FTDI driver kills fake FTDI FT232??

[Fungus]

PS: Does much hospital equipment run on these things?

[Simon]

PS: Does much hospital equipment run on these things?

medical / military tends to use long proven designs and techniques and leave the bleeding edge to commercial stuff that can go wrong and forewarn them without killing anyone....

[firewalker]

Does anybody know if devices with an FT232BM chip are affected by this mess? It's rather old, about six or seven years.

FT232BL doesn't seem to be affected (device version 04.00). I guess FT232BM is also not affected.

Alexander.

[Fungus]

Does anybody know if devices with an FT232BM chip are affected by this mess? It's rather old, about six or seven years.

FT232BL doesn't seem to be affected (device version 04.00). I guess FT232BM is also not affected.

I haven't read every message in this thread but: Surely NO genuine chip should be affected by this. Say it ain't so...

[firewalker]

Yep, no genuine chip is affected. But chips imitating FT232BM, FT232BL (if they exist) should be ok. I make my assumption looking the code of the python script posted here. It looks for specific device version (06.00). I believe FT232BM is a version bellow 6. FT232BL is version 4.

Alexander.

[free_electron]

All we need is a picture of someone's grandma laying on the floor in a coma with a USB cable connected to her heart monitor or insulin pump with an new hardware found driver screen on the computer  and then USB Device not recognized.

nope. wouldn't happen. medical device = traceable parts down to the lot number and production day

[Rigby]

nope. wouldn't happen. medical device = traceable parts down to the lot number and production day

Ideally, yeah.  There are no instances of anyone ever taking the easy route and using non-verified parts or something?  I hope not, but it seems unlikely that there's no history of that.

[nctnico]

All this could possibly hope to achieve is that the evil "counterfeiters" tweak their chips so they can't be distinguished from real ones by the driver. It will take them a month or so to get get back in business again.

The only answer is to make it easy to spot fake chips. If that means putting a hologram on them or whatever, then that's what they have to do.

That will make the genuine chips even more expensive making it more lucrative to produce functional equivalents. The only way for FTDI to stop counterfeiting is to make their devices so cheap that counterfeiting is no longer viable.

[Rufus]

Dear FTDI come up with a solution for reprogramming my fake chips.
I still have to use my boards in winXP.

Dear FTDI please help me steal your winXP drivers.

Why don't you ask the manufacturer of your fakes to help you?

[linux-works]

Hey,

Just intentionally bricked one of my original FTDI device ;-)
Let's hope it works out as I have in mind xD - otherwhise I have 10€ worth of original garbage...

Greets
Berni

days ago, the linux 'unbricker' was posted.  its proven to work.  and if you don't have a linux box, you can boot a live cd, don't install it - just run it - and then build the source and run it.  no need for windows de-bricker when its free and easy to use the linux version and the linux version is trustable, up and down the chain (all source, no stupid vendors to mess things up or put hidden timebombs in the code).

[Rufus]

PS: Does much hospital equipment run on these things?

Stuff like this http://www.bbc.co.uk/news/health-29660705 probably does.

[free_electron]

nope. wouldn't happen. medical device = traceable parts down to the lot number and production day

Ideally, yeah.  There are no instances of anyone ever taking the easy route and using non-verified parts or something?  I hope not, but it seems unlikely that there's no history of that.

not for medical equipment. full traceability is a must.

anyawy. this whole thing looks to me like another intel <> amd war back in the good old days.

AMD made 'clean room' compatible devices ( for the 'unwashed' : clean room is not the same as clean-room. a clean-room is a particle free environment in which chips are made. a 'clean room' is an empty room. clean room copy means : we start with only the specification : pinout and instruction set as specified by the orignial maker . and we attempt to come up with a design that does work exactly the same. we do not look inside the chip , we don;t do a teardown , delamination or anything. datasheet only.

So this is what these chinese dudes did. now, you can have hidden instructions in a device ( intel has multiple ones , that are now known, but were secret back in the day. undocumented. like the routine to do bcd to integer. it turns out you can do any base conversion by loading the 'b' register with the base value. this was not documented.  some software tools , made by intel, would run a test on that. ( very few people use base 7 notation or base 11 or whatever weird base apart from decimal or hexadecimal. on an non-genuine intel the outcome would be wrong.
the coe was written cleverly. it performed some operations that left the b register in a state that was not 0 ( hex ) or 10 ( decimal ) and then executed the conversion.
They hade certain compiler tools and other things like iRMX and ISIS that would simply refuse to install or execute when the test failed as you were running on a non genuine intel. and the licence was written : to be used on genuine intel processor only.

