Chipmaker FTDI bricking counterfeit kit

Reports are emerging that chip-maker FTDI has declared war on chip counterfeiters with a driver update that bricks USB devices recognised as fakes. Hackaday reports that the issue has been noticed in various forums – EEVBlog and Arduino among them – and pins the issue down to drivers setting the USB product ID to 0 if a USB …

[Munin]

That's going to cause some problems

I've been watching some of these developments on twitter; several prominent hardware designers have sworn off FTDI for future use.

Furthermore, this is likely to cause non-technical consumers some consternation: in the perception of the typical uneducated user, "Windows Update" will have broken their widget. As such, it's likely there's going to be a lot of future resistance to OS updates by those users and those persons those users talk with. The story of "my friend updated his windows and his things broke" is bound to make the rounds very fast.

Needless to say, this is going to be problematic for the infosec community; it's hard enough to get users to install updates promptly as-is, but after this, it'll be all the harder.

Additionally, besides the inevitable class-action suits that'll be brought against 'em, it's likely that FTDI is going to end up getting some nasty visits on the criminal side of the house for malicious destruction of property - if not worse; if they managed to brick any government kit with this stunt, then like as not they'll get charged with espionage or summat like.

There's plenty of ways FTDI could have addressed this issue, and bricking hardware is probably the worst way.

[Anonymous Coward]

Re: That's going to cause some problems

>several prominent hardware designers have sworn off

You mean dave from eevlog? If so "prominent" is maybe a bit of a stretch.

[Munin]

Re: That's going to cause some problems

I specifically saw Travis Goodspeed state this; can probably find some others if you take a look.

[Anonymous Coward]

Re: That's going to cause some problems

>Travis Goodspeed

Probably an academic hardware hacker and not a prominent hardware designer.. i.e. a guy that designs products that ship millions of units.

[Pypes]

Re: That's going to cause some problems

@AC

Surely the fact that you can say "Dave from eevlog" on a non-electronics forum and expect people to know who you're talking about is evidence enough of the blokes prominence.

[Gumby1]

Re: That's going to cause some problems

Ello Dave I want to use your chips! Is that the bloke?

[petur]

Re: That's going to cause some problems

Not only designers...

I bet this will somehow fly back into their face in another way.

Knowing the issue, and in need of a USB to Serial, will you take the risk of getting an FTDI based one (with the risk that it is a fake one), or go for another one that doesn't have this risk?

I'm sorry but although I try hard not to buy fake versions, I'm going to play safe and avoid FTDI completely.

Watch sales drop through the floor. This is image damage that will last a long time.

[Anonymous Coward]

Re: That's going to cause some problems

>Watch sales drop through the floor. This is image damage that will last a long time.

Yes maybe a few hundred people that maybe buy one or two of their $3 parts over their whole life time boycotting them is going to totally kill them. That's a few trays of the many hundreds of trays of components they have to sell yearly to just stay afloat BTW.

All of the guys that spend far too much time on Twitter are going to find it very hard to totally boycott FTDI's chips considering how many dev kits use the FT2232 for JTAG.

[JP19]

Re: That's going to cause some problems

"Knowing the issue, and in need of a USB to Serial, will you take the risk of getting an FTDI based one (with the risk that it is a fake one), or go for another one that doesn't have this risk?"

In a few months after this FTDI driver action has flushed low quality clone crap from the supply chain I will be more likely to buy an FTDI based one because it will be less likely to be low quality crap with a fake chip.

[Anonymous Coward]

Re: That's going to cause some problems

Sounds like a great way of alienating customers.

[Anonymous Coward]

Re: That's going to cause some problems

There's plenty of ways FTDI could have addressed this issue, and bricking hardware is probably the worst way.

Maybe you are right, but chip counterfeiting has reached epidemic levels. If the board manufacturers that buy the chips don't care of they are getting cheap counterfeits or not (because they knowlingly buy from non-authorized suppliers) then it's up to the chip manufacturers to put a stop to it.

Counterfeit chips may work for a time, but they can result in inevitable failure. Then the developer calls me, and complains that I have to fix it because it's not his fault that he bought his product from someone that uses fake chips. No, I don't work for FTDI, I work for another semiconductor company and counterfeits are costing us dearly, and not just in money. I even have people tell me "it's not my fault it's a counterfeit, you still have to replace them!" Then come the threats.

So if your FTDI chip is a fake, call the manufacturer you bought the kit from and demand a refund or you will report them. Hell, I've had developers that got scammed buying boards with fake chips work with us to catch the crooks. We reward them with kit worth a lot more than their original board.

several prominent hardware designers have sworn off FTDI for future use.

Who? Don't B.S. me, tell me who they are. BTW, where do you buy YOUR boards from?

[Daniel B.]

Re: That's going to cause some problems

Maybe you are right, but chip counterfeiting has reached epidemic levels. If the board manufacturers that buy the chips don't care of they are getting cheap counterfeits or not (because they knowlingly buy from non-authorized suppliers) then it's up to the chip manufacturers to put a stop to it.

Understandable, but bricking counterfeit chips is a bad move in the long run. It would be far easier for FTDI to have the drivers flag a chip as counterfeit, then give this information to the end-user, which will then go to the manufacturer and say "hey, this is counterfeit stuff!" and so the complaint goes all the way up through the supply chain.

Instead, this will only get anger directed at FTDI and/or Microsoft. Manufacturers will probably avoid FTDI altogether instead of risking their hardware getting bricked because one of their suppliers slipped a mickey on their chips.

[Jordan 1]

Re: That's going to cause some problems

The keyword being "non-technical consumer." What practical difference is there between the only driver the user knows about bricking the device and the only driver the user knows about not working? A useless device is a useless device. A simple warning message accomplishes nothing.

[Henry Wertz 1]

Pretty nasty

Having FTDI's drivers not work with counterfeits? No problem. Having it 0 the ID on the chip? I think this is over the line.

[Anonymous Coward]

Re: Pretty nasty

>Having FTDI's drivers not work with counterfeits? No problem.

>Having it 0 the ID on the chip? I think this is over the line.

To most users that's going to amount to the same thing. They'll get an "you inserted a device" bong sound and then it won't work either way. There's nothing to say that the driver talking to knock offs normally wouldn't break them so maybe stopping them from registering with the driver in the first place is a good idea (tm).

You can fix the id with FTDIs tool and continue to use the device with older drivers. It's hardly destroying the hardware.

[Nuno trancoso]

Re: Pretty nasty

No, you're just tampering with it in a malicious way. Wanna bet how well that goes down? It's already bad when someone bricks hardware unintentionally, but doing it on purpose? Gonna go down real well...

