FTDI driver kills fake FTDI FT232??

[nctnico]

The big question to the hobbieist community is will you do that and pay the extra $ for the genuine part or not?

Talking about price. Another post in this thread got me thinking (uh-oh). FTDI supports many platforms and appearantly spends quite some money on driver development. But let's be realistic: those extra drivers are useful for 0.001% of their customers. The rest of the customers pays extra for features they don't need. That is a bad business model IMHO and opens a niche for cheaper clones.

[dr.diesel]

I am glad to see FTDI respond here on the forum. 

Although I'm glad to see them post, still doesn't excuse them from maliciously attacking end users, with the intent to harm.  Their stance reversal is only due to miscalculated media attention.

All things considered I will look to FTDI alternatives from now on.

[Simon]

We appreciate your feedback, comments and suggestions.
 
As you are probably aware, the semiconductor industry is increasingly blighted by the issue of counterfeit chips and all semiconductor vendors are taking measures to protect their IP and the investment they make in developing innovative new technology. FTDI will continue to follow an active approach to deterring the counterfeiting of our devices, in order to ensure that our customers receive genuine FTDI product. Though our intentions were honourable, we acknowledge that our recent driver update has caused concern amongst our genuine customer base.  I assure you, we value our customers highly and do not in any way wish to cause distress to them.
 
The recently release driver release has now been removed from Windows Update so that on-the-fly updating cannot occur. The driver is in the process of being updated and will be released next week. This will still uphold our stance against devices that are not genuine, but do so in a non-invasive way that means that there is no risk of end user’s hardware being directly affected.   
 
As previously stated, we recommend to all our customers to guarantee genuine FTDI products please purchase either from FTDI directly or from one of our authorised distributors.  http://www.ftdichip.com/FTSalesNetwork.htm
 
If you are concerned that you might have a non-genuine device, our support team would be happy to help out.
 
Yours Sincerely
Fred Dart - CEO

As has been well said here in the last nearly 40 pages or more users don't mind so much that a driver refuses to work with a future non genuine chips as they can then seek redress from the supplier and as they have not been in use for years and suddenly stop working don't create mayhem and collateral damage that will severely hurt your customers. but to brick historic products is unacceptable. Other companies seek legal redress through laws and lawful methods of enforcing their patents etc, you may find users are willing to work with you to help identify fake supply chains if you work with users. Alternatively you can get out of the chip market and go do whatever else pleases you, there are it would seem plenty of other chip manufacturers so your not exactly like gold dust to anyone. Now let me sit down and wonder why Britain is no longer the leading edge in technology and our economy is not improving, thanks for showing up the British market place and making it an international laughing stock !

[jeremy]

We appreciate your feedback, comments and suggestions.
 
As you are probably aware, the semiconductor industry is increasingly blighted by the issue of counterfeit chips and all semiconductor vendors are taking measures to protect their IP and the investment they make in developing innovative new technology. FTDI will continue to follow an active approach to deterring the counterfeiting of our devices, in order to ensure that our customers receive genuine FTDI product. Though our intentions were honourable, we acknowledge that our recent driver update has caused concern amongst our genuine customer base.  I assure you, we value our customers highly and do not in any way wish to cause distress to them.
 
The recently release driver release has now been removed from Windows Update so that on-the-fly updating cannot occur. The driver is in the process of being updated and will be released next week. This will still uphold our stance against devices that are not genuine, but do so in a non-invasive way that means that there is no risk of end user’s hardware being directly affected.   
 
As previously stated, we recommend to all our customers to guarantee genuine FTDI products please purchase either from FTDI directly or from one of our authorised distributors.  http://www.ftdichip.com/FTSalesNetwork.htm
 
If you are concerned that you might have a non-genuine device, our support team would be happy to help out.
 
Yours Sincerely
Fred Dart - CEO

Mr Dart, please please please have the driver inform the end user that it is counterfeit, rather than just silently doing something.

I'm pretty sure most people who design electronics here don't want counterfeit chips either (I certainly don't), but not everyone has the ability to find out if their not-working chip is because it is a fake, DOA or even just poor circuit design. It is particularly hard with the FT232 as it seems the only real way to tell is to decap or xray the chip (or perhaps doing an even address EEPROM write! but now that the cat is out of the bag, I assume this is going to be worked around by counterfeiters).

[Simon]

Take the FTDI post as a mere press release, i doubt very much the email address the account is registered is Mr Darts

[PA0PBZ]

Take the FTDI post as a mere press release, i doubt very much the email address the account is registered is Mr Darts

It is: http://www.ftdichipblog.com/?p=1053

[Simon]

Take the FTDI post as a mere press release, i doubt very much the email address the account is registered is Mr Darts

It is: http://www.ftdichipblog.com/?p=1053

Ah yes, posted by a mikeg that ties with the address the account on here is registered to.