So FTDI could do that. Have a couple of hidden instructions that can send 'markers' in the stream. if the markers fail : perform a usb disconnect and pop up a message saying that the device has malfunctioned ( it has, as it did not provide the correct markers ) and should be taken in for service or repair.  pop up a messag saying 'Non-Genuine FTDI USB bridge'.

i don;t want fake chinese crap in my hardware. who knows what spy functions they have on board ...

[firewalker]

Medical device killing patient over serial comm failure wouldn't have a pass sticker.

The problem could occur with devices like Holter monitors.

Alexander.

[Rigby]

not for medical equipment. full traceability is a must.

anyawy. this whole thing looks to me like another intel <> amd war back in the good old days.

AMD made 'clean room' compatible devices ( for the 'unwashed' : clean room is not the same as clean-room. a clean-room is a particle free environment in which chips are made. a 'clean room' is an empty room. clean room copy means : we start with only the specification

I thought that was called "double-blind" reverse engineering.  Are they the same?  Double blind reverse engineering is fully legal, cloning and counterfeiting aren't.

And doesn't AMD license the Intel instruction set?  I imagine at some point they reversed it, so yeah.  The "x64" CPUs we all use now, even the Intel ones, are AMD instruction sets.  Bit of justice for Intel, there.  They have to license that from AMD.

[free_electron]

That will make the genuine chips even more expensive making it more lucrative to produce functional equivalents. The only way for FTDI to stop counterfeiting is to make their devices so cheap that counterfeiting is no longer viable.

race to the bottom ... not possible. FTDI is a small company that has heavily invested time and money in the driver base and chips them make.
they could drop price but then the chinese will drop price even more. every dodo in china has access to a chipfab in a shoddy garage that can spit out chips dirt cheap. Labor cost is next to nothing, they get the design for free from university students, and the government subsidizes these fabs heavily. so if you drop the price , they drop the price, you drop it more, they give em away at a price you can't even afford to pay the lady that comes and cleans the toilets in your office...

Doesn't work. you can't compete against china. The chinese can spin chips faster than the western world. That is why i left the chip business. it's over. last bluetooth chipset took 3 years to develop fully integrated apart from 2 caps and the antenna. some chines garage outfit made one in 3 months , half the power consumption , half the die size , antenna integrated , sells it for 1/4 of the price. give it up. it's over.

you can only make money if you create original new products that they can't copy (yet).
Look at the plethora of scopes. the bottom has completely fallen out of the scope market. ( good for hobbyists, bad for the big scope makers )
theres oodles of chinese kits that make, decent to very good basic digital scopes. they sell em at a low pricepoint. think about  what it cost them to develop these. with the entire development budget for that scope you can probably hire 2 engineers over here... one will decide what color the case will be  , the other will make a powerpoint presentation...
doesn't work.

all the commodity crap (diodes, transistors, ttl, cmos, lm741's , 8051's et al , is useless to pursue. Today, FTDI has become a commodity part... i predict soon we will see chinese AVR and Cortex 'clone' parts ... The only thing holding them back is the army of lawyers that ARM has and some specialised low power processes the chinese haven't mastered yet. but it is coming ...
TSMC and UMC and other chinese wafer fabs have more advanced processes than the western world. simply because they produce more and have more money to upgrade their gear. the fact is that big boys like TI , ST , Infineon are, today , already 2 steps later in technology than the big chinese fabs... only Intel and IBM can surpass them and IBM has recently thrown in the towel as well.

like is said : chips are a commodity. a diode made with 1 square millimeter of silicon is sold for 5 cents. a chip with 100.000 transistors that is also 1 square millimeter also costs 5 cents. it only costs more to design. this is untenable. due to the high development cost , but the fixed area-driven sales price it becomes prohibitive to design anything. budgets are being cut left and right. it's over, apart from the specialty devices the chinese haven't mastered yet.