[Anonymous Coward]

Re: Pretty nasty

>No, you're just tampering with it in a malicious way.

It's an EEPROM setting that is totally reversible.

>Wanna bet how well that goes down?

It doesn't corrupt any data or brick the hardware. It changes the ID from one that is being used illegally to one that no longer registers with a driver that it is forbidden to use on non-original devices.

>It's already bad when someone bricks hardware unintentionally, but doing it on purpose?

It doesn't brick the hardware. It changes an EEPROM setting so that fake chips no longer register with a driver they aren't licensed to use. I have seen at least one example of a pretty boutique product, a PCI bridge for the Amigas that use generic cards with modified ROMs, that wiped the RDB (partition table in Amiga land) when it found that the user was trying to use generic cards with the special drivers. That causes actual damage to peoples data. This on the other hand changes a totally reversible setting in the EEPROM. Nothing is bricked. It just won't register with the drivers anymore.

[corestore]

Re: Pretty nasty

AC, what you say may have some technical validity.

The end user will observe what happens, and say, "this Windows update bricked my hardware!".

And they will be correct, for all practical purposes.

[Gotno iShit Wantno iShit]

Re: Pretty nasty

This will be interesting to watch as various legal systems will be involved. China will of course do absolutely sod all about the counterfit makers. The American legal system would, if FTDI were American, defend it to the ends of the earth. But FTDI is British and if there's one thing the Merkin legal system likes to do it's screw a foreign company. If I were Fred Dart I'd be closing down the US listed company, the UK legal & political systems won't offer it any help. The UK doesn't have a class action mechanism so the legal system here is unlikely to do anything for the consumers. FTDI might find themselves under the spotlight if they have breached the computer misuse act, if so there will be years of court procrastination that end with a slap on the wrist.

One thing is for sure, the only winners will be the vampires lawyers.

[bonkers]

Re: Pretty nasty

I've just gone through this whole process with a "clone" device, from a reputable supplier.

Firstly, I don't see how it is illegal to "white room" copy an existing part, like the very popular FTD232, if the chinese or whoever have replicated the function without copying the silicon, then, isn't that what AMD did to Intel, legitimately? This chip is the new "MAX232" - of course it will be replicated.

Incidentally I hugely respect FTDI - have a look at their new "Eve" concept, turns a dumb graphics display into a sort of HTML terminal, so small micro's can drive big displays without tons of gfx and fonts type of codebase.

Secondly, I'm not sure the new FTDI driver actually writes zero into the PID of the clone parts, I think they come with zero as the PID, but I could be wrong. My understanding is that the new drivers will recognise only parts with VID=0403 and PID = 6001, 6010, 6011. It will "fail to install properly" -because it has not been explicitly instructed to work with "0000" parts.

I would post some of the code from the *.inf files, but the T's and C's are highly restrictive. In fact it is the agreement you sign up to when installing the drivers that carries most of the poison, you are not allowed to modify the software in any way, etc etc.

I can understand they don't want their efforts in making and maintaining the drivers to benefit their competitors, but they're protecting a carcass, there's no more meat on the USB-UART thing, best move on, and btw everyone's coming round to this open-source thing these days.

[the spectacularly refined chap]

Re: Pretty nasty

Firstly, I don't see how it is illegal to "white room" copy an existing part, like the very popular FTD232, if the chinese or whoever have replicated the function without copying the silicon, then, isn't that what AMD did to Intel, legitimately? This chip is the new "MAX232" - of course it will be replicated.

Reverse engineering is dicey but there's certainly no problem producing a compatible part which is what the MCU based part referenced above is. The difficulty is then claiming it to be an FTDI part. That is what you are doing if you program it with FTDI's VID.

I can understand they don't want their efforts in making and maintaining the drivers to benefit their competitors, but they're protecting a carcass, there's no more meat on the USB-UART thing, best move on, and btw everyone's coming round to this open-source thing these days.

This is nonsense and self-contradictory with the above - on the one hand you are claiming it is the new standard, on the other you are claiming it is obsolete and not worth defending. This is a large market - much larger than you probably appreciate. Discrete USB→RS232 adapters probably account for less than 10% of the total market, the rest is integrated.

Don't get me wrong, I'm not defending FTDI here, they seem to be on very shaky ground if it is in fact deliberate as everyone is assuming. However, it is worth remembering that there is no confirmation from FTDI anywhere I have seen and if this is an "inadvertent" side effect of operating their own chips they're on much more solid ground.

[Alan Brown]

Re: Pretty nasty

" I'm not defending FTDI here, they seem to be on very shaky ground if it is in fact deliberate as everyone is assuming"

The linux driver code snippet posted elsewhere in this thread proves it's deliberate.

[JeffyPoooh]

Re: Pretty nasty

...claiming it to be an FTDI part. That is what you are doing if you program it with FTDI's VID."

Are VIDs and PIDs and so forth legally protected? By statute, in the way that Trademarks are?

"FTDI" is obviously a legally protected trademark, but I doubt that something like "6201" in a certain register is actually legally protected.

[Sandtitz]

Re: Pretty nasty@JeffyPoooh

"Are VIDs and PIDs and so forth legally protected? By statute, in the way that Trademarks are?"

Well, if the counterfeit device carries the USB logo without authorization from USB-IF, it most likely has some legal issues.

"but I doubt that something like "6201" in a certain register is actually legally protected."

True. Even Intel couldn't trademark '80486' so the successor was named 'Pentium'.

[Jaybus]

Re: Pretty nasty

"Are VIDs and PIDs and so forth legally protected? By statute, in the way that Trademarks are?"

Yes. The contract for the vendor ID requires a USB-IF trademark license agreement. The USB logos are trademarked. If a company does not have a VID, then they also do not have a license to use any USB logo. Any device with a fake chip that is using a USB logo is then in violation of trademark laws in any country in which USB-IF has a trademark. At this point, that is just about anywhere they are sold. Conclusion: if it has a fake chip and uses a trademarked USB logo, then it is contraband, Such a contraband device is not protected in any way, In fact it is subject to confiscation..

[Solmyr ibn Wali Barad]

Re: Pretty nasty

"Secondly, I'm not sure the new FTDI driver actually writes zero into the PID of the clone parts, I think they come with zero as the PID, but I could be wrong."

Couldn't have been. Under Windows, neither new or old FTDI driver would tolerate zero PID. Hence the suggestion to use PID recovery tool AND older driver.

