Making alterations to someone else's property without their consent for the express purpose of rendering it non-functional is commonly called vandalism.
    - wdewind 12y ago
      In a culture with intellectual property laws I'm not sure that's true. Is it legal to destroy counterfeit handbags commonly sold on the street? Honest question, the police seem to do it frequently.
      - Vendan 12y ago
        Even if it is, there is a difference between the police doing it and the company doing it.
makomk 12y ago
Fortunately, most of the newer Arduinos have moved to firmware implementations of USB-to-serial that use one of the standard USB device classes and drivers, but there's all kinds of stuff out there with FTDI chips in.

dmitrygr 12y ago

IF this is on purpose and can be proven so, it is most definitely illegal!

spiritplumber 12y ago
All they have to say is "We write our drivers to support our chips, if it messes with other chips that incorrectly identify as ours, that's just the way it went, it'd cost us extra to support them and why should we help our competitors". Practically impossible to prove otherwise.
- rainforest 12y ago
  They have a track record of trying to fingerprint and screwing with counterfeits, so it would appear there's evidence the driver doesn't happen to disable counterfeits, but actively disables them. To me there's a fuzzy distinction (possibly not reflected in law) between software that breaks when you make it do stuff you didn't design, versus having it attack things you don't want it to work with.
- DannyBee 12y ago
  "All they have to say is "We write our drivers to support our chips, if it messes with other chips that incorrectly identify as ours, that's just the way it went, it'd cost us extra to support them and why should we help our competitors"." Buzz, thanks for playing. :) That won't get them out of discovery for various torts, and the discovery (emails, code, etc) is likely to show they did this on purpose. It's not practically impossible, it's trivially easy to disassemble and see if it does this on purpose. Then you argue it to a jury, and it's going to look really really bad for FTDI.
  - Tomte 12y ago
    I wish German civil law had something like your discovery process. Over here the claimant probably would not be able to peek into the defendant's stuff. Especially if he can't specifically claim "on march 10th, Mr. Meier sent an email to Mr. Schmidt discussing topic X". A simple "hand over your mails about the matter at hand" would be ruled a "fishing expedition", not admissible as a motion to discover.

dogecoinbase 12y ago

Hackaday has a good short summary of the situation: http://hackaday.com/2014/10/22/watch-that-windows-update-ftdi-drivers-are-killing-fake-chips/ http://hackaday.com/2014/10/22/watch-that-windows-update-ftd...

adamfeldman 12y ago
Elsewhere Hackaday links to a Russian microelectronics company's blog[1], where they decapped real and fake FTDI chips and found that: "It seems that in this case Chinese designers implemented protocol-compatible "fake" chip, using mask-programmable microcontroller. This way they only needed to redo 1 mask - this is much cheaper than full mask set, and explains a lot of redundant pads on the die. Fake chip was working kinda fine until FTDI released drivers update, which were able to detect fake chips via USB and send only 0's in this case. It was impossible to foresee any possible further driver checks without full schematic recovery and these hidden tricks saved FTDI profits." [1]: http://zeptobars.ru/en/read/FTDI-FT232RL-real-vs-fake-supereal http://zeptobars.ru/en/read/FTDI-FT232RL-real-vs-fake-supere...
Someone1234 12y ago
I am more entertained by that animation than I should be...

bri3d 12y ago

FTDI have been anti-consumer for years - their last several drivers have introduced intentional instability and Code 10 errors for suspected counterfeit devices. I think this is totally crappy. I see what they're trying to do (create market incentive for consumers to insist on real FTDI chips) but the reality is that it's just screwing over innocent consumers who buy a device.

wrl 12y ago
The FTDI OSX drivers will still randomly cause kernel panics when the device is unplugged and a program still holds an open file descriptor for the serial port. While working with a company which was developing and selling products with FTDI chips in them, we made FTDI aware of this issue and attached many panic logs. It's been about 5 years and they've still yet to actually fix it.
- tcas 12y ago
  They luckily did fix this in a relatively recent version -- try updating your driver. Still crazy that it shipped in the first place like that. EDIT: just realized that I was thinking of the PL2303, which had a similar issue, not FTDI.
  - wyager 12y ago
    The newest version I can find on their site says it's from 2012. Link?
    - tcas 12y ago
      Oops, was dealing with a similar issue with the Prolific 2303, which was dealt with by using a newer driver, I haven't run into the issue yet with FTDI (which I don't as much).
      - wyager 12y ago
        Bummer. The FTDI driver crashes my mac quite frequently.

Zizzle 12y ago

I foresee an arms race here. Next gen FTDI clones will work around this driver detection. Next FTDI driver has new detection code. Iterate until the counterfeit chips are indistinguishable from the real thing via software.

