FTDI admits to bricking innocent users' chips in silent update

[Borg 386]

In a move that has surprised and angered security researchers, chip maker FTDI has admitted to issuing a silent update that bricks cloned FTDI FT232 [USB to UART] chips.

Hardware hackers and security researchers are furious at chip maker FTDI for issuing a silent update that bricks cloned FTDI FT232 [USB to UART] chips.

The chip is extremely common on a wide variety of devices and there is no way of knowing at this time which devices have cloned chips -- and the tainted supply chain could hit anyone.

FTDI appears to have used a recent Windows update to deliver the driver update to brick all cloned FTDI FT232s.

FTDI's surprise new driver reprograms the USB PID to 0, killing the chips instantly.

FTDI admits to bricking innocent users' chips in silent update | ZDNet

 

[NoN]

Looks FTDI provide an utility to be able to flash those chip without brick them all by manually changing the PID.

FTDI Utility

 

[lehnerus2000]

I hope they get sued.

I'd be sent to prison if I:

• Went to someone's house and smashed their stuff
• Sent out malware and it was tracked back to me

 

[HerrKaLeun]

They didn't "brick" the chip, their new driver just doesn't' support it. This is reversible by installing older driver.

And the chip wasn't made by FTDI, why would they have to be required to support it? If you buy a fake Apple product, can you bring it in to the Apple store and get it repaired under warranty and serviced?

The end consumers are the pawns and FTDI could have been nicer to them.... but the end consumer can take his product to where it was purchased and complain there. If the end-user inadvertently buys a fake copy of windows, it also will get disabled. If someone buys fake tickets for a concert, he also gets turned down at the entrance. Sad and not fair... but why would the original OEM have to honor a pirated product?

This driver is clearly for FTDI chips and the EULA stated so. IF it is applied to a fake product, why should FTDI be required to make it work with fake products?

 

[lehnerus2000]

They didn't "brick" the chip, their new driver just doesn't' support it. This is reversible by installing older driver.

I keep backups of all my installers (driver & program) because companies have a proven track record of releasing dodgy and/or worthless updates.

How many ordinary users keep backup installers?

This driver is clearly for FTDI chips and the EULA stated so. IF it is applied to a fake product, why should FTDI be required to make it work with fake products?

They don't.

Hardware hackers and security researchers are furious at chip maker FTDI for issuing a silent update that bricks cloned FTDI FT232 [USB to UART] chips.

The chip is extremely common on a wide variety of devices and there is no way of knowing at this time which devices have cloned chips -- and the tainted supply chain could hit anyone.

However it seems they made no mention of the fact that the update could cause problems (especially for those who have unapproved chips).

Are you suggesting that everyone who had a fake chip deliberately bought the fake version?

 

[HerrKaLeun]

However it seems they made no mention of the fact that the update could cause problems (especially for those who have unapproved chips).

Are you suggesting that everyone who had a fake chip deliberately bought the fake version?

the EULA stated that fake chips are not supported and that should go without saying anyway. If someone in China makes a fake ford Taurus, can you expect Ford (and possibly sue) ford if the original ford parts don't work in the clone? i never read the EULA, but don't expect an Intel driver to work on a product not made by Intel.

the consumer and possibly the board manufacturer are innocent in this. I don't think anyone deliberately installed fake chips. but the consumer can go to the board manufacturer and get a new board witch real chip. and the board manufacturer can sue his suppliers and improve QM.

I feel sorry for anyone affected, and this wasn't a good publicity move for FTDI. Because now manufacturers may not use them knowing chips may or may not be fake. Ultimately the publicity is bad for board manufacturers. no consumer knows who made the chips. but they buy a board from MSI, Asus or whoever that failed.

 

[Layback Bear]

The board manufactures know exactly where they got the chip. It's the board manufacture duty to make sure that everything on their board are legal and not counterfeit. They bought Cing Dong Dings chip because it was cheaper and didn't care if it was counterfeit.