These links seem to hint the same:

channeleye.co.uk/microsoft-bricks-scottish-ftdi-clones/

hackaday.com/2014/10/22/watch-that-windows-update-ftdi-drivers-are-killing-fake-chips/

Latter link has usable workarounds for Linux. Apologies for copying.

Arduinouser says:

My arduino got hit by this I think. If you use linux, you can tell the serial driver to load even if the pid=0: echo 0403 0000 > //sys/bus/usb-serial/drivers/ftdi_sio/new_id

Jiří Němec (@BluPix) says:

Thanks, whole operation to restore pid using http://www.rtr.ca/ft232r/

echo 0403 0000 > /sys/bus/usb-serial/drivers/ftdi_sio/new_id

ft232r_prog –old-pid 0x0000 –new-pid 0x6001

[heyrick]

Re: Pretty nasty

"It's an EEPROM setting that is totally reversible."

I rather suspect that the Windows users that can understand that sentence is likely to be a rather small subset, and the Windows users that can understand it and do something about it, smaller still.

Therefore, while technically reversible, the original statement still holds true. The driver is intentionally bricking people's hardware.

[NumptyScrub]

Re: Pretty nasty

No, you're just tampering with it in a malicious way. Wanna bet how well that goes down? It's already bad when someone bricks hardware unintentionally, but doing it on purpose? Gonna go down real well...

Counterfeit cash or cards: subject to confiscation upon detection, further use is not permitted

Cloned car: subject to confiscation upon detection, further use is not permitted

Counterfeit USB to serial gizmo: ...

I'm not saying bricking them won't really piss off everyone affected, because it will. But why treat a counterfeit USB to serial gizmo any differently to other counterfeit items like cash, or cloned motor vehicles? Once it is detected as counterfeit, your recourse as a consumer is to go after the seller; you don't sue the police for confiscating your cloned car, you sue the bloke at the pub who sold it to you.

[Anonymous Coward]

Re: Pretty nasty

you don't sue the police for confiscating your cloned car, you sue the bloke at the pub who sold it to you.

And the car doesn't get confiscated by the maker of the car that yours is a clone of either… it gets confiscated by law enforcement.

That is where FTDI have overstepped the boundary.

[Daniel B.]

Re: Pretty nasty

Counterfeit cash or cards: subject to confiscation upon detection, further use is not permitted

Cloned car: subject to confiscation upon detection, further use is not permitted

Counterfeit USB to serial gizmo: ...

Counterfeit Rolex watch: You get to keep it.

Counterfeit bags: You get to keep it.

Pretty much counterfeit product confiscation is made at country customs, and even then end-users/consumers are pretty much given a pass on that. Why? Because there's a good chance you didn't even know they were counterfeit goods!

The hideous ACTA was trying to criminalize this, but that got shot down thanks to the retarded SOPA/PIPA law in the US that made the world notice ACTA. Sure, they'll try to do TPP, but I'm pretty sure it'll also get shot down.

In fact, there's a good chance that this bricking might have been actually legalized by ACTA. Yet another reason to kill that thing for good.

[Nuno trancoso]

Re: Pretty nasty

Pretty much. And as someone said already, bricking peoples things will just make lawsuit chasers happy. There's absolutely no way to defend the course of action they took. IANAL, but i'm sure those that are are already doing the happy dance. Heck, ppl might start willfully bricking their stuff just to join in on the action.

[corestore]

The elephant in the room is...

Microsoft.

Did they know exactly what the payload - and I use that word deliberately - of the drivers was, when they distributed them as part of Windows update?

Microsoft could be at least as much on the hook here as FTDI. If they knew, they were part of the conspiracy. If they didn't know, they distributed malware (and I can't think of any other description for something designed to brick a device) without doing due diligence.

What have they said on the matter? Register - do journalism! Dig.

[Malcolm 1]

Re: The elephant in the room is...

Do you really think that Microsoft keeps a stash of knock-off parts just on the off-chance that a driver causes it to fail in some way?

Hardly some grand conspiracy methinks.

[corestore]

Re: The elephant in the room is...

Irrelevant what they do or don't keep on the wall.

The question is what they were TOLD.

[Anonymous Coward]

Re: The elephant in the room is...

@malcom

To be part of a Windows Update, the driver has to be certified by MS i.e. pass it's tests. I would hope that it would of shown up.

[KjetilS]

Re: The elephant in the room is...

I would hope that it would of shown up.

I'm terribly sorry to nitpick:

It's would have.

[Tom 38]

Re: The elephant in the room is...

Do you really think that Microsoft keeps a stash of knock-off parts just on the off-chance that a driver causes it to fail in some way?

Not just. They keep stacks and stacks of hardware that they verify all windows updates (and subsequently user software) on for all sorts of reasons. Microsoft's dedication to keeping their software running on a wide variety of machines and OS is legendary, even to an OSS fanboy like me. Did you think "WHQL" was some badge they just stick on after looking at the code?

[Anonymous Coward]

Re: The elephant in the room is...(@Corestore)

NOT MICROSOFT!

FDTI wrote the drivers for THEIR usb to serial chips, not the counterfeit ones. Who ever made the counterfeit chips is STEALING from FDTI.

Microsoft was provided the FDTI driver, all they did was "update the driver".

[Daniel B.]

Re: The elephant in the room is...(@Corestore)

Who ever made the counterfeit chips is STEALING from FDTI.

That word doesn't mean what you think it means. They are infringing upon patented stuff, or building a trademarked/copyrighted design and having it interface with software they haven't paid a license for, but they aren't stealing anything. There's a reason why copyright infringement, patent infringement, trademark infringement and theft are separate things in pretty much any country's law.

[Andrew Jones 2]

Sorry but the people in here who are claiming changing a setting in the EEPROM is totally justified and reversible don't really seem to get the point.

Fake hardware or not - when a "normal" customer bought whatever kit it was from eBay or wherever - they more than likely did not know it was fake. They certainly don't have the knowledge of how to find a tool and go changing things in the EEPROM themselves. And as this article points out - even if you do change the setting back - it just flat out won't work with Windows - which is what the vast majority of people will be using. This is criminal damage - and is no different from writing a virus to kill another virus and then purposefully infecting peoples machines with it - which is also considered illegal.

If you are using Linux - this doesn't affect you - you more than likely know how to get hold of the tool and change the EEPROM setting - and you more than likely knew or at least suspected that the hardware might be a bit on the dodgy side.

[Anonymous Coward]

>And as this article points out - even if you do change the setting back -

> it just flat out won't work with Windows -

So they aren't allowed to restrict their drivers to only real devices either then? Blocking the devices in software and/or changing the ID so that they no longer register with the driver amounts to the same thing in the real world.

