FTDI driver kills fake FTDI FT232??

[Simon]

Microsoft would care about stuff that hurts them and it hurts when it looks like the OS is damaging a device, sneaky of FTDI to abuse the system like this for a seek and destroy mission effectively or at least that was their hope.

[nitro2k01]

Would, maybe, but is there any evidence they did in this instance?

[Simon]

What has not been asked yet is what other changes were there made to the new driver, or was the sole change the bricking code ? if yes them FDTI can't say it was just a random side effect, they made the driver to kill, that was their intention.

[nitro2k01]

What has not been asked yet is what other changes were there made to the new driver, or was the sole change the bricking code ? if yes them FDTI can't say it was just a random side effect, they made the driver to kill, that was their intention.

Maybe (as spoken by a lawyer) the intention was to use it simply as a check. Maybe the code could for setting the PID in volatile memory in clone A, whereas clone B also saved the PID to non-volatile memory. The driver would then write and then read back the value to detect clone A. FTDI were then only aware of clone A and could not anticipate the side effects in clone B. Of course, this is another hypothetical, as FTDI has pretty much admitted what they are doing in public already.

[tbbw]

Now that they appear to have realised the error of their ways, maybe the "I'll never use FTDI again" brigade should consider this :
Company F screws up, realises it and fixes it.
Company S hasn't (yet) screwed up.

Which of the two is more likely to do something stupid like this in the future?

"That guy's error cost me $x000"
"Why didn't you fire him"
"Why should I do that, I just spent $X000 training him..."

No, no, no. This wasn't a mistake. This was an unbelievably unethical decision deliberately made. There is a difference. I will still avoid FTDI Chips henceforth. Fool me once, shame on you. Fool me twice, shame on me.

Cypress Semi has a pin-compatible replacement. I've got a few on order already to test.

You would get my eternal gratitude if you let me know the part humber and how it goes with those tests.
For me atleast ther motives are clear they eather want to brick the copys or make them not work at all with ther drivers so i got alot of work cut out for me just replasing some of these chips to make them "Windows safe"...
I did buy a few cheap products from china and i did not think in a milion years that FTDI would do anything remotely as drastic as screwing me over this hard with spomething like this.
Iwe always trusted that anything "FTDI compatible" would be something i could trust and would work without any hassle... but now i'm even starting to get paranoid with my old usb->rs232 cables iwe had for years.
I mean even the local products that iwe bought over the years from very reputable sellers have not garantee they are the genuine chips in them... i just got a ton of headakes i did not need... i mean there is no way i can check if it's genuine chip or not... some of these consumer products eather are molded in plastic (like the usb->rs232 cables) so you cant read the part number or you void the warranty if you open them... and if you ask the seller they will 99% of the times say "Sure it's FTDI! it says something about FTDI here on the box.. look for yourself!"

I cant trust a product mentioning "ftdi" since there is most of the time no way for me to be sure if it's genuine or not and playing russian roulette is not my thing.

[(*steve*)]

I rewrote it to use libusb and made it a lot more useful.
[...]
Tested on both real devices (where it refuses to do anything) and on clones (where all of the above works; I tested it against FTDI's driver too).

Hmmm... It requires root permission (so sudo) and then I get some unexpected results.

Firstly on an "Arduino Nano V3.0" labelled "Made in China". It passes.  The index mark on the chip appears like a good one.

Secondly on an older PIC programmer, an FTDI device is identified by the OS (lsusb shows it) but ftdi_clone_tool says "No devices found"

lsusb says:

Bus 002 Device 011: ID 0403:6001 Future Technology Devices International, Ltd FT232 USB-Serial (UART) IC

The chip is a 32 pin LQFP package labelled FTDI/FL232BL/729-1.  The last line that I'm assuming to be the date code does not seem to be in the XXYY format specified in the datasheet (http://www.ftdichip.com/Support/Documents/DataSheets/ICs/DS_FT232BL_BQ.pdf), and appears larger than is indicated therein.

The only ID on the programmer is www.nbglin.com (and the device looks exactly like this one http://www.nbglin.com/cpjs/dpj39.htm).  I assume it's a copy of something.

I'm shocked that the only two cheap Chinese products I can find that contain this chip appear to use non-fake chips.

Although I'm curious as to why the latter device is not detected.  Do you have any suggestions? (EDIT: The device version returned is "04.00")

[Simon]

up until not long ago when i had to get a serial to USB converter for work I did not realize FTDI was an actual company, I thought it was the name of the generic type of chip (and was trying to work out what FTDI stands for), so stupidly when I realized from farnell listings that FTDI is the manufacturer and others are available I thought well if we keep calling them all "FTDI cables" etc it must be because they are the best......