The titanic has hit the iceberg , and the orchestra stopped playing 2 minutes ago, not because we are sinking , but because we are already completely underwater and on the way down... anyone still on board now is doomed. other ships, leaner ships ( not these huge behemoths that can't react and turn on a dime) are ready and already sailing. the traditional juggernaut of 'we design and fab it' is dead. lean design centers , huge megafabs with cheap labour. that is the current business model.

[Richard Crowley]

And doesn't AMD license the Intel instruction set?  I imagine at some point they reversed it, so yeah.  The "x64" CPUs we all use now, even the Intel ones, are AMD instruction sets.  Bit of justice for Intel, there.  They have to license that from AMD.

If you look at the instruction sets published in the specs, it appears that Intel and AMD have cross-licensing agreements for all the new instructions. The competitive advantage is that if it is an AMD addition, then Intel plays catch-up and it doesn't appear until the NEXT generation, and vice-versa. Of course, AMD seems to be slowly backing out of the processor business since it sold off its fabs and bought ATI.

[Rufus]

I don't condone what FTDI did. That said, in the name consumer interest, it would be interesting to see an honest comparison between a genuine ft232 and a clone.

A clone? Which one? Do you know how many there are? If you tested a fake/clone today do you know the fake/clone you buy next week would be the same or even from the same manufacturer?

If you test a fake/clone today you could hope the results will hold for the rest of the reel/batch you bought and not much more.

[gman4925]

My 2 cents.

I think the general consensus here is that FTDI are in their right to stop the non-genuine chips working with their driver and the way they should do that is by simply refusing to work with the non-genuine chips.

Lets look at this.
How much different would the situation have been if FTDI initially pushed an update that simply stopped the clones/counterfeits working, without changing the PID?
To the lay user, their product (if dodgy) stops working. Did that damage the product? The argument that if it stops working then it is damaged has come up in this thread.
Would they be able to sue for damages? That's been suggested, how is it any different?
What would they need to do to 'fix' the damage? Install some older drivers, now pushed by the seller of the clones, not supported by FTDI and most likely withdrawn by FTDI.
What do you need to do now to make the clones work? Almost the same, install some older drivers and run a program that changes the PID back to fake the FT232 PID and now you are at the same point.
I guess there is an extra step there, but to the lay person trying to get it to work again they are just going to run some (possibly dodgy) program that they find online that fixes their problem.

Either way, the steps needed to be taken by the end user with a non-genuine FT232 to get it working again will be essentially the same after a while.

FTDIs thinking must be that the people cloning their chips will now need to get rid of all their stock at a discount because now it is clearly worse than genuine (they were probably hoping that it would get discarded but I doubt that will happen). Also the cloners will have to retool their chip fab to ignore the eeprom write, or work in the same way as the genuine chips, my guess is this is expensive, for such a minor thing and they will more likely just push a software fix of old drivers etc, which will be OK for a lot of people who are computer savvy, but for the people who want to plug something in and have it work then this is no good.

Manufacturers who are knowingly using non-genuine parts will rush to pick up genuine parts (I haven't noticed a drop in stock level on DigiKey though) to make sure that the production run will get out the door, boosting FTDI sales (probably temporarily). But from the outcry it looks like people say they will respin their devices to use something other than FTDI, because there is now a risk with FTDI.

I wonder how many managers will agree to the extra cost of redesigning products, reworking all supporting documentation etc when someone comes and tells them they should no longer use FTDI.
When they ask why they should no longer use FTDI and the response is "FTDI pushed a malicious update to users that damaged fake FTDI chips but did nothing to genuine FTDI chips" what will be the managers response?
I think it would be something along the lines of "We use genuine FTDI chips though, why is this an issue? This just makes our product better than the competition who's product is now failing in the field. I'm not approving any cost to redesign anything."
Or in the case of a company using non-genuine, if that manager has had their head in the sand all this time - "Oh Sh!t".

Another thing on the semantics of non-genuine, clones and counterfeits/fakes.
I'd say that genuine chips are manufactured by FTDI and non-genuine by someone else.
A clone would be a chip that is functionally equivalent, but doesn't present itself as a genuine chip.
A counterfeit/fake would be a chip that may be functionally equivalent (or may not) but does present itself as a genuine chip (either visually or electronically through VID/PID).
In this case I think the chips are clones and counterfeits and would remain counterfeits even if they did not have the FTDI logo or part number on them because they would still identify themselves as genuine chips by presenting the VID and PID which they are not authorised to use on request.