My thoughts.
Layback Bear

 

[lehnerus2000]

the EULA stated that fake chips are not supported and that should go without saying anyway. If someone in China makes a fake ford Taurus, can you expect Ford (and possibly sue) ford if the original ford parts don't work in the clone?

Car analogies don't seem to work properly for software.

If you took your Fake Ford Taurus to Ford they would tell you it was a fake (and charge you to fix it).

Ford doesn't go to peoples' houses and "clamp" fake Ford Tauruses (I've never heard of it happening here).
I also doubt that they'd beam an update into the fake Ford Taurus, which just so happens to "accidentally" disable it.

IT companies have a proven track record in dubious behaviour.
Actually they are just like the car companies.

The board manufactures know exactly where they got the chip. It's the board manufacture duty to make sure that everything on their board are legal and not counterfeit. They bought Cing Dong Dings chip because it was cheaper and didn't care if it was counterfeit.

In that case, it might be possible for someone to start a class action lawsuit.

 

[Layback Bear]

A class action lawsuit against a Chinese company will never happen. It would be a waste of time and money. I don't believe the Chinese government will allow it. A major amount of the Chinese
economy is counterfeiting and they surly don't want to step on their own toes.

 

[HerrKaLeun]

Car analogies don't seem to work properly for software.

If you took your Fake Ford Taurus to Ford they would tell you it was a fake (and charge you to fix it).

Ford doesn't go to peoples' houses and "clamp" fake Ford Tauruses (I've never heard of it happening here).
I also doubt that they'd beam an update into the fake Ford Taurus, which just so happens to "accidentally" disable it.

FTDI didn't force anyone to install the update. The user actively installed it (by downloading from manufacturer website or by automatic installation via MS). It sounds like it was an update to a driver where the user had to "accept" the EULA. FTDi didn't hack into computers to install the update.

If people want the convenience of automatic updates, then the user chose comfort over safety/security.

 

[HerrKaLeun]

The board manufactures know exactly where they got the chip. It's the board manufacture duty to make sure that everything on their board are legal and not counterfeit. They bought Cing Dong Dings chip because it was cheaper and didn't care if it was counterfeit.

My thoughts.
Layback Bear

i doubt Asus, MSI et all knowingly installed fake chips. One of their vendors duped them, or got duped himself. At maximum they lacked in their purchasing control. This isn't even a QM problem since at time of manufacture with the drivers provided the chips worked exactly as the original.

Obviously the board OEM name is attached to it and they have to rectify it for the consumer.

I wonder if the board manufacturers also provided the new driver that disables the fake chips, or if this only happens with Ms updates?

 

[andrew129260]

FTDI didn't force anyone to install the update. The user actively installed it (by downloading from manufacturer website or by automatic installation....

Read that again......slowly. Then tell me how that makes sense that the user would be at fault.


And every user should be using automatic updates, security updates need to be applied as quickly as possible. The average user needs that or they would be lost and confused.

Think about the average user here, not the techy. They can barely find control panel-much less understand what updates are. To them updates are the annoying thing that takes forever when they shut down or turn on my computer.

The board manufactures know exactly where they got the chip. It's the board manufacture duty to make sure that everything on their board are legal and not counterfeit. They bought Cing Dong Dings chip because it was cheaper and didn't care if it was counterfeit.

My thoughts.
Layback Bear

+1

 

[HerrKaLeun]

You can separate security from driver updates in MS update. Drivers are "optional"

 

[lehnerus2000]

A class action lawsuit against a Chinese company will never happen. It would be a waste of time and money. I don't believe the Chinese government will allow it. A major amount of the Chinese economy is counterfeiting and they surly don't want to step on their own toes.

Obviously you'd have almost no chance of getting compensation from the Chinese.
You guys in the US would have more chance than we would here in Australia.

However somewhere in the supply chain, someone in the US, transferred these devices to US consumers (it would probably be the retailer level).
With all the whining about IP theft, surely it is illegal to sell products that violate IP laws?

Even if they get off using the "we didn't knowingly break the law" defence that will leave the angry customers.

Customers might be so upset that they do things like:

• Never update their PCs again
• Actively engage in IP theft to, "stick it to the Man."