Never again will i make such a mistake, I should have checked prices on other brands and probably would have but it being for work and me not giving very much of a rats arse what the cost was as I don't like hassle at work.

[mikeselectricstuff]

I'm struggling to see if there is a consensus of option.  Is it wrong for FTDI to intentionally break clones?  I'm not interested in legality, I'm interested in people's opinions on ethics.

Seriously? where have you been the last few days - the whole shitstorm has been a reaction to FTDI breaking people's stuff. 500+comments on Hackahay & Slashdot, almost all of the opinion that breaking people's stuff is going too far.
 

I like analogies, so here's my contribution:
I once went to a wrist watch shop to have a counterfeit watch repaired.  Upon inspecting the watch, the shop keeper declared that "normally" he would have to cease and destroy such a counterfeit product, but that he would let me off this time.  I didn't say anything at the time but I was certain he was wrong.  No individual or company should have the right to destroy other people's possessions simply because the possession imitates something else.  Only the legal authorities should be able to do this and only when the possession is intended for criminal activity;  I only had one counterfeit watch, I had no intention of selling it, and so no one should be able to take it away from me.

If they'd destroyed it, then in most jurisdictions  it would have been criminal damage and you could have sued them for your losses. There may be some places where there is specific legislation allowing it, but generally speaking, owning a fake item is perfectly legal, so destroying it would be illegal. Even if they have a big sign saying they will destroy fakes, in general you can't override law with terms and conditions.

[Simon]

I have a bloke locally that repairs GHD hair straighteners. He has a website that clearly shows what fakes look like and will not repair fakes on safety grounds. If you send them to him he returns them at cost.

[sunnyhighway]

OK, FTDI is basically saying I have to do my due diligence and make sure I use genuine hardware.

Lets say (for arguments sake) I have 100% solid undeniable proof I got the genuine chips.

In order to make these chips work I need drivers, in this case I want the V2.12.00 drivers.
Obviously I want to be sure sure I get the genuine FTDI drivers. Otherwise my efforts could be wasted and still have disgruntled users of my product.

First of all I need a reliable source for the drivers. It seems to be www.ftdichip.com is the place to go.
Obviously I need to check if this domain is actually owned by FTDI. So I start checking the internet DNS root servers and gobble down the chain and end up with all the contact data of FTDI. Next I check with the chamber of commerce if that address really belongs to FTDI. Fortunately this checks out and I'm confident www.ftdichip.com is the place to go for the genuine FTDI drivers.

Next I want to download the drivers and do my due dilligence because I want to make 100% sure the drivers are not compromised or tampered with.
First I noticed albeit port 443 of their website is open for requests it does not serve me any web-pages let alone it is encrypted with a certificate I can check.
Now I must assume the download of these drivers are using an unsafe transport mechanism and I must find another way that proofs the drivers are not tampered with in transport.
For this I check if ALL binaries are digitally signed with a code signing certificate. If this checks out with a full chain of trust I can still be confident about the drivers.

First of all I noticed the file "CDM v2.12.00 WHQL Certified.exe" (which claims to contain the drivers) are indeed signed with a code signing certificate owned by FTDI.

Weird thing is the website states the driver is released at 2014-09-29 while the code signing certificate on the "CDM v2.12.00 WHQL Certified.exe" is signed at 2014-10-22.
This is proof the "CDM v2.12.00 WHQL Certified.exe" is changed after it has been released and cannot be trusted.
It does not proof the the drivers contained in it are tampered with, but it does make me wonder if it still can be proven FTDI can account for the legitimacy of all the binaries for the drivers.

In order to do this I unzip the installer and make sure all the binaries have no chance of being tampered with without me knowing about it.
First fail I see now is that the binary "dp-chooser.exe" is not code signed. This leads me to conclude that this binary was not was not authorized for release by the person/department in charge.
This leaves me no choice other than deleting this offending binary as it cannot be trusted.
But luckily I still can work around this issue for some Windows operating systems by using the "dpinst-amd64.exe" or "dpinst-x86.exe" as they are properly code signed.
That is.... if all the other binaries these two installers are installing are code signed.

As it turns out all the binaries for 64 bit Windows operating systems are properly code signed. Hurray!!!! 

But my project also needs to be able to run on 32 bit Windows operating systems, so I better check them out as well.
OH NOOOOO!!!!!!! The binary "ftcserco.dll" has no code signing certificate on it. 