Do they also have to test all of the fakes against their drivers to make sure they don't break them?

>This is criminal damage - and is no different from writing a virus to kill another

>virus and then purposefully infecting peoples machines with it -

>which is also considered illegal.

Stop being a drama queen. This changes a few bytes in an EEPROM. Those bytes can be totally recovered and the USB ID those bytes represent is FTDI's property in the first place.

And .. drum roll .. Commercial devices (shipping in millions of units) that contain these chips have their own VID/PID and won't register with the stock drivers. This is why the Linux kernel contains a massive list of IDs for devices that use this chip and has a method to add new IDs at runtime. The main people this is going to affect is people that have bought cheap USB->Serial modules from eBay.

[DryBones]

Stop thinking like an uber-geek. You need to be thinking like an end-user about this. Nobody outside of this forum and frequenters of perhaps a handful of other tech sites would know about this unless it manages to go huge online. Yon End User plugs the device in, it stops working, they have no way to find out why unless they think to go digging way into device properties. When is the last time you looked at a USB ID just because?

It is effectively bricked, for the average person's level of skill. Copy or not, this falls squarely into the Computer Misuse Act as malicious software.

[Anonymous Coward]

>You need to be thinking like an end-user about this.

Exactly the same thing will happen if they block the device in the driver or brick the fakes by writing a register the doesn't exist in the fakes by mistake. What exactly should they do?

I would argue that stopping the fakes from registering with their driver in the first place is fairly sensible.

You all seem to be missing a few points, probably from not actually knowing what these chips are used in so let me help you out:

These chips are USB to serial bridges. They are usually used in those USB to serial cables that you would find at Maplin etc but chances are you will not find a cable with an FTDI chip in on the high street as they are considerably more expensive than the chips from Silabs for example. They were used in some long since EOL'd Nokia data cable IIRC. If you manage to find a cable with an FT232 in it and it stops working you can return the cable to where ever you bought it and get them to work out why they are selling counterfeit goods.

The other use of these chips is for simple usb interfaces to microcontroller based systems. The best example I can think of right now is my swanky 700 quid multimeter. It has an FT232 on one side of some optocouplers so that it can do data logging to a PC over USB without directly connecting to the microcontroller in the multimeter. This is to retain isolation between however many hundred volts are being measured on the multimeter inputs and the PC.

Products like this use their own VID/PID and not the FTDI one so they will not register with the stock FTDI driver and require a special one from the vendor for Windows. If it's not really a generic serial port you don't want it being used as one. If the FT232 chip in the datalogging module does turn out to be a fake and gets bricked by the windows driver (not going to happen as I wrote Linux software to work with it but for the sake of argument..) the rest of the device won't stop functioning. I won't be able to use the data logging part anymore and I would return the meter to the vendor to have it fixed and they will have to deal with how counterfeit parts got into their supply chain.

Other than cheap USB to serial modules, cheap Arduino clones etc used by makers etc I'd be surprised if you could find a product that contains one of these chips that has the stock VID/PID and that would be totally broken beyond use by the VID/PID getting changed.

[Anonymous Coward]

Having a licence for drivers is properly lame anyway.

[Tom 38]

It is effectively bricked, for the average person's level of skill.

If the "average user" used serial ports then you would still find them on the backs of computers. The average user has no use for a serial port, so if this bricks someone's USB-serial adapter, they aren't an average user.

[Pypes]

@tom 38

The whole reason FTDI chips are so popular is that they prevent the average user from needing to know they are using a serial port. There is a hell of a lot of legacy industrial machinery currently being driven over magic cables that have a friendly USB plug on one end and a "weird trapezoid thing with a dozen pointy bits and some screws" on the other.

[Matt Bryant]

Re: DryBones

".....You need to be thinking like an end-user about this....." So, thinking like an end-luser, when the USB device stops working (which may not be noticed until an USB device is plugged in days after the update), the luser does one of three things.

In the first case, they just assume their cheap, eBay-sourced USB device has blown up because it is a cheap, eBay-sourced device, and they go order another. Should that not work out-of-the-box (because it has a one of the fake chips) then they may come to the conclusion that buying cheap, eBay-sourced devices is not a good idea, and then purchase a more expensive part which has a warranty and hopefully an FDTI part included. At some point the supply of fakes will dry up as they will not be able to sell them as 'Windows ready' without falling foul of Trading Standards.

Secondly, in the case they think they have a warranty they will reach out to the warranty-supplier's support, at which point it is up to the supplier to explain they have used a knock-off chip and need to supply a working replacement (ie, one with a proper FDTI part). Since the device is not 'broken' it could be rejected as a warranty replacement case, but that depends on whether they described it as 'Windows compatible' at the time of sale as it no longer is post-update. Supplying a replacement part that they know is not going to work after the update as 'Windows compatible', either as a warranty replacement or as a chargeable replacement, would be an illegal act in the UK, probably all EU countries, and most likely in the US too.

In the third case, the luser takes his unit to someone who actually has the skills to diagnose the problem. In the case it is someone really skilled then they will get the explanation and probably the offer of a replacement device with an FDTI part. If they go to a less skilled repairer, such as a PC chain store, then they will probably get an offer of a replacement part with the diagnosis of "dis part be broke, we sell new one, only $59.99", but it highly likely someone in the chain store's organization will know about the issue and will have made sure their stock of replacements are genuine FDTI-containing parts.

As it is FDTI has not irreversibly broken the 'fake' device, simply ensured they will not work with FDTI's Windows driver. FDTI is under no legal obligation to supply a driver that works with non-FDTI devices and could argue that, since it has no means of qualifying the design of 'fake' devices it cannot guarantee they will work safely and is therefore protecting the user. This is the Apple argument used to stop people using non-Apple PSUs and connectors.

[JeffyPoooh]

Re: DryBones

MB: "...come to the conclusion that buying cheap, eBay-sourced devices is not a good idea, and then purchase a more expensive part..."

A reassuringly expensive replacement that will probably be just another clone with a high price applied to assist with moving them off the shelves.

Your logic of paying more will be anticipated and taken advantage of.

[NumptyScrub]

Sorry but the people in here who are claiming changing a setting in the EEPROM is totally justified and reversible don't really seem to get the point.

Fake hardware or not - when a "normal" customer bought whatever kit it was from eBay or wherever - they more than likely did not know it was fake.