[linux-works]

Someone posted this over at Slashdot, amused me:

>We've discovered some counterfeit parts in your car.
-Oh, really? Well, I'm going to drive over to the dealership take that up with them.
>We've already handled the problem. We crushed your car into a cube.
-Uhhh...
>You have 15 seconds to move your cube.

gotta love the Simpson's reference in that

[jeremy]

The more I think about it, the more I can't shake the feeling that there isn't really a way out of this for FTDI. Looks like they've just given up one of their last secrets about the FT232 that can be used to identify it from the counterfeits (and made it widely known due to the bricking and subsequent attention). They can EOL the FT232, but there are so many legitimate ones out there that they'd still have to support the driver for a while. And I'd be quite surprised if they changed the masks for such an old and stable product.

I suppose they could go for a hail mary and open source the drivers, in the hope that people will stick to legit chips. But I'm thinking that the chances of that are about as small as, well, you know, avian porcines and such.

[linux-works]

mr ceo of ftdi,

as a boss of mine once liked to say, "you cant unring that bell".  you may have revoked the malicious windows update, but it seems that another one is going to replace it; and while it may not actively write to non-genuine parts like yesterday's driver update did, refusing to instantiate the chip (init it) still punishes the end-user and leaves him stranded.  it hurts the companies who -thought- they had real chips and used them in embedded products that we, consumers, bought.

a message on the screen, even with a forced delay and a forced "I understand" typed back in by the user would be mostly acceptable. otoh, refusing to init the driver would still be a malicious act, punishing the end-user.

please think this out very clearly before you take the next move.  you have already lost a lot of customers over this; how you handle this, next, can either save you or send you down the 'sony rootkit fiasco' direction and people will just write you off as a troublesome company that cannot be trusted.  and that's really odd since you once were Good Guys(tm) and we all DID trust you and your products.

we look forward to your return to sanity and hope its a speedy transition

[nctnico]

I suppose they could go for a hail mary and open source the drivers, in the hope that people will stick to legit chips. But I'm thinking that the chances of that are about as small as, well, you know, avian porcines and such.

I'm not sure. If the new driver shows a pop-up saying a fake FTDI chip is connected (but still works!) people can go back to the supplier and demand a device with a genuine chip. I contacted the seller of the RS485 boards (which started this thread) and he promised me to send 12 new boards and I urged him to make sure these have genuine FTDI chips on them otherwise they would be as useless as the boards he send me previously. I'm planning to hand out these RS485 boards to my customers so I don't want a 'this is a fake pop-up' appearing on their computer.

[linux-works]

the way I plan to handle this is: lockdown any windows pc that wasn't created by corp IT, and disable its automatic search for windows updates.  I used to trust that, but that trust is now down to ZERO, thanks to both ftdi and MS.  MS also owns some blame here for 'qualifying' this piece of crap malware and they were active in distributing said malware.

so, disable auto-update search for drivers.

then, remove the 2.12 driver AND REBOOT.  if you don't reboot, it stays mem-resident.

then, install the last good driver, 2.10, I believe.

beyond that, I'm going to disable all windows auto-updates on any box I have admin rights to, and be very careful about which ones I accept.  anything marked 'optional' won't ever get onto my systems unless I first do a full image backup (which is a huge PITA).

it sounds like ftdi is going to revise their driver and send out another update, eventually.  I can't trust it. the trust is completely gone with this company, at least for me.  I am an arduino developer at my company (a huge datacom company, everyone has heard of..) and my advice to my peers and bosses is to do just as I've said, above, and also to avoid connecting these serial dongles or embedded arduino boards into anything windows based.  if we stick with linux to do our programming, we will be safe.   and as many large companies do, my win laptop is locked down by a 'group policy' and so I can't disable windows updates, even with admin privs on my company laptop.  that means that its not safe to use windows and arduino development, ever again (at least with ftdi chips).

[Rufus]

As has been well said here in the last nearly 40 pages or more users don't mind so much that a driver refuses to work with a future non genuine chips as they can then seek redress from the supplier and as they have not been in use for years and suddenly stop working don't create mayhem and collateral damage that will severely hurt your customers.

Their customers, you know the ones that actually bought FTDI chips are not hurt.

but to brick historic products is unacceptable.

The fake chips having no legitimate drivers always were bricks. FTDI found (or decided to implement) a way to stop their drivers working with some? of the fakes and FTDI become the bad guys and 'international laughing stock'?

The level of shit posted in this thread is astounding. Perhaps some of the anger could be directed at the manufacturers of the fake chips except you don't even know who made the 'bricks' which is the whole problem.

Other companies seek legal redress through laws and lawful methods of enforcing their patents etc,

Irrelevant. FTDI do not have to write drivers for fake chips. They specifically say they are only licensed for use on their chips. If you don't want FTDI drivers messing with your chips don't buy chips programmed with VID/PID which requests FTDI drivers to be loaded.

