Shop OBEX P1 Docs P2 Docs Learn Events
Counterfit FTDI chips? — Parallax Forums

Counterfit FTDI chips?

cavelambcavelamb Posts: 720
edited 2014-10-25 18:15 in Propeller 1
FTDI develops drivers for its chips. The drivers can be obtained directly from FTDI, or they can be downloaded
by Windows automatically, through Windows Update. This latter feature is a great convenience for most people,
as it enables plug-and-play operation. The latest version of FTDI's driver, released in August, contains some new
language in its EULA and a feature that has caught people off-guard: it reprograms counterfeit chips rendering
them largely unusable, and its license notes that:
Use of the Software as a driver for, or installation of the Software onto, a component that is not a Genuine
FTDI Component, including without limitation counterfeit components,
MAY IRRETRIEVABLY DAMAGE THAT COMPONENT
The license is tucked away inside the driver files; normally nobody would ever see this unless they were explicitly
looking for it.



<http://arstechnica.com/information-technology/2014/10/windows-update-drivers-bricking-usb-serial-chips-beloved-of-hardware-hackers/&gt;

Comments

  • Heater.Heater. Posts: 21,230
    edited 2014-10-23 13:31
    You are late to the party here. It's already under discussion on some other threads.

    My conclusion is that FTDI are shooting themselves in the foot here.

    If their driver breaks my machine I want blood.

    No matter if I happen to knowingly or unknowingly using a real or fake FTDI chip.
  • Ken GraceyKen Gracey Posts: 7,392
    edited 2014-10-23 13:56
    Heater. wrote: »
    If their driver breaks my machine I want blood.

    Just to clarify, does the driver break your computer? I thought it only rendered the FTDI copycat bridge circuit useless.

    Ken Gracey
  • Heater.Heater. Posts: 21,230
    edited 2014-10-23 14:24
    Ken,

    Admittedly I was talking out of my butt there. This issue has not broken any computer I have.

    But, I have systems with PC's and connected devices. If one day I find that an FTDI driver update has broken those systems for no good reason other than it has detected clone chip that would make me heartily angry at FTDI.

    On a deeper level, why do we ever even need a driver from FTDI? I thought the idea behind USB was to abstract serial ports, parallel ports, mice, joysticks, block file devices, network adapters, etc away. You know, into a "Universal" bus. There are profiles for all these things.

    My computer should not be able to tell if I have a serial port adapter made by FTDI or any other company.
  • Ken GraceyKen Gracey Posts: 7,392
    edited 2014-10-23 14:31
    Heater. wrote: »
    Ken,

    Admittedly I was talking out of my butt there. This issue has not broken any computer I have.

    Thanks, Heater. Your message implied [to me] that the driver could intentionally wreck your machine, but I think it's the hardware containing the counterfeit FTDI device that would become useless.

    Ken Gracey
  • jmgjmg Posts: 15,173
    edited 2014-10-23 15:53
    cavelamb wrote: »
    : it reprograms counterfeit chips rendering
    them largely unusable,

    Something that reprograms an external device, is NOT a 'USB driver' anymore...
    cavelamb wrote: »
    :
    and its license notes that:
    Use of the Software as a driver for, or installation of the Software onto, a component that is not a Genuine
    FTDI Component, including without limitation counterfeit components,
    MAY IRRETRIEVABLY DAMAGE THAT COMPONENT
    Wow, so they also admit here that this could damage parts that are NOT counterfeit components ??

    I have a great many USB drivers installed on this PC, and in the great buried allocation that windows does, Windows decides what Drivers to use on what peripheral.
    End Users have no control over that decision.

    The risk of a 'driver' that may decide to flip itself into 'a hunt and destroy Programmer' was not on my radar before, and it certainly has moved FTDI down the selection list of vendors.
  • jonesjones Posts: 281
    edited 2014-10-23 16:07
    I think that might be reading a bit too much into their statement. Does anyone have any evidence that the driver damages legitimate devices made by others? Or does it just damage those that are pretending to be FTDI devices but aren't? Further, does anyone have any idea just how many devices are being affected? For the record, I agree this is a dumb move on FTDI's part, but the reaction seems to be getting ahead of any real knowledge of the extent of the problem.
  • jonesjones Posts: 281
    edited 2014-10-23 16:21
    I'm no Windows wizard, but doesn't Device Manager give you the option of manually choosing what driver a particular piece of hardware uses? It will choose on it's own, but you can override that by using the Update Driver functionality. From what I've read, there is some program that can be downloaded from FTDI that can be used to reprogram the chip so that it will work, just not with the current FTDI drivers. Mind you, I see this as the nuclear option and I think it's going to end up costing FTDI, but we ought not attack them for something they aren't actually doing.
  • localrogerlocalroger Posts: 3,451
    edited 2014-10-23 16:31
    I understand counterfeit chips are a problem for companies like FTDI, but this is not a good solution.