As I mentioned to another poster, I feel it is exactly as justifiable as the confiscation of cloned cars, or the confiscation of counterfeit banknotes. Normal consumers who unwittingly use counterfeit notes, or who purchase a cloned car, will (upon detection of the counterfeit) have those taken away from them never to be seen again. They get no reparation for the loss of those items, and have to pursue the seller (of the cloned car) or the person who handed them the funny money if they feel they deserve remuneration for being the victims of fraud.

Why is it that you feel that consumers who unwittingly purchase a counterfeit USB to serial gizmo deserve different treatment in the eyes of the law?

[Tom 35]

So not justified at all

"I feel it is exactly as justifiable as the confiscation of cloned cars, or the confiscation of counterfeit banknotes."

There are specific laws in place to cover bank notes. It's not just because someone thought it was a good idea.

Cloned cars? I read one story that claimed there were some fake Jeeps produced in China but I have never read anything about confiscation of cloned cars. Handbags yes, but that's due to trademark, and requires legal action. You can't just walk into china town with a hammer and wack anything you don't like.

[Anon5000]

"Why is it that you feel that consumers who unwittingly purchase a counterfeit USB to serial gizmo deserve different treatment in the eyes of the law?"

Here in the UK it is not illegal to own counterfeit goods and i'm pretty sure it is not illegal to own them either. Certainly if you had a fake Gucci handbag it would not be removed from your person, unless you was selling the fakes. So that comment is is way off.

Many of these customers have no idea their product is fake or why a company has now broken it for them. As an example, I know next to nothing about electronics but recently got a chrome cast and wanted to root and a few usb micro controllers were suggested as cheaper alternatives to the Teensy to flash with the usb exploit. Even now I don't know if the one I purchased is a fake of something else, as electronics are not my area of expertise. For a company to kill that device with a driver update and for it to become useless to me cannot be seen as morally acceptable by anyone other than those with a twisted sense of judgement. The amount of lost hours such crippling could cause is also not acceptable.

Edit- Reading further this driver issue may actually affect me. After not having much luck trying to flash the image on to the Pro Micro board through linux I booted in to windows and tried flashing though an app there but had issues getting it recognised after the first flash, even though the drivers installed themself. Not been able to do anything with the controller since. Noticed the baud rate stuff so this board must have a usb to serial converter in and there is a good chance it's one nobbled by this update.

Thanks a lot for all that wasted time you utter twats at FTDI!

[Daniel B.]

Normal consumers who unwittingly use counterfeit notes, or who purchase a cloned car, will (upon detection of the counterfeit) have those taken away from them never to be seen again.

Selling counterfeit goods is illegal.

Buying counterfeit goods isn't.

Counterfeit banknotes are actually illegal for very specific reasons, mostly that banknotes are actual legal tender, and if counterfeit banknotes weren't illegal, all banknotes would be worthless as anyone would just simply print their own and pay with them.

[Andrew Jones 2]

I see so really there is only one real solution to this problem then.....

If you have no way of being 100% certain that the product you are buying is all real and above board, then don't buy it. Thus - we should probably just never buy anything.

The proper way of dealing with this issue - would of been for FTDI to have issued the driver update right at the beginning when they discovered the first counterfeit devices. Instead they have waited 5+ years until the problem has gotten so far out of hand that there is no way for the average consumer to know if what they are buying is legit.

[Dan Paul]

Remind me to give you counterfeit money

A fake product does not deserve any protection. The people who provided the fake part are at risk here.

If you bought fake kit, go back to the vendor and get a valid replacement. No one else is culpable.

[James Finnie]

Very dumb idea

Having worked for years in manufacturing CE/IT goods in the Far East - this is a really, really dumb idea.

I would be willing to bet there will be bona-fide product out there that some enterprising Chinese contract manufacturer has thought "I can save some money using these "local" FTDI chips". The company with responsibility for the product will have no option but to ship them back and replace the IC's - and this may not even be economical if the products have been potted or coated for harsh environment.

A pop-up message alerting the end-user to the status of their kit - or at the very least, if you brick the devices from working with the mainline driver, provide as a good-will gesture a driver which does work, but makes the user very aware they are using a knockoff.

In many cases FTDI chips will have been used as they are highly regarded over their counterparts (I've specified them on my designs in the past for this reason). I won't be using them in my new designs as a result of this action.

[Anonymous Coward]

Re: Very dumb idea

What's more: you pick up a peripheral off the shelf and tell me what USB serial chip is in it.

I've got a couple that are Prolific PL-2303 compatibles (one IBM branded, one ATEN), both work fine in Windows XP and Linux, neither work in MacOS X. The USB serial chip in my Kenwood TH-D72A is a Silicon Labs device, and I'm starting to see more of these.

Nowhere on the packaging or documentation does it state what chip is in use, and nor would this information mean anything to most end users.

Sorry FTDI: I understand you have to earn a living and that developing drivers costs money, but tampering with other peoples devices to prevent them from working in the way they were originally intended (whether reversible or not), is simply not on.

[Anonymous Coward]

Re: Very dumb idea

Nowhere on the packaging or documentation does it state what chip is in use, and nor would this information mean anything to most end users

[…]

10 thumbs up & 8 thumbs down

A pop quiz for the 8 downvoters: Here are some USB-serial adaptors on sale.

Can anyone one of those 8 downvoters care to tell me:

- what chipset each one uses and

- whether the chipset is genuine

If you cannot answer either of these two questions, how can you make a valid decision on whether to purchase that device?

[Anonymous Coward]

Re: Very dumb idea

So FTDI gets no money for the parts so they say "you are not using our VID/PID and our drivers" for free and they are the bad guys?

>In many cases FTDI chips will have been used as they are highly regarded over their counterparts

Maybe they don't want that reputation to be spoiled by fakes?

[Doctor Syntax]

Re: Very dumb idea

"Maybe they don't want that reputation to be spoiled by fakes?"

They don't need fakes to do that. They're doing it themselves.

They've engineered a situation in which any device which claims to contain their chip could be a fake which will be bricked. Getting bricked or not seems to be the only test available to the user to determine the good from the bad. That's not a test which will appeal to the user so the safest thing for anyone who's in a position to check what their device claims to contain will simply avoid it if it claims to be theirs.

It matters not that this is reversible if you download some tool from their site (remember that's the site of a manufacturer who has just bricked your gadget) and then find something else on which to run that tool (because unless you've been able to back out the new driver there's no point). All the average punter is going to see is a bricked device. And if it came to court that's more than likely that that's how the jurors would see it.

Then there's Microsoft's POV. How will they react? If the driver is distributed via their upgrade users are likely to consider them responsible. Surely they're going to have to come down on this like a ton of bricks, replace the driver with the old one, probably issue a tool to fix bricked devices, give FTDI a stern talking to and forbid this sort of thing as part of the T&Cs of getting drivers distributed by them.

[Anonymous Coward]

Re: Very dumb idea

So FTDI gets no money for the parts so they say "you are not using our VID/PID and our drivers" for free and they are the bad guys?

They are if they put out a driver that bricks the device. It's one thing to put out a driver that pop's up a message about a counterfeit device and refuses to work: the person will either roll the driver back or seek assistance to get the driver rolled back, but they at least know that something isn't right. If the device was recently purchased, it would be a prompt to go and see the supplier.

What is proposed here, is that the driver makes a change to the device that prevents the device from operating on any system. A reversible change, true, but a change nonetheless. This device does not belong to FTDI, thus FTDI have no permission to make any alterations to the device whatsoever.

The only thing in FTDI's power, is to refuse to acknowledge the device.

[JP19]

Re: Very dumb idea

"What is proposed here, is that the driver makes a change to the device that prevents the device from operating on any system."

If you don't want someone else's driver making changes to your device then don't program your device with VID/PID which requests that driver to be loaded. Not exactly rocket science is it.

[ender]

Re: Very dumb idea

> This device does not belong to FTDI, thus FTDI have no permission to make any alterations to the device whatsoever.

Exactly. It's not a FTDI device, so why should it work with any FTDI driver?

[Anonymous Coward]

Re: Very dumb idea

This device does not belong to FTDI, thus FTDI have no permission to make any alterations to the device whatsoever.

Exactly. It's not a FTDI device, so why should it work with any FTDI driver?

Exactly. It's not a FTDI device, so why should any FTDI driver send any commands to it?

[Adrian 4]

Re: Very dumb idea

But it claims to be an FTDI device (VID/PID).

So why shouldn't FTDI send commands to it that would be harmless to an FTDI device ?

[ender]

Re: Very dumb idea

> Exactly. It's not a FTDI device, so why should any FTDI driver send any commands to it?

Because it pretends to be one. And as marcan points out, the driver doesn't discriminate between genuine and counterfeit devices - it sends the same commands to both, but they have no effect on the genuine part.

[Alan Brown]

Re: Very dumb idea

"So FTDI gets no money for the parts so they say "you are not using our VID/PID and our drivers" for free and they are the bad guys?"

If FTDI popped up a message saying the chip was a fake and refused to run, or operated only at 1200bps 8/N/1 then that would be OK.

The moment they deliberately rewrite the VID/PID without a court order, they're into illegal destruction of 3rd party hardware (You can argue the finer points of them being reprogrammable, but for the end user the device is dead)

You can't just arbitrarily trash devices for fake parts even if your intellectual property is being compromised, there are procedures in place to deal with this kind of thing happening.

It's also important to note the fake VID/PID are NOT a clone device. They're an independently designed workalike using completely different silicon. The IP violations come from FDTI labels on the front (most don't have this, by all accounts) and using a FTDI assigned VID/PID.

This can and will blow up in FDTI's face. They can't justify the action using their driver contract - this was installed by Windows update and the message wasn't seen, plus the laws about Unfair terms in consumer contracts are applicable in most cases.

[JeffyPoooh]

Re: Very dumb idea

AB: "The IP violations come from FDTI labels on the front (most don't have this, by all accounts) and using a FTDI assigned VID/PID."

Which legislation protects VIDs and PIDs?

[Fatman]

Re: Maybe they don't want that reputation to be spoiled by fakes?

Like the way high end watches, fashion apparel, perfume and jewelry manufacturers go after the cheap "knock offs"?

I recall once seeing a photo of a steam roller being used to flatten a bunch of fake Rolexes. (OH, wait, I found it: http://newslite.tv/2010/04/28/7000-fake-rolex-watches-crushe.html )

[Clark Griswold]

Re: Very dumb idea

"I would be willing to bet there will be bona-fide product out there that some enterprising Chinese contract manufacturer has thought "I can save some money using these "local" FTDI chips". The company with responsibility for the product will have no option but to ship them back and replace the IC's - and this may not even be economical if the products have been potted or coated for harsh environment."

In my opinion thats the intended outcome. Of course it would not be economical, if it was economical you would be encouraging this behaviour. The next time the company is selecting a Chinese contract manufacturer they will be more careful to select one that is not as "enterprising" as you generously put it and may also want to review their contract terms. Also lets call a spade a spade and replace the word local with counterfeit, the contract manufacturer has not been duped here, they know what they were doing.

"A pop-up message alerting the end-user to the status of their kit - or at the very least, if you brick the devices from working with the mainline driver, provide as a good-will gesture a driver which does work, but makes the user very aware they are using a knockoff."

A good-will driver here is not appropriate as it once again encourages this type of behaviour. The end user has purchased a counterfeit device or a device with counterfeit components, if it works and it was cheaper wouldnt you keep this in mind the next time you make a purchase?

The user is unlikely to have purchased a counterfeit product knowingly, I agree a popup message as you said is a good idea. Ideally the message should say: "This device is using the wrong manufacturer ID, as the correct manufacturer is unknown it has been changed to 0 and here is a website ww... with instructions as to how to change this yourself to the correct ID once known. Please contact the supplier for more information"

"In many cases FTDI chips will have been used as they are highly regarded over their counterparts (I've specified them on my designs in the past for this reason). I won't be using them in my new designs as a result of this action."

Why? The end user has not been given what they paid for, they have been sold a counterfeit product instead of one with FTDI chips which as you put it are highly regarded. ***The place where the end user purchased the device needs to replace or refund the end user!!***. The seller needs to go back to the supplier. The supplier needs to go back to the manufacturer. The manufacturer needs to show due dilligence when using contract manufacturers. This type of behaviour would quickly weed out counterfeit parts from the supply chain which would benefit everyone. Well maybe not that particular enterprising contract manufacturer..

[Anonymous Coward]

Re: Very dumb idea

So I worked in supply chain for one of the top CMs in the world. We had vigorous checks and balances to ensure that no counterfeit parts made it onto our boards. Integrated circuits were pretty uniformly part of the "locked BOM" where no substitutions can be made. If a company ends up with counterfeit ICs on their boards, it is because they specified counterfeit ICs. They get what they deserve.

I was at another company that made USB to 1284 smart cables to enable USB printing. Our CM at the time was one of the largest and still is. You would recognize their name. We found out that they were using our manufacturing software to build for a competitor. So we sent them an update of the manufacturing software with a time bomb in it, and tooled up at another CM. When the new software blew up, it put our competitor lines down for 6 months. Cheaters should be punished whenever possible.

[RAMChYLD]

Never trust Windows Updates for drivers

Have been bitten twice:

NVidia: One update pushed drivers that results in "device stopped working but has recovered" errors and freezing. Traced this down to the motherboard chipset (NVidia NForce, no less) having a dodgy Message Signaled Interrupt implementation which the later drivers tried to enable. Rolled back to the legacy 314.22 and had not have any issues, and sat it out until later drivers who detect the motherboard chipset type and not enable MSI if the chipset is on the list. And even then I'm still extremely reluctant to upgrade.

SoundBlaster X-Fi: One update driver caused volume to be stuck at maximum and horrible sound distortions.

And this is why I don't let Windows Update handle driver updates anymore.

[JeffyPoooh]

Re: Never trust Windows Updates for drivers

RAM... "twice" ?

Twice? Like, in your whole life?

You need to buy more gadgets.

[msknight]

Hope they've got deep pockets

This is malicious damage, clone chips in use or not, and I hope they've got deep pockets because I think people are going to be coming for them.

[Anonymous Coward]

Get a grip people...

They are counterfeit products and should be removed from the market. Any customer who's affected should demand a refund and/or report the fake to their local trading standards body.

The people producing these fakes are costing the designers of the devices millions of dollars and some fakes are causing serious failures in high-reliability devices (think medical, avionics, automotive, rail, etc.).

Even the big distributors are finding it hard to identify the fakes as the can often only be identified by destructive inspection once they have been injected into the supply chains.

It's just a matter of time before fakes lead to loss of life or a major incident. I know someone will come back with something like "but it's just being used to connect my iThingy to...", but that's not the only market these fakes end up in.

[Anonymous Coward]

Re: Get a grip people...

I agree that it would be good to get poorly-performing stuff that misrepresents itself as a well-trusted part out of the market, but given the level at which these counterfeit parts live (several layers below the people who put their label on the box) then it's a lot easier said than done.

Causing a work->doesn't work regression is not acceptable, as explained frequently by Linus every new kernel release.

[Mage]

So Wrong

What if the device ISN'T a fake, but the FTDI programmers make a mistake? (Cue FTDI getting sued)

Are they ONLY looking at USB ID? What if it starts disabling real FTDI IDs due to a bug?

This is arrogant unacceptable behaviour. At the most their driver should simply not operate non-FTDI hardware. It's immoral of them to change the ID.

If they have a problem with vendors allegedly doing fakes they need to

a) Prove the copies are illegal. Not all kinds of functional copies are illegal

b) Use due process of law.

[Anonymous Coward]

Re: So Wrong

>What if the device ISN'T a fake, but the FTDI programmers make a mistake?

The real FTDI devices probably have a few undocumented registers, timing differences etc.

>What if it's a very good fake (the approach won't brick it).

There's not enough margin in producing the fakes to make it worth getting the timing 100% spot on or taking apart real chips to work out what hidden features there are. Most likely they have taken the Linux driver and written some code for a cheap micro that implements a compatible protocol.

>This is arrogant unacceptable behaviour.

>At the most their driver should simply not operate non-FTDI hardware.

>It's immoral of them to change the ID.

Changing the ID ensures that the device doesn't get registered with the driver again. Changing the ID or blocking in the driver results in the same thing: The user plugs in the USB connector and it fails to register. For those say "They should have pop ups about it being fake!!!" - Is that even possible from a driver? Changing the ID doesn't break whatever is connected to the RX/TX lines on the FT232 and for most products that use these chips the thing on the end of those lines is the important part.

>a) Prove the copies are illegal. Not all kinds of functional copies are illegal

The copies have the FTDI logo on them which is a trademark. There is nothing wrong with them implementing a compatible protocol (you have to wonder why anyone would do that when you could implement a USB class device instead..) but you aren't allowed to use device with FTDI's VID/PID or their drivers.

>b) Use due process of law.

This is changing a setting in the device. It's not making the device blow up or wiping your hard drive. Stop being babies.

[Dr. Mouse]

Re: So Wrong

This is changing a setting in the device. It's not making the device blow up or wiping your hard drive. Stop being babies.

As so many have pointed out, to the average user it amounts to the same thing. All they are going to see is that their device suddenly stops working.

I can see why FTDI are clamping down. The drivers they supply are supposed to be for development use only. If their chips are to be distributed in a product, they should be getting their own IDs, assigning them to the chip, and paying for a licensed copy of the drivers with the correct IDs. This is even for original FTDI chips.

However, I feel they have gone the wrong way on this. They could have implemented this using a softer approach. For example, they could allocate one of their IDs as "Fake FTDI-compatible device", allowed the device to be used, but made it irritating (e.g. adding unreliable long term operation, frequent windows error log events, etc). This would not brick a consumer device, but would ensure the user knows they are using a fake. Possibly make the driver go into a "time limitted demo" mode. They could also ask the user to report the device, with possible discounts on equivalent originals if they do.

They way they have gone about this is, essentially, destruction of property (from the average user's point of view).

[beanbasher]

I Still Call Shill

UK law Misuse of computers act says you can't mess up someones computer like this end of story. If they have a problem then they need to flash a message saying the USB is a knock off and refuse to install the driver. Breaking someones computer like this is just so wrong.

[Paul Smith]

Odd reactions

I don't get all the comments about unacceptable behaviour and malicious damage and so on. Why is it that you expect FTDI to play nice with components it can positively identify as fakes? That the end user might not have known it was a fake isn't really relevant as if they were dupped, they can demand recourse from the seller, and if they knowingly bought a cheap knock-off, then they shouldn't be too surprised if it stops working.

Don't get me wrong, I don't like what FTDI did, but I am surprised that no one has done it before.

[Anonymous Coward]

Re: Odd reactions

> I don't like what FTDI did, but I am surprised that no one has done it before.

- BluRay players will brick themselves if you insert a BluRay with a new revocation list on it and the key on your player happens to be in the list.

- Something more EE related. Segger (Producers of JTAG pods for debugging, testing etc) has put stuff in firmware updates that stops clones from working with their official tools for ages.

[Radbruch1929]

Re: Odd reactions

That might be because they interfere with an object that somebody else owns and it is rather questionable that the user/owner is responsible for the piracy.

An earlier AC suggested that FTDI "owned" the USB ID. I doubt that: You can not "own" a number under copyright law. It is not a trademark because it is usually not discernible by the human senses. It does not fall under patent law because it is not an invention. It may be contrary to passing off laws to use a fake USB ID but those do not affect the user because he is not passing off the device.

Bottom line: IMHO modifying the user's property may be legally risky under the Computer Misuse Act.

And that also affects other anti-piracy efforts which are reasonable i.e. to keep defective products from the market: The good intention is tainted by the execution with a somewhat questionable act. If they just wanted to end the support for fake devices, having their driver stop working with the fake devices and showing a message would have been enough.

[Alan Brown]

Re: Odd reactions

"Why is it that you expect FTDI to play nice with components it can positively identify as fakes? "

Tort law for starters.

They can refuse to operate with the device, but to deliberately reprogram the device so it can't work AT ALL cross the line from legal to illegal behaviour.

A representative of Rolex can't take a fake Rolex off a customer's wrist and smash it on the ground without a court order and Gucci can't go around spraypainting fake handbags on the street. Doing either would land the perpetrators with jailtime.

[M Gale]

Re: Odd reactions

Don't get me wrong, I don't like what FTDI did, but I am surprised that no one has done it before.

Sony BMG.

It didn't work out so well.

[Martin-73]

Re: Odd reactions

Stopping something working without modifying code on the device=legal

Stopping it working by modifying code on the device=not legal.

Ref, as stated MANY times above, Misuse of computers act.

[Aidan242]

Why not generic CDC?

One thing that people don't seem to have picked up on is that it's fairly easy to implement a generic USB CDC device that would work under Windows/Linux/OSX/Android/BlackBerry/(insert OS of choice). Why go to the trouble of explicit compatibility with FTDI chips with all the trouble of reverse engineering them?

[Anonymous Coward]

Re: Why not generic CDC?

Two reason:

1) FTDI are consider a "premium" brand so they are easy to sell, especially when they're offered at what seems to be a real discount.

2) The don't have to worry about supporting the device drivers.

[Fihart]

This is a bit like chipped batteries and refills.

Panasonic (Lumix) and the inkjet manufacturers started this kind of nonsense, fed up with people buying cheap substitutes for overpriced replacement batteries and refills.

Rather than penalise consumers for doing what retailers lead them to do (i.e. look for the apparent best buy) the manufacturers should have gone after the makers of fake refills and batteries using trademark and IP law.

But of course that takes time and money.

[Anonymous Coward]

Re: This is a bit like chipped batteries and refills.

>gone after the makers of fake refills and batteries using trademark and IP law.

So they have two options:

A: Chase tons of grey market operations around China while getting laughed at by the Chinese authorities.

B: Get an intern to work on a solution that uses a $0.01 chip to block most of the unofficial consumables and requires a lot more effort from those that persist to use refills etc.

Which makes more sense to you?

[Martin-73]

Re: This is a bit like chipped batteries and refills.

Option A, as option B is illegal.

[Haku]

Such a dick move.

Do they even have the right to destroy your hardware, wether you know the device you have contains a fake chip or not?

I thought FTDI were a reputable company that produced reliable hardware & software solutions, especially their USB-TTL/RS232 chips, but this is such a dick move, people who have heard of or experienced first hand what they did won't want to trust them again.

If you're in the market for a device that uses hardware of a type that FTDI manufacture, how can you be 100% sure it doesn't contain a fake FTDI chip before you hand over your money?

[Anonymous Coward]

Re: Such a dick move.

>Do they even have the right to destroy your hardware

FFS.

- They aren't destroying any hardware.

- They are changing a setting in an EEPROM. You can change it back.

- They have a tool that allows one to change the settings on their chips which you can use to put it back.

[Doctor Syntax]

Re: Such a dick move.

"FFS.

- They aren't destroying any hardware.

- They are changing a setting in an EEPROM. You can change it back.

- They have a tool that allows one to change the settings on their chips which you can use to put it back."

If this comes to court I look forward to your giving expert testimony to try to persuade a jury of that.

[Richard 12]

Re: Such a dick move.

So it would also be fine if it moved the contents of your Windows folder or wiped the boot sector of your hard disk so your computer could not boot?

Those are just settings, you can put them back.

Sorry, but this is on very legally dodgy ground, and there is certainly an argument that it may fall foul of the Computer Misuse Act.

Hope they have good lawyers, they are likely to need them.

Had they simply prevented their driver from working with 3rd party devices, that would be fine. The moment they decided to actively damage those 3rd party devices, that is when they crossed the line.

[Moeluk]

One group of people are about to have a pretty big problem...

One group of people without the technical expertise (in computing anyway), are going to have a massive shock...people with USB to OBDII cables that they bought on ebay, and use to interrogate and change their cars ECU's, AKA pretty much every independent garage in the country ever..

This is going to come as a bit of a shock to them, and they won't be very happy, when they discover they can't reset warning lights etc....

They won't sue, they'll get a geek to sort it all out, but seriously...wtf? That's Shady FTDI...tres shady!

[Anonymous Coward]

Re: One group of people are about to have a pretty big problem...

Similar problem here…

I'm in Brisbane Area WICEN (Wireless Institute Civil Emergency Network for those not familiar with the group) who do emergency communications for various community events. (In the UK there's an equivalent: RAYNET, and in the US: ARES)

One of those is the International Rally of Queensland, where we use packet radio with TNCs (terminal node controllers: modems basically). Most of us use Kantronics KPC3 TNCs which as typical of early 90's equipment, are RS-232 based.

Some of us have laptops that have on-board RS-232 but most use USB-serial converters.

Many in the group are electronically savvy, but not computer savvy. They might be good with antennas, many service their own equipment, and most know their way around a computer enough to get themselves out of trouble, but are not experts in computing.

I can see this being a major pain in the arse: as I pointed out above. Try picking up a piece of kit off the shelf at a shop, and tell me:

(1) what USB-serial device is in use and

(2) whether it's a genuine one.

About the only way I've found to find out about (1) is to download the driver from the shop's website (if it links to one) and go digging around in the various files for clues.

Price is not an indicator: The fakes can jack their prices up just as easily as anyone else. The same company can sell a "cheap" cable using knock-off ICs in one shop, and an "expensive" cable using the same chip, and people would be none the wiser.

Then there's the problem of USB-serial devices embedded in other equipment, which we get no say over and can do nothing about.

Return it to place of purchase you say? Good luck sending something back when it was bought from some eBay seller with a disposable account who has long since ditched their account and old contact details. Or explaining the problem to the dolly bird behind the counter at the Dick Smiths/Tandy/BestBuy/PCWorld/whatever