Zikes 12y ago
That's the arms race that's already in place. The new one will take place in a courtroom.
mariuolo 12y ago
> Iterate until the counterfeit chips are indistinguishable from the real thing via software. Will they still cost less?
- TheLoneWolfling 12y ago
  Probably
  - jessaustin 12y ago
    But... innovation! Seriously, though, this just looks like extracting economic rents from the fact that their vendor ids come pre-installed in certain OSes.

mmagin 12y ago

As mentioned, Prolific's USB serial driver previously dropped support for counterfeit some Prolific chips, albeit not in quite as nasty of a way.

seanp2k2 12y ago
And I'm totally fine with that, even though that also creates a bad UX, especially for users who previously had a working thing, updated their driver / software, and now have a broken thing. Really hope everyone starts dumping FTDI and they end up in a class-action lawsuit. USB <-> serial converters are a commodity these days, regardless of what these goons think. If they can't compete in a free market, they should find something else to do or go out of business.
- joezydeco 12y ago
  They're a commodity because they're all using counterfeit FTDI and Prolific chips.
  - makomk 12y ago
    The counterfeit FTDI chips are apparently reimplemented from scratch using a completely different design, one based around a USB microcontroller of some kind. They're a commodity because they're really easy to create.
    - rcxdude 12y ago
      Yeah, I never really understood how they justified the prices on their chips when you could literally code the same thing in a week or two on a micro which was half the price. About the only reason I see to use them is they have quite neat pre-made cable assemblies.
      - bsder 12y ago
        The analog side. Being able to do the voltage regulation and oscillator operation without external components is actually non-trivial.

mey 12y ago

I haven't gotten into the DIY/Hacker/Arduino stuff but it seems like there would also be plenty of consumer devices that may be impacted that don't have correct supply chain control (or care about the source of their chips). I wonder if Windows will pull the driver.

duncan_bayne 12y ago
Microsoft has confirmed that they're aware of the issue, and are investigating. No news yet on what (if any) action they'll take. But I'd expect they'll do something, as it would appear to the end user that "Windows Update broke my $DEVICE".
- mey 12y ago
  Yeah, Microsoft has a pretty robust hardware lab as part of WHQL certification. I would expect there would be some off brand devices containing this chip in their lab.
  - duncan_bayne 12y ago
    Or on-brand. One of the things that makes FTDIs decision so bad is that even a reputable manufacturer could be caught out by fraud somewhere in their supply chain.

orik 12y ago

Me and my buddy were going to work on a couple of projects last weekend and got bit by this. The workaround once your chip has been flashed by the new driver is modifying the driver to communicate with devices that have a PID of 0.

deleted 12y ago

[deleted]

0x0 12y ago

I hope this causes a major and publicly visible malfunction in some important device/installation/machinery, of course with no harm done to any persons, but enough of an embarrasment to really set an example, so no vendor will think of pulling tricks like these in the future. Takeaway lesson: End users should never touch anything remotely FTDI-like, since it's probably impossible to verify if the device is genuine or not. Wonder if FTDI thought this through.

gioele 12y ago
My takeaway lesson is that end users should never trust closed source drivers. Can you picture a Linux or *BSD driver in which there is an intentional if (counterfeit) { do_damage(); }
- dalke 12y ago
  Yes, I can. I can picture a product vendor using a modified Linux kernel with that code in a driver, or at least a moral equivalent. Eg, a NAS box which is "only compatible with brand X drives". Just because the code is available doesn't mean it does no damage. Only that you have the ability to find and fix the code.
  - pb2au 12y ago
    A NAS box "only compatible with brand X drives" is nowhere near a NAS box that intentionally bricks non-brand X drives when attached. As a side note, are there any known cases where a vendor has released open source code that intentionally bricks a device? I'd be surprised if they were not found legally liable if the intent was spelled out so clearly.
    - dalke 12y ago
      Sorry, I wasn't clear. My "only compatible ..." left out "and does naughty things if otherwise." Perhaps you'll like this example better? https://www.google.com/patents/US4577289 https://www.google.com/patents/US4577289 "Hardware key-on-disk system for copy-protecting magnetic storage media" There are physical holes on the disk. "The test program writes the sections with a test pattern which generates a change in the pattern of magnetic domains of the medium, a subsection at a time, with a subsection responding to the test pattern only in the absence of indicia thereon, to form a stored pattern on the given section. An expected pattern and the stored pattern are compared at least a subsection at a time to determine if corresponding subsections have a predetermined pattern of magnetic domains." If you have "insert key disk now", followed by a write to the disk, and then a verification, then a standard disk/non-key disk will get corrupted. That 'bricks' non-brand floppies by design, under the aegis of copy protection. There's been open source with back doors in it. Eg, Firebird had one that took about 6 months to detect, after source code release. In listening to the various accounts of GPL enforcement, it isn't always easy to track down the actual vendor. Quoting from http://www.infoworld.com/article/2617579/open-source-software/why-the-gpl-licensing-cops-are-the-good-guys.html http://www.infoworld.com/article/2617579/open-source-softwar...: > Always keen to shave the last few cents from their bill of materials, these manufacturers tend to procure their firmware from low-cost suppliers that have in turn delivered open source software without passing on its licensing terms. It can come as a surprise to the hardware manufacturer to discover a violation of the license terms. While that's about incorrect use of licensing terms, it shows there's no reason why the manufacturers are aware of all of the code in the software they sell.