In contrast, the binaries "dp-chooser.exe" and "ftcserco.dll" in the V2.10.00 driver download were code signed.

This leads me to conclude the V2.12.00 drivers on the FTDI website could be compromised/fake and therefore cannot be trusted.


Having said this, it raises the question where FTDI got the guts to force us to control the entire supply chain of their chips if they cannot even control their internal software development and release chain.

[nctnico]

It is interesting they signed the v2.12 driver package the day this thread got started. It means they already made some changes to it that day. Version 2.12 was already available before that date.

[(*steve*)]

Version 2.12 was already available before that date.

Remember that there were two version 2.12's released.

[sunnyhighway]

It is interesting they signed the v2.12 driver package the day this thread got started. It means they already made some changes to it that day. Version 2.12 was already available before that date.

Looks like only 5 files we changed since the 2014-09-29 release.

Code: [Select]

26-10-2014  12:04    <DIR>          .
26-10-2014  12:04    <DIR>          ..
11-09-2014  09:11    <DIR>          amd64
22-10-2014  13:01            83.456 dp-chooser.exe
22-10-2014  15:16         1.046.896 dpinst-amd64.exe
22-10-2014  15:16           921.456 dpinst-x86.exe
22-10-2014  13:01            19.875 dpinst.xml
09-09-2014  11:42            40.547 ftd2xx.h
10-09-2014  14:22            13.511 ftdibus.cat
09-09-2014  11:42            16.806 ftdibus.inf
10-09-2014  14:22            12.715 ftdiport.cat
09-09-2014  11:42            14.211 ftdiport.inf
11-09-2014  09:11    <DIR>          i386
22-10-2014  13:01             9.143 licence.txt
11-09-2014  09:11    <DIR>          Static

My educated guess would be this was done to have the user mandatory accept the license before installing the drivers.
Looks like that shows when the lawyers stepped in when they realized the users/victims were not warned and could have a valid claim against them.

[(*steve*)]

Looks like only 5 files we changed since the 2014-09-29 release.

Might be useful also to look at the differences between the two 2.12.00 releases.

https://www.eevblog.com/forum/reviews/ftdi-driver-kills-fake-ftdi-ft232/msg536122/#msg536122

[Rufus]

FFS the device provides the VID and PID which tells the OS what drivers it needs.

Well, if the FTDI's driver falsely represents to the OS that it can handle that devices but in reality it is not licensed to do so it's FTDI fault. The device is passive, it does not perform driver selection.

When you plug in something which is not compliant with USB specifications anything can happen. It takes two to tango and trying to blame the compliant, tested, and certified half of the party when something goes wrong is ridiculous.

The test would be done every time the driver loads, every device plug in and power up. How is FTDI (or anyone else for that matter) supposed to know the EEPROM endurance of an unknown clone chip from an unknown source?

It's not our job to solve FTDI chip authentication issues.  It's up to them to do it in a non destructive way or not do it at all.

They fixed the device PID to solve the problem which isn't destructive because as you claim the device is passive and does not perform driver selection - lol. It is your job to find drivers to work with your clone/fake.

[zapta]

They fixed the device PID to solve the problem which isn't destructive because as you claim the device is passive and does not perform driver selection - lol. It is your job to find drivers to work with your clone/fake.

Of course it's destructive. It used to work on Linux but not anymore.

Rufus, it's OK to sympathise with FTDI but you need to stick to the facts.

[all_repair]

Is FTDI a listed company?  Where if it is listed? Thanks.

[Simon]

ftdichip.com

[Rufus]

They fixed the device PID to solve the problem which isn't destructive because as you claim the device is passive and does not perform driver selection - lol. It is your job to find drivers to work with your clone/fake.

Of course it's destructive. It used to work on Linux but not anymore.

They fixed the Linux drivers to make it work again so obviously the drivers were faulty - lol. You claim FTDI drivers must not assume VID/PID means anything yet claim changing the PID is destructive because Linux drivers make the same assumption.

The double standards and grasping at straws trying to make out FTDI is the bad guy going on here is ridiculous. Maybe you should direct some ire at the manufacturer of these faulty clones and fakes but you don't even know who they are do you.

[nctnico]

They fixed the device PID to solve the problem which isn't destructive because as you claim the device is passive and does not perform driver selection - lol. It is your job to find drivers to work with your clone/fake.

Of course it's destructive. It used to work on Linux but not anymore.

Rufus, it's OK to sympathise with FTDI but you need to stick to the facts.

Just ignore. If it's up to Rufus he'd drop a nuke on Afganistan, Syria, Irak etc to get rid of every terrorist living there.