These sort of incidents undermine confidence in the "System".

In this case:

• IT (updates)
• Retail
• IP law

If people want the convenience of automatic updates, then the user chose comfort over safety/security.

I suspect that:

• The PCs of most ordinary users are either set to "Never Update" or "Automatically Update"
• The users are not even aware that the settings can be changed

 

[andrew129260]

You can separate security from driver updates in MS update. Drivers are "optional"

Don't look at me. You said automatic install.

 

[Borg 386]

Update:

A driver update published in Windows Update has resulted in counterfeit chips used in finished products being left inoperable. After a public outcry, the update was removed from Windows Update.

Scottish design firm Future Technology Devices International (FTDI) pushed an updated driver for automated installation in Windows Update for devices that use the FT232 chipset, which converts RS-232 (specifically, UART) to USB. The driver update leaves devices that use counterfeit FTDI chips in an unusable state. After a public outcry, the update was pulled from Windows Update, but a great deal of damage had already been done.

Buried in the INF file of the latest drivers, the comments warn "Use of the Software as a driver for, or installation of the Software onto, a component that is not a Genuine FTDI Component, including without limitation counterfeit components, MAY IRRETRIEVABLY DAMAGE THAT COMPONENT." Naturally, as the driver is installed using Windows Update, this notice is not presented to the user prior to installation.

FTDI uses Windows Update to disable devices using counterfeit chips - TechRepublic

 

[oneeyed]

FTDI uses Windows Update to disable devices using counterfeit chips - TechRepublic

Nice link that clarifies the issue.

So this WAS intentional. I thought the update bricking clones was merely an unfortunate accident, but your article seems to prove it was deliberate.

Even then, I'm not so sure we should blame FTDI. If manufacturers used tricks such as this much more often, then maybe the clones would have a harder time being accepted on boards in the first place.

 

[Gornot]

After thoroughly reading the topic, I agree with the post above.

Yes, it was a move that generated FTDI bad press. Yes, they were wrong to have it as a silent install and give users absolutely no clear indication or warning. Yes, it was totally intentional.

But are they at fault? Most certainly not.

They protected their product against counterfeits, that's all there is to it. Where the chip came from and how it ended up in there doesn't matter one bit; I'm not saying it's the user's fault, or anyone elses - the blame is solely on those who manufactured the counterfeit chip.

It's not fair, but it's reality.

Even then, I'm not so sure we should blame FTDI. If manufacturers used tricks such as this much more often, then maybe the clones would have a harder time being accepted on boards in the first place.

+1

 

[lehnerus2000]

Even then, I'm not so sure we should blame FTDI. If manufacturers used tricks such as this much more often, then maybe the clones would have a harder time being accepted on boards in the first place.

They protected their product against counterfeits, that's all there is to it. Where the chip came from and how it ended up in there doesn't matter one bit; I'm not saying it's the user's fault, or anyone elses - the blame is solely on those who manufactured the counterfeit chip.

It's not fair, but it's reality.

The trouble is that this will lead consumers to conclude that updates are bad.

Their response will be to never update their machines, which will probably lead to an increase in botnets.

One of my friends refuses to install an AV program because "it will slow his machine down."
I can't even convince him to use the free version of Malwarebytes (which only runs if it is told to).

 

[andrew129260]

Even then, I'm not so sure we should blame FTDI. If manufacturers used tricks such as this much more often, then maybe the clones would have a harder time being accepted on boards in the first place.

They protected their product against counterfeits, that's all there is to it. Where the chip came from and how it ended up in there doesn't matter one bit; I'm not saying it's the user's fault, or anyone elses - the blame is solely on those who manufactured the counterfeit chip.

It's not fair, but it's reality.

The trouble is that this will lead consumers to conclude that updates are bad.

Their response will be to never update their machines, which will probably lead to an increase in botnets.

One of my friends refuses to install an AV program because "it will slow his machine down."
I can't even convince him to use the free version of Malwarebytes (which only runs if it is told to).

I cannot stand people like that. They are the reason malware and botnets spread more. ugh