fn42 12y ago

Thanks for the heads up, this will probably affect us car nerds too (I'm sure my cheapo KWP2000 cable has a fake FT232)

stinos 12y ago
heads up indeed, might even get some heads rolling.. The FTDI chip is the sole means of communication in a major product of a startup I know. If the chips are fakes and customers are left with useless devices that's going to seriously hurt reputation and income.

JasuM 12y ago

I wonder if anti-virus and anti-malware companies will add this to their black lists.

jessaustin 12y ago
Can they do that to Windows Update stuff? That would be amusing...

ChuckMcM 12y ago

Interesting situation. Given that "drivers" for USB serial ports are now boiler plate, why not just have some Chinese company buy the USB VID code from the USB Consortium and then agree that everyone will make chips that export that?

amckenna 12y ago

If anyone is curious what a real vs fake FTDI chip looks like under the hood (de-capped chip) this is a great analysis and some beautiful pictures. http://zeptobars.ru/en/read/FTDI-FT232RL-real-vs-fake-supereal http://zeptobars.ru/en/read/FTDI-FT232RL-real-vs-fake-supere... Exerpt: "What's the economic reason of making software fake of well-known chip instead of making new one under your own name? This way they don't need to buy USB VID, sign drivers in Microsoft, no expenses on advertisement. This fake chip will be used right away in numerous mass-manufactured products. New chip will require designing new products (or revisions) - so sales ramp up will happen only 2-3 years later. Die manufacturing cost is roughly the same for both dies (~10-15 cents)."

danesparza 12y ago
+1 for the fake chip name. "Supereal" takes the cake
- cesarb 12y ago
  "Supereal" might not be the name of the fake itself, it might be just the name of the mask-programmable microcontroller they used. "It seems that in this case Chinese designers implemented protocol-compatible "fake" chip, using mask-programmable microcontroller. This way they only needed to redo 1 mask - this is much cheaper than full mask set, and explains a lot of redundant pads on the die."
tmp26 12y ago
What is the HN crowd's preferred way of dealing with that kind of parasite?
- Dylan16807 12y ago
  If someone makes a compatible chip from scratch then they are not a parasite, they are a competitor.
  - sigterm 12y ago

Someone1234 12y ago

Microsoft should revoke the driver's signature via their next CRL update, so that it refuses to install (effectively making the drivers unsigned). It is acting maliciously and will break consumer's hardware, even hardware which doesn't contain any FTDI chips. If FTDI have an issue with a company ripping off their IP then go sue that company. But what they're doing is catching consumers in the firing line, who will wind up with multiple dead USB devices. There's no reasonable way a consumer can know they are buying something with a fake chip and this could kill devices years old, which will be outside of warranty. I am totally serious that Microsoft should step in. FTDI's driver is so defective that it is literally killing hardware, if they won't step in for this then what will they step in for?

0x0 12y ago
Isn't the WHQL process supposed to vet for malware like this?
- Someone1234 12y ago
  They may not be WHQL certified, per Wikipedia: > A company can choose to sign their own drivers rather than go through the WHQL testing process. These drivers would not qualify for the "Certified for Windows" logos, but they would install on 64-bit versions of Windows and install without a warning message on 32-bit versions of Windows Vista or Windows 7. However, it will not install without a warning message on Windows XP. If they are, I don't know enough about how rigorous Microsoft's certification process is now to comment. It used to be just looking for things that would cause kernel instability but it seems the standards have increase a lot since its exception.
  - 0x0 12y ago
    But they are pushed through Windows Update? Doesn't everything there have to be WHQL?
    - rwmj 12y ago
      Correct. To use the non-MSFT signed approach, the driver has to add the cert to the registry beforehand somehow (eg. using certutil -addstore -f TrustedPublisher), which obviously rules out a straight install using Windows Update.