I won't be too surprised if after this debacle that USB.org or manufacturers get more legal protection for their VID and PIDs, making this sort of thing (blocking fakes, not necessarily rewriting the PID) more common in the future and making it hard for non-members i.e. hobbyists or small companies to make a USB product without a great deal of headache.

I used to use a fair few FT232s and I know I would have a hard time justifying the cost of using something else just because the clones of it will now no longer work. But our chips came from DigiKey and if they stopped working I don't think I would be cracking the sh!ts with FTDI but getting a please explain from DigiKey. I guess it was only about 2000 chips a year so never had to look at "alternative" sources of supply.

Please don't shoot me down for voicing what seems to be a less hateful opinion of FTDI than the general backlash, but I don't see much of a difference between it stopped working (because they changed the PID) and it stopped working (because they detected a fake).
Would you all honestly give FTDI the big thumbs up for stopping the clones from working with their driver and then just use the old driver workaround?

[Fungus]

Medical device killing patient over serial comm failure wouldn't have a pass sticker.

It doesn't have to be a critical life support system, the device that tests your poop would do - a nice backlog of stool samples piling up.

The point is, did the moron who signed off on this even think of all the possible consequences of his actions?

[Fungus]

I think the general consensus here is that FTDI are in their right to stop the non-genuine chips working with their driver and the way they should do that is by simply refusing to work with the non-genuine chips.

They also have a "right" to burn down their factory.

The question you need to answer is: Does it make any sense to do so?

[XFDDesign]

The only answer is to make it easy to spot fake chips. If that means putting a hologram on them or whatever, then that's what they have to do.

Any person can create a lock which they themselves cannot find a way to pick.

Countless companies have stuff made in China, there is nearly nothing that is made elsewhere in the world, that China cannot also duplicate. It's why so many companies... use vendors in China. Create a hologram? Find some Chinese company that does those. Boom, back into business. How about some kind of encryption business on the IC? The Chinese have some excellent cryptographers, and would likely figure out a software hack anyway (think Hardware Dongles). The only means of competing against "us-too" duplicators is to push towards a particular innovation that isn't "near enough" in technology for the copy-cats to copy.

(And no, I'm not a sinophile).

The tragedy here, isn't really the hardware. The innovation was really all in the software.

[firewalker]

FTDI could move to China! 

Alexander.

[Richard Crowley]

I wonder how many managers will agree to the extra cost of redesigning products, reworking all supporting documentation etc when someone comes and tells them they should no longer use FTDI.
When they ask why they should no longer use FTDI and the response is "FTDI pushed a malicious update to users that damaged fake FTDI chips but did nothing to genuine FTDI chips" what will be the managers response?
I think it would be something along the lines of "We use genuine FTDI chips though, why is this an issue? This just makes our product better than the competition who's product is now failing in the field. I'm not approving any cost to redesign anything."

But that is the same kind of unrealistic world-view that got FTDI into trouble in the first place.  Dave explained pretty well what happens out in the procurement and manufacturing worlds, especially when you aren't doing everything for yourself in-house.

This is why critical chips have official second-sources, so that you aren't caught with your pants down when the FTDI official source dries up.

[Fungus]

Countless companies have stuff made in China, there is nearly nothing that is made elsewhere in the world, that China cannot also duplicate. It's why so many companies... use vendors in China. Create a hologram? Find some Chinese company that does those. Boom, back into business.

It's much easier to track down people who are doing that than if you're trying to trace standard-packaged chips that could have been produced in any number of factories by paying the night-watchman to turn a blind eye for a few hours.

The tragedy here, isn't really the hardware. The innovation was really all in the software.

That value no longer exists. I can program an Atmel Tiny85 to act as a USB-to-RS232 converter for 1/4 the price of an FTDI chip. It will work with my OS's generic drivers.

(And that's an expensive way of doing it).

[nctnico]

FTDI could move to China! 

Their chips are already made somewhere in Asia by a subcontractor. Like many small semiconductor firms FTDI doesn't have their own production facility.