    I suspect they may get some memos from other industry players because if this breaks the wrong thing at the wrong time it's likely to spark a lawsuit, and that lawsuit will hinge heavily on whether that TOS agreement has any validity. And a lot of companies much bigger than FTDI do NOT want that to get into court, because it's never really been tested and if a court comes down on what a lot of people would call the side of common sense and says no, it's not a legally binding agreement if you "agree" to it by accepting an update you're told you need or opening a package you just paid for, then a lot of peoples' business models collapse into dust.
  • 4x5n4x5n Posts: 745
    edited 2014-10-23 16:45
    jmg wrote: »
    Something that reprograms an external device, is NOT a 'USB driver' anymore...


    Wow, so they also admit here that this could damage parts that are NOT counterfeit components ??

    I have a great many USB drivers installed on this PC, and in the great buried allocation that windows does, Windows decides what Drivers to use on what peripheral.
    End Users have no control over that decision.

    The risk of a 'driver' that may decide to flip itself into 'a hunt and destroy Programmer' was not on my radar before, and it certainly has moved FTDI down the selection list of vendors.

    There's currently no evidence that they're deliberately inserting code in their drivers to break counterfeit ftdi chips. All that warning means is that the drive could damage other non-ftdi components. I don't know that I blame them for the warning. My guess is that while they test the drivers with their chips, they don't test them with competitors chips and are assuming no responsibility for what their drivers do to other non-ftdi chips. Do you think that they should be testing their drivers with every "clone" chip?
  • Mike GreenMike Green Posts: 23,101
    edited 2014-10-23 16:58
    The issue is that FTDI's new driver somehow detects whether the USB-serial bridge chip is genuine or a counterfeit. If it's counterfeit, the chip's PID value is reprogrammed to zero which effective makes the chip disappear when an OS (any OS) re-enumerates the USB bus contents (identifies what's there and starts up the proper drivers).

    The PID value is stored in non-volatile memory, so the chip would disappear forever. Obviously, the chip's PID could be reprogrammed, but there's no generally available utility that would do this. A counterfeit chip is illegal to make and a case could be made that it's even illegal to possess. Big problem if FTDI's method for detecting a genuine chip is flawed.
  • jmgjmg Posts: 15,173
    edited 2014-10-23 17:27
    Seems it did not take very long at all....

    [" Update: Microsoft has given us a statement:

    Yesterday FTDI removed two driver versions from Windows Update. Our engineering team is engaging with FTDI to prevent these problems with their future driver updates via Windows Update. "]
  • localrogerlocalroger Posts: 3,451
    edited 2014-10-23 19:17
    Well I guess I called that one.
  • Roy ElthamRoy Eltham Posts: 3,000
    edited 2014-10-23 19:55
    My understanding is that the driver doesn't detect if the chip is a fake. It just issues commands that a genuine chip would not react to in the same way. Someone over on the eevblog forums disassembled the code, and found that the new FTDI drivers have code to that is designed to fail on genuine devices but succeeds on fake ones. What they do is attempt to write only one byte of the two byte PID in the eeprom, it doesn't update the PID in genuine parts, but does on the fake ones.

    So they will not misdetect a genuine device, because they aren't detecting anything.
  • __red____red__ Posts: 470
    edited 2014-10-25 18:15
    What Roy said, they're taking advantage of the difference in application.

    FTDI pretty much came out and said that this was intentional. They were not expecting that kind of backlash.

    I'm worried for the end-user more than the rogue supplier. As someone who has been burned by supply-chain tainting, unless you are a major player it's difficult to have full control of every aspect of every component of your BOM.

    The Linux kernel immediately added support for these "bricked" devices. A device that initialized with a USB ID of 0x0000 will now be detected as an ftdi device :-)

    That's a pretty strong indicator to show how the Open Source community thinks of this behavior.

    The statement they issued could arguably be used as evidence in a criminal case against the Scottish company under the Computer Misuse act.
Sign In or Register to comment.