[German_EE]

For all_repair:

Company Details

Name & Registered Office:
FUTURE TECHNOLOGY DEVICES INTERNATIONAL LIMITED
2 SEAWARD PLACE
CENTURION BUSINESS PARK
GLASGOW
G41 1HH
Company No. SC136640


      
Status: Active
Date of Incorporation: 14/02/1992

Country of Origin: United Kingdom
Company Type: Private Limited Company
Nature of Business (SIC):
26110 - Manufacture of electronic components
Accounting Reference Date: 31/12
Last Accounts Made Up To: 31/12/2012  (GROUP)
Next Accounts Due: 30/09/2014 OVERDUE
Last Return Made Up To: 14/02/2014
Next Return Due: 14/03/2015
Mortgage: Number of charges: 1 ( 1 outstanding / 0 satisfied / 0 part satisfied )
Last Members List: 14/02/2014
Previous Names:
Date of change    Previous Name
13/03/1992    CASECHANCE LIMITED

Data from the UK Companies House.

[Rufus]

They fixed the device PID to solve the problem which isn't destructive because as you claim the device is passive and does not perform driver selection - lol. It is your job to find drivers to work with your clone/fake.

Of course it's destructive. It used to work on Linux but not anymore.

Rufus, it's OK to sympathise with FTDI but you need to stick to the facts.

Just ignore. If it's up to Rufus he'd drop a nuke on Afganistan, Syria, Irak etc to get rid of every terrorist living there.

I was wondering if we would see Godwin's law here, congrats on skipping Godwins and going straight to nuclear holocaust analogies.

[8086]

They fixed the device PID to solve the problem which isn't destructive because as you claim the device is passive and does not perform driver selection - lol. It is your job to find drivers to work with your clone/fake.

Of course it's destructive. It used to work on Linux but not anymore.

Rufus, it's OK to sympathise with FTDI but you need to stick to the facts.

Just ignore. If it's up to Rufus he'd drop a nuke on Afganistan, Syria, Irak etc to get rid of every terrorist living there.

I was wondering if we would see Godwin's law here, congrats on skipping Godwins and going straight to nuclear holocaust analogies.

This has nothing to do with Godwin's law, so why bring it up? Godwin's law is not a fallacy, it is not actually meant to show that a discussion has reached a point of ridiculousness, it merely is about the mention of nazis.

No nazis mentioned here.

Do you perhaps in fact not understand that of which you speak?

[nitro2k01]

This has nothing to do with Godwin's law, so why bring it up? Godwin's law is not a fallacy, it is not actually meant to show that a discussion has reached a point of ridiculousness, it merely is about the mention of nazis.

If you read the law very literally, yes. If you read between the lines, the point of Godwin's law is to say that all discussions on the internet will eventually derail into a cesspool of ridiculous and extreme arguments that have nothing to do with the original question. Making the law about Nazis in particular is why the law is memorable enough to be quoted today. If the law simply stated "all discussions will be derailed", you would never have heard of it.

Edit: Oh, and:

There are many corollaries to Godwin's law, some considered more canonical (by being adopted by Godwin himself)[3] than others.[1] For example, there is a tradition in many newsgroups and other Internet discussion forums that once such a comparison is made, the thread is finished and whoever mentioned the Nazis has automatically lost whatever debate was in progress.[8] This principle is itself frequently referred to as Godwin's law. It is considered poor form to raise such a comparison arbitrarily with the motive of ending the thread.

With this use, saying that the opponent wants to bomb the Middle East is similar in nature to calling the opponent a Nazi.

Edit 2:

Just ignore. If it's up to Rufus he'd drop a nuke on Afganistan, Syria, Irak etc to get rid of every terrorist living there.

I was wondering if we would see Godwin's law here, congrats on skipping Godwins and going straight to nuclear holocaust analogies.

And while we're at it. The claim here is of skipping Godwin's law and going straight to something worse without passing go. No mentions of Nazis needed.

[BigClive]

What a mind-blowingly ignorant thing to do.  Suddenly the name FTDI has gone from hero to zero in one stupid move.

How long before ebay is full of cheap little inline USB dongles from China that you plug into a USB power supply, then plug your bricked product in and it fixes it by rewriting the address.  Or perhaps acts as a buffer in a computers USB port to prevent FTDI's malware from bricking stuff.

I have absolutely no doubt that there are a lot of FTDI "compatible" devices in my collection of Chinese modules.  Now I'm going to worry about whether FTDI have launched any new malware in windows updates.