deleted 12y ago

[deleted]

chrissnell 12y ago

This reminds me of the Sony music CDs that came with a rootkit to prevent theft of their IP: http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootki... There were lawsuits and Sony ended up having to distribute a removal tool.

jjoonathan 12y ago

Does anyone know of good FTDI alternatives? Are there any clone makers that are relatively legit (i.e. they put their actual brand name on the chip, they support drivers, etc)? At $4.50 a pop for bog-standard bit-banging in a day and age where you can get ARM M4 SoCs for $2.75 a pop (n=1 prices) I would think FTDI would have more above-the-table competition than they do. Is the subterfuge required for illegitimate cloning really that much easier than getting a website, writing docs, and supporting drivers?!

smilekzs 12y ago
Didn't see your post when I was posting mine, but anyway -- CP210x.
- FigBug 12y ago
  Do you know if it supports non-standard baud rates on OS X> (Maybe Linux too?) I use FTDI because I can easily run comm ports at 3 Mbit/s. OSX (and I think Linux too) does support comm ports at non common baud rates. I'm looking for a way to add decently quick USB comms to a device without writing my own drivers. FTDI seems like the only option. Using HID is limited to 64KB/s.
  - a1k0n 12y ago
    You could always just use libusb to talk to your device (e.g., an AVR w/ V-USB or another microcontroller with actual USB support) from user space, instead of fooling around with fake COM ports.
    - FigBug 12y ago
      That's probably what I should do. I bought a book on usb and started learning a bit about the protocol. Are there any good Libusb projects that would be a good example? Most I was were for using libusb to talk to an existing device class. I'd like a sample that contains both device and host?

smilekzs 12y ago

FT232 isn't very stable to begin with. CP210x is a much better alternative from my experience with FT232, PL2303 and CP210x.

nitrogen 12y ago
Does the CP210x support operation at exactly 250kbaud? I've previously recommended FTDI-based adapters for DMX-512 control of lights. The other adapters I tried can only do 232k or 256k or some fixed number, not 250k.
- msandford 12y ago
  Looks like it: http://www.silabs.com/products/interface/usbtouart/Pages/usb-to-uart-bridge.aspx http://www.silabs.com/products/interface/usbtouart/Pages/usb... USB 2.0 compliant, full-speed (12 Mbps) No external crystal required Up to 1024 Bytes of EEPROM or OTP ROM User-programmable custom Baud rates Supports all modem interface signals Baud Rates: up to 2 Mbps Industrial temperature –40 to +85 °C Datasheet: http://www.silabs.com/Support%20Documents/TechnicalDocs/CP2101.pdf http://www.silabs.com/Support%20Documents/TechnicalDocs/CP21... UPDATE: On this PDF (page 18) it talks about how to set the baud rates. I think it defaults to "normal" serial baud rates but there's a way to modify the baud rate choices. At least that's how it reads to me. http://www.silabs.com/Support%20Documents/TechnicalDocs/AN144.pdf http://www.silabs.com/Support%20Documents/TechnicalDocs/AN14...
  - tmm 12y ago
    The CP2102 - CP2104 will do 250k; the CP2101 will not. Also, the CP2102 and CP2103 have a fixed table of rates (one of which is 250k) while the CP2104 can do arbitrary rates (within reason, see section 6.1 for details: http://www.silabs.com/Support%20Documents/TechnicalDocs/cp2104.pdf http://www.silabs.com/Support%20Documents/TechnicalDocs/cp21...).
    - msandford 12y ago
      Thanks for correcting me!

qnaal 12y ago

The real world is a lot like cyberpunk except instead of exciting it's frustrating.

beagle3 12y ago

Does this qualify as a CFAA violation? I think so and for monetary gain, no less. I would like to hear why wouldn't the DA that leaned so hard on Swartz wouldn't do the same FTDI's CEO.

jrockway 12y ago
Technically the counterfeit devices should have never been allowed into the country. So it should be interesting how this plays out.
- beagle3 12y ago
  Are they actually counterfeit? Legally, I'd be surprised. They are re-implementing the FTDI protocol, which is completely legal. They are reusing FTDI's PID/VID, which might or might not be a violation of the USB specs or USB recommendations -- I'm not sure about that -- but I'd be really surprised if that matches the legal definition of "counterfeit" for which customs has the right (and duty) to stop imports.
  - jrockway 12y ago
    I'm guessing they intended to go after devices sold as FT232s with the FTDI logo on them. If there's collateral damage, that could be a problem. Then again, the users _did_ agree to let that happen in the clickwrap agreement, so it's still uncertain. Either way, I'm readying the popcorn. This should be interesting.

swamp40 12y ago

I think FTDI might be shooting themselves in the foot here. Plugging in a USB is messy, and you will sometimes get an "Unrecognized Device" error, which you simply fix by unplugging and replugging. I could see a similar hiccup causing their driver to sometimes "brick" a legitimate device. Then this false positive ripples back to a manufacturer who bought 50,000 of those chips on the last run, and thinks they might all be fake... It turns everything into a huge mess. Very poor management decision, and shame on the engineers for implementing it.

andmarios 12y ago

This is one of the many reasons to use Linux and free software on your desktop. :)

JasuM 12y ago

This seems to be reversible: http://www.reddit.com/r/arduino/comments/2k0i7x/watch_that_windows_update_ftdi_drivers_are/clgviyl http://www.reddit.com/r/arduino/comments/2k0i7x/watch_that_w...

cschneid 12y ago

Can somebody give me the background here? What is a FTDI FT232s? It appears to be a fairly low level USB controller chip? Is this chip (or its ilk) in every kind of usb device? What is the impact of this? Most of this article dives in with a fair bit of preexisting knowledge - can somebody fill me in?

sdrothrock 12y ago
It's a USB-serial chip. The most common device I can think of that it shows up in is USB modems.
dfox 12y ago
FT232 is USB to serial port adapter chip. Typical application of these chips is anything that has to be connected to USB but does not warrant full-featured USB implementation. This includes various interface cables and converters, (low-cost or specialized) test and measurement equipment and large amounts of various (semi-)custom electronics (both hobbyist and industrial). In essence, FTDI's chips are the go to solution for adding USB support when you don't want to spend too much time on it. I would argue that today there are better and cheaper alternatives, but FTDI was probably the first vendor of such chips with reasonable documentation and software support.

noonespecial 12y ago

Absolutely everything with an FTDI logo on it in the wild is now suspect. They didn't preserve their brand with this action, they just destroyed it.

JackC 12y ago

It's interesting to consider from a legal perspective exactly why this isn't something a company is allowed to do. (Assuming the company did in fact intentionally damage people's chips, reversibly or not -- sounds like we don't know for sure yet?) - Intentionally sabotaging someone's stuff, legally, is more or less the same as intentionally taking it. Keying a car and driving it away might have different names but are on the same scale. - There ain't no self help. If you think someone else's stuff should actually be your stuff, your path is through a court. - We don't fix things with injunctive relief that can be fixed with money. When Apple proves that Samsung violated a patent or vice versa, we don't collect and burn all the infringing phones, we just make someone cut a check. Because we are not idiots. - The "someone" who cuts the check is Samsung or Apple, not their customers. As far as I know no one's managed to go after end users, even in extreme cases like a $10 designer handbag where the buyer obviously knows it's not real. (And it's at best unclear whether going after the buyers would make any sense, even in those extreme cases -- if someone pays knockoff prices for a knockoff product, it's the seller and not the buyer who has ill-gotten gains. There might be some additional reputation damage and lost profits that the buyer is complicit in, but it makes a lot more sense to me -- and apparently everyone else -- to make the seller pay for those as well.) - When you do go after the seller of trademarked goods and want to seize those goods, we actually have a procedure for that -- Section 34 of the Lanham Act.[1] Which includes a whole bunch of protections like swearing out an affidavit, getting permission from a judge, informing the attorney general, posting a bond to cover damages, conducting the seizure through government agents, and keeping the seized items in the custody of the court. It's very much unlike showing up at someone's house and breaking their stuff. (I am a lawyer; I am not a trademark lawyer; I just googled some stuff based on vague memories from law school to write this.) [1] http://www.bitlaw.com/source/15usc/1116.html http://www.bitlaw.com/source/15usc/1116.html

JackFr 12y ago
One could argue that using the official driver with counterfeit chips is outside intended purpose of the official driver, at which point the user is proceeding at his or her own risk.
- 12y ago

SunboX 12y ago

Official response from @FTDIChip: https://twitter.com/mikelectricstuf/status/524917368154492929 https://twitter.com/mikelectricstuf/status/52491736815449292...

drzaiusapelord 12y ago
This is so incredibly tone-deaf and borderline childish, its shocking how badly FTDI as a company is run. It sounds like its run by a handful of pissed off neckbeards who don't know how bad publicity and a class action suit could destroy their company.
guyzero 12y ago
This is the worst response possible.
analog31 12y ago
From that page: "FTDI is definitely not targeting end users - if you're unsure if ICs are genuine then please don't use the drivers." This is where I think they are mistaken, because end users may be downloading and installing the drivers themselves. I have done this on more than one occasion: Some gadget has a USB port and I find that it uses the FTDI chip, so I go to the web page and download the FTDI drivers for it. This may happen quite frequently, for instance when an end user moves a gadget from one PC to another, and (mistakenly assumes that) they want the latest driver. I'm disappointed because I was a big fan of FTDI and use them in a lot of my projects. I won't just go and burn all of my FTDI chips, but I am sufficiently motivated to look for an alternative. Looks like SparkFun has a couple of breakout boards for the Silicon Labs chips.
nishonia 12y ago
Have they contracted PR out to Ocean Marketing?

swamp40 12y ago

They are getting pummeled on Twitter now, as well. My guess is an 8am meeting in Glasgow (about 8.5 hours from now), followed by an apology and an updated driver announcement at 10am.

jhallenworld 12y ago

The real problem here is that USB does not define a standard interface for an RS-232 adapter. Proprietary drivers should never have been required for these. Same deal for Centronics printer adapters.

userbinator 12y ago
It does, it's called CDC and there are plenty of other adapters that use it. Which is why I think the popularity of FTDI adapters is surprising in some ways.
- jhallenworld 12y ago
  Very interesting. I've been reading all about it: http://www.recursion.jp/avrcdc/driver.html http://www.recursion.jp/avrcdc/driver.html
- dfox 12y ago
  The problem is that on Windows you still need .inf file with correct VID/PID (this is the case for eg. MCP2200). So for typical user there is not much of an difference between CDC and proprietary driver.

duncan_bayne 12y ago

I tried reporting this to Microsoft; their handling of calls to report security vulnerabilities was just horrendous. ===== Hi, I've been advised to email this address by 'XXXX' at Microsoft Support. FTDI is shipping a malware driver for Windows; if it detects what it thinks is a counterfeit device plugged in by USB, it bricks it. Details here: http://www.eevblog.com/forum/reviews/ftdi-driver-kills-fake-ftdi-ft232/ http://www.eevblog.com/forum/reviews/ftdi-driver-kills-fake-... I've also attempted to report this by phone as suggested by XXXX. I've never experienced such difficulty trying to report a security issue; I'd have expected that you'd have processes in place, but apparently not. My first attempt was met by a CSR who informed me that he knew of no protocol for reporting security issues, and that he couldn't help me because it wasn't directly effecting my computer. He then hung up on me when I asked to speak to a supervisor. Second call got me a much more helpful chap, who after conferring with a supervisor, transferred me to professional services. The person I spoke with there said they also didn't have any security reporting protocol, or if they did, he didn't know about it. When I said the issue could effect thousands of devices, he transferred me through to 'corporate'. I ended up going through an IVR system to an operator, who was no help whatsoever. She was entirely the wrong person to speak to; she was also completely ignorant of any security reporting process, and didn't know who to transfer me to. Could you please call me on +61 XXX XXX XXX to acknowledge receipt of this report, and to discuss it? Thanks. =====

duncan_bayne 12y ago
An update to this: the security folks have told me it’s not a security issue, but they’re forwarding it to the appropriate team. Perhaps I’m biased, but I’d have thought that a Windows Update that ships malware that bricks thousands of consumer devices without warning would constitute a security issue. But hey … at least they’re actioning it, and they responded so quickly. So, FYI: if you have a security issue to report to Microsoft, do it by email. Phone staff are utterly, completely useless for this.
- azernik 12y ago
  Bureaucratically, it probably isn't a security issue for Microsoft; they have a separate department (probably legal, although maybe a separate hardware vendor relations group) that is much better at dealing with a named, legal organization like FTDI.

imrehg 12y ago

I'm designing an Arduino-compatible board[1] that supposed to have an FTDI chip for ease of design. This whole thing makes me reconsider it, what would be the best way to replace it some other solution? Do I have any real option if I want to stay within the Open Parts Library[2]? [1]: https://www.hwtrek.com/product_preview/VTZUZV9k https://www.hwtrek.com/product_preview/VTZUZV9k [2]: http://www.seeedstudio.com/wiki/Open_parts_library http://www.seeedstudio.com/wiki/Open_parts_library

Vendan 12y ago
not sure, but shouldn't you be able to use the ATMEGA32U4-AU as the microcontroller and get usb for free? Here's a good place to start for a bootloader that'll do your usb setup for you... http://forum.arduino.cc/index.php?topic=124459.15 http://forum.arduino.cc/index.php?topic=124459.15
- Vendan 12y ago
  Just looked at your product idea, see you already had planned a good microcontroller. Maybe replace the FTDI with the ATMEGA and make a firmware that'll allow in circuit programming so you really can't brick the main microcontroller?
  - imrehg 12y ago
    Yeah, people suggested something similar before[1], and definitely will research it. Using two of the ATmegas might not work (the miniPCIe form factor is tiny!), I wonder if a single chip could do that, at the expense of maybe some storage? The current setup needs almost no custom work, and for the proof-of-concept version I'd rather not do firmware programming if I can avoid it (but then maybe I can't be picky about the FTDI:) Thanks for the suggestion! [1]: http://www.reddit.com/r/arduino/comments/2ehosj/pcieduino_feedback_on_arduino_clone_design_on_a/ http://www.reddit.com/r/arduino/comments/2ehosj/pcieduino_fe...
    - Vendan 12y ago
      Look at the datasheet, it's got a usb DFU bootloader loaded by default. :) Biggest issue would just be making sure it can switch over to serial mode, but that's already done in arduino's, so should be pretty easy.

swimfar 12y ago

How is this much different from what is done with other counterfeit goods[1-4]? Is it because they aren't going through legal channels to do it? But these all are counterfeit, so the end result is the same, right? When counterfeit goods are found, they are seized and destroyed. I can see people getting upset about this, but I'm surprised at the unanimous response to it. [1]Car bodies: http://autoweek.com/article/car-news/mercedes-and-daimler-crush-300sl-gullwing-imposter http://autoweek.com/article/car-news/mercedes-and-daimler-cr... [2]Guitars: http://thehub.musiciansfriend.com/bits/feds-seize-over-185-counterfeit-guitars-in-nj http://thehub.musiciansfriend.com/bits/feds-seize-over-185-c... [3]Carrying bags: http://www.hamm.eu/en/aktuelles-und-presse/news/2009/2009-04_Reisenthel_Plagiate.html http://www.hamm.eu/en/aktuelles-und-presse/news/2009/2009-04... [4]Clothing: http://www.nytimes.com/2014/01/31/nyregion/trademark-trumps-charity-so-us-will-destroy-bogus-nfl-jerseys.html?_r=0 http://www.nytimes.com/2014/01/31/nyregion/trademark-trumps-...

jessaustin 12y ago
[EDIT: redacted unnecessary aspersion.] In none of the links you provide are authorities taking or destroying property that consumers already bought. Rather, they're taking property from distributors who theoretically could have known better than to purchase the "counterfeits" in the first place. Can you think of any interesting way that LEOs taking property from distributors is similar to a private party destroying the property of consumers?
- swimfar 12y ago
  It was an honest question, and that's the kind of answer I was looking for. So maybe once it's been sold nothing can be done about it(unlike stolen goods, which is obviously a different case). edit: According to a professor at the Fashion Law Institute at Fordham University, buying counterfeit goods is only illegal in France and Italy[1]. US customs even allow people to knowingly bring one counterfeit good into the country. [1] http://bucks.blogs.nytimes.com/2010/10/28/the-legality-of-buying-knockoffs/ http://bucks.blogs.nytimes.com/2010/10/28/the-legality-of-bu...

duncan_bayne 12y ago

FTDIs own website says their chips are used on medical devices: https://twitter.com/JohnnySoftware/status/525092883125506048 https://twitter.com/JohnnySoftware/status/525092883125506048 Let's hope that all the manufacturers are 100% certain of their supply chains, from top to bottom. And that there are no bugs in the driver that might cause inadvertent bricking. Way to go, FTDI.

dammitcoetzee 12y ago

FTDI Makes fantastic chips though.

rasz_pl 12y ago

Those devices are NOT bricked/broken! They are ABSOLUTELY FINE. You just need to use proper driver straight from the _real_ manufacturer - Supereal Microelectronics (or whatever). Feel free to ask "Suzhou Supereal Microelectronics" for a working driver for your counterfeit device.

deelowe 12y ago
You realize reverse engineering is legal and actually protected by law right? Tampering with other vendors' computer systems is not (in the software world that's called maleware). The "counterfeiting" issue is a trademark problem only. In other words, the only thing wrong here is that the Chinese manufacturer stamped FTDI on their chips. There's nothing in trademark law that says it's OK to use these tactics to combat the issue. Why would there be? The two are completely orthogonal to each other. If there are chips out there that emulate FTDI and do not have the logo, FTDI has most certainly broken the law. As others have pointed out, this would be like Intel damaging AMD chips simply because they identify themselves in a similar manner. (again, minus the bit about trademark which is again, orthogonal to what FTDI has done here).
- rasz_pl 12y ago
  Someone reverse engineered FTDI driver on the EEVBlog forum and its not specifically detecting fakes. Its doing EXACTLY SAME procedure without discrimination - it is issuing illegal (and ignored on real chip) write to eeprom. There is no detection, just some fuzzing with illegal instructions.

cnvogel 12y ago

Here's someone claiming to have found the responsible function in a driver. PLEASE NOTE: ALL NAMES HAVE BEEN CHOSEN FREELY BY THE PERSON WHO MADE THE SCREENSHOT! So there's no name "BrickCLoneDevices()", it's probably called UpdateEEPromChksum or something like that in the original code, because it looks like that's what it does. http://www.eevblog.com/forum/reviews/ftdi-driver-kills-fake-ftdi-ft232/msg535270/#msg535270 http://www.eevblog.com/forum/reviews/ftdi-driver-kills-fake-... Assuming that this disassembly/decompiled code indeed is genuine, the interesting thing is explained in the 2nd comment block: A genuine FTDI device seems to be designed such that a write only to the offset that stores the PID is ignored, hence for a genuine part this code will only update the word at offset 62, and that would be matching the functionality to just update the eeprom checksum. For comparison, here's a random mainling-list post which includes a dump of the 232 eeprom. The VID/PID is stored at word 1 and 2 of the eeprom, something that could be a checksum is down at the word with offset 0x7f (word 0x3f = 63? There's probably a off-by-one here). http://developer.intra2net.com/mailarchive/html/libftdi/2009/msg00306.html http://developer.intra2net.com/mailarchive/html/libftdi/2009...

makomk 12y ago
Neither write has any effect on a genuine FTDI chip because both writes are to even addresses. That's also why they write to word 62 even though the checksum is in word 63 - they can't modify the checksum directly because that'd affect genuine devices, so instead they modify word 62 so that the data has the same checksum as before their changes. The entire thing has no purpose other than bricking clones.

voltagex_ 12y ago

If anyone's still reading - here's annotated disassembly: https://pbs.twimg.com/media/B0mf-pmCIAAoPxS.png:large https://pbs.twimg.com/media/B0mf-pmCIAAoPxS.png:large

AlyssaRowan 12y ago
I confirm this is an accurate analysis of the code - and that it's definitely intentional, malicious copy-protection software. Wow. I haven't seen something this spectacularly dumb in a while. Should be entertaining! :)

igmac 12y ago

Sounds like a company about to loose very badly in court, and who will shortly have to write out an apology on their cheque book. Intentionally sabotaging customer equipment will lead to all sorts of data loss and consequential damages issues. As @Someone1234 said below, FTDI needs to pursue legitimate channels to protect their IP. Ouch... Time for the CEO to reach for that third envelope and write to his successor.

Aissen 12y ago

So how does this work ? Hector Martin gives us a glimpse: Commented reverse engineering assembly: https://twitter.com/marcan42/status/525126731431038977 https://twitter.com/marcan42/status/525126731431038977 So they are rewriting the USB Product ID in EEPROM, only on "fake" chips, hence the Windows USB driver doesn't recognize the device anymore. It should be reprogrammable using the right tools. (https://twitter.com/marcan42/status/525134266112303104 https://twitter.com/marcan42/status/525134266112303104) What allows them to do things differently on different chips: "Figured out the real/clone FTDI difference: EEPROM is written in 32bit units. Even writes are ignored (buffered), odds write both halves." https://twitter.com/marcan42/status/525194603746426881 https://twitter.com/marcan42/status/525194603746426881 And some wisdom: "For those unfamiliar with embedded engineering: most USB (and other) devices can be bricked if maliciously attacked." "Assume ALL devices are brickable by evil code unless proven otherwise. This isn't news. Most devices make no attempt to protect themselves." (https://twitter.com/marcan42/status/525137221431463937 https://twitter.com/marcan42/status/525137221431463937 https://twitter.com/marcan42/status/525137463107272704 https://twitter.com/marcan42/status/525137463107272704)

stuaxo 12y ago

People should be complaining to microsoft to get these malicious drivers blocked and older non-malicious ones reinstated.

Aissen 12y ago

Finally ! Someone made a proper Linux to guarantee genuine FTDI products: https://lkml.org/lkml/2014/10/23/129 https://lkml.org/lkml/2014/10/23/129

cgtyoder 12y ago

So what are the actual products that are getting bricked? Curious about the end result of all this.

jbagel2 12y ago

I threw together a little util for correcting the PID you still have to fix the driver yourself, but I put info in the readme.. Since most of the issues are on Windows systems, its a little WPF app. https://github.com/jbagel2/FIX_BROKEN_FTDI_PID https://github.com/jbagel2/FIX_BROKEN_FTDI_PID