I am quite happy FTDI did what they did and the resulting shit storm highlights the extent of the problem. The people claiming they won't design in FTDI parts in the future are admitting they build low quality shit with parts from unidentified manufacturers - they are the ones I laugh at.

[all_repair]

I suppose they could go for a hail mary and open source the drivers, in the hope that people will stick to legit chips. But I'm thinking that the chances of that are about as small as, well, you know, avian porcines and such.

I'm not sure. If the new driver shows a pop-up saying a fake FTDI chip is connected (but still works!) people can go back to the supplier and demand a device with a genuine chip. I contacted the seller of the RS485 boards (which started this thread) and he promised me to send 12 new boards and I urged him to make sure these have genuine FTDI chips on them otherwise they would be as useless as the boards he send me previously. I'm planning to hand out these RS485 boards to my customers so I don't want a 'this is a fake pop-up' appearing on their computer.

Looking at the latest reply from FTDI, as you are not the one that collected the chip hot out from the factory oven, you can never know what your customers going to see or not see now, and in the future.  Worse can happen, a few bytes may be changed or lost along the way, etc etc.  One can never be sure as they are operating on different turf.

[SydB]

. The lawyers will certainly make some money here.

Regardless of what you think of FTDI's decision, it is the counterfeiters that are the criminals and it is the responsibility of the goods manufacturer to sell products containing authentic parts. As a manufacturer, if you cannot control your buyers then you should change how you operate. Some people on this topic appear to be sympathising with the manufacturer who has inserted the counterfeit product into a design. Perhaps a minority deserve sympathy but not the majority.

If a designer or budgeter within a company creates a cost list with the price of a component listed as it would be supplied from the grey (risky) market, and not a price from the chip manufacturer’s franchised dealer, and the company goes onto source that component from the grey market then does that company really deserve sympathy? No.

In small and medium quantities, it is not difficult for anyone to buy from a reputable dealer such as Farnell, Mouser or Digikey. In larger numbers, try the franchised dealers for best price. These are very simple supply rules. If part of your organisation decides to cut costs and take a risk with a cheaper deal then it must accept the risk (or incompetence) and prepare to get burnt.

As an individual (or business), when you buy cheap electronics from sources such as ebay, direct from China or from smaller online outlets you are running the risk of buying counterfeit, reject or stolen goods. When other, more reputable outlets exist for what you are buying, and you still choose to buy cheap then you must accept the risk. I have been buying from ebay for years for personal use and most 'sold-as-new' electronics products I have purchased for the lowest price have developed a fault after a while. Nearly all those products have clearly been factory rejects or substandard in some way. I have not whinged about this because I understand the risk. I try to avoid short-duration ebay dealers, those with a significant number of negative feedbacks and those who I consider to have an unreasonable returns policy, and I never buy mains goods unless I take them apart to check for safety first. I rarely buy from China but, when I do, I understand the risk. For my business, I adopt minimum risk and do not buy from China directly and do not buy from ebay unless it is a 'transparent' non-complex product (i.e. non-electrical) to be tested or used for internal administrative purposes e.g. a paper-clip.

If a business can only make money by buying cheap grey market high-risk components then it should not exist. If a business is doing that to be greedy then it has decided to run the risk of getting burnt.

With expert counterfeiters these days, the only way to minimise your risk is to pay the 'going price' and buy from a reputable dealer. Only idiots buy cheap goods from the back of a van in a car park more than once. If you are lucky, the goods are stolen and the negative result is that your purchase is promoting crime. If you are unlucky, the negative result is that the goods will be substandard. The result is always negative. Go watch some early ‘Only Fools and Horses’ episodes to learn what ‘back-of-the-lorry’ goods are.

This morning FTDI confirmed to me that Farnell is an 'official channel partner' and Farnell confirmed that 'order code 1146032rl is sourced directly from FTDI'.

If you have suffered a PID 0000 and want to do something constructive, then post the details of what the product is and where you purchased it from here. It may help identify the counterfeit supply routes.

[dr.diesel]

I am quite happy FTDI did what they did and the resulting shit storm highlights the extent of the problem. The people claiming they won't design in FTDI parts in the future are admitting they build low quality shit with parts from unidentified manufacturers - they are the ones I laugh at.

Wrong, and quite laughable.

As a moral human being I take note of malicious people and companies, and base my support and buying decisions accordingly. 

[Marc]

I emailed FDTI with my thoughts and a link to this thread and this was part of the response:

The recently release driver release has now been removed from Windows Update so that on-the-fly updating cannot occur. The driver is in the process of being updated and will be released next week. This will still uphold our stance against devices that are not genuine, but do so in a non-invasive way that means that there is no risk of end user’s hardware being directly affected.   

[linux-works]

as usual, rufus is defending the company that exhibited poor decision-making.  not sure why, but some of us can guess.

as was said several times before, if the US MILITARY can't ensure, 100%, that they avoid clones and fakes when building their own hardware, I'm not sure its reasonable in today's 'made in china' world to expect any company to be on the ground, 7x24, 100% of the time, to watch the board makers production lines.

to think so shows total ignorance about how things are done in today's 'outsourced' world.

rufus, give it up.  your cred here is totally shot.  perhaps its time to add you to my ignore list.  I'm getting tired of your posts, to be honst; and they are not adding any value to the discussion.

[Kjelt]

Well bottom line is that FTDI was not happy how their new driver came in the news, was afraid to loose existing clientele and so takes a step back.
Ergo this topic was a succes and the people saying that this action was a step too far were and got right.

[linux-works]

it seems that even the wikipedia entry for ftdi (the company) has added a section about the 'controversy':

http://en.wikipedia.org/wiki/FTDI#Driver_controversy

congrats, ftdi.  you are the new rootkit posterboy of 2014.

I expect that, over the years, MBAs will study this as another example of how NOT to act.

[XFDDesign]

As a bit of an oddity, I'll ask the folks here for a similar thing I asked of FTDI support:

Can someone create a tool to reproduce the "kill" operation of the 2.12 driver? If this is a "thing" that can happen, I'd prefer to add a few seconds of production test time to screen parts that might cause the end-user grief down the road. This is, in essence, a vulnerability without a clear way to patch it - so the easiest route I can do is attempt to brick any devices that might get a non genuine part in the lot. (I buy all my parts from Mouser and Digikey, but they're not omnipotent or flawless).

[metalphreak]

As a bit of an oddity, I'll ask the folks here for a similar thing I asked of FTDI support:

Can someone create a tool to reproduce the "kill" operation of the 2.12 driver? If this is a "thing" that can happen, I'd prefer to add a few seconds of production test time to screen parts that might cause the end-user grief down the road. This is, in essence, a vulnerability without a clear way to patch it - so the easiest route I can do is attempt to brick any devices that might get a non genuine part in the lot. (I buy all my parts from Mouser and Digikey, but they're not omnipotent or flawless).

You can write "kill" code for any devices that has development tools that let you reassign USB VID/PIDs. It has been a standard feature of many chips for a while now. They're just simply using it maliciously to "brick" devices by abusing the general trust around their official drivers (other malicious hackers writing kill code won't get it into the official microsoft update system for example)

[Rufus]

as usual, rufus is defending the company that exhibited poor decision-making.  not sure why, but some of us can guess.

Seems I have higher moral standards than most here - you know like if I was in possession of stolen goods I wouldn't call the owner wanting them back immoral or malicious just because I didn't know they were stolen and had been using them a while.

as was said several times before, if the US MILITARY can't ensure, 100%, that they avoid clones and fakes when building their own hardware, I'm not sure its reasonable in today's 'made in china' world to expect any company to be on the ground, 7x24, 100% of the time, to watch the board makers production lines.

to think so shows total ignorance about how things are done in today's 'outsourced' world.

So you are happy to sell product built with fake chips of unknown origin and quality as long as the legitimate source of the chips can't demonstrate they are fake and don't work? - I'm still laughing.

[dr.diesel]

rufus, give it up.  your cred here is totally shot.  perhaps its time to add you to my ignore list.  I'm getting tired of your posts, to be honst; and they are not adding any value to the discussion.

One more to my ignore list as well.

but do so in a non-invasive way that means that there is no risk of end user’s hardware being directly affected.   

This is what a mature company would do from the start, just as effective, no media storm, no innocent just starting out totally screwed makers.

[jeremy]

As a bit of an oddity, I'll ask the folks here for a similar thing I asked of FTDI support:

Can someone create a tool to reproduce the "kill" operation of the 2.12 driver? If this is a "thing" that can happen, I'd prefer to add a few seconds of production test time to screen parts that might cause the end-user grief down the road. This is, in essence, a vulnerability without a clear way to patch it - so the easiest route I can do is attempt to brick any devices that might get a non genuine part in the lot. (I buy all my parts from Mouser and Digikey, but they're not omnipotent or flawless).

You can write "kill" code for any devices that has development tools that let you reassign USB VID/PIDs. It has been a standard feature of many chips for a while now. They're just simply using it maliciously to "brick" devices by abusing the general trust around their official drivers (other malicious hackers writing kill code won't get it into the official microsoft update system for example)

This is not true. You can't use the FTDI programming tools to "disable" just the clone chips, as the tools do not perform the preimage attack on the EEPROM checksum (as far as I know?). Using the tools to set the PID to zero will set both clones and legitimate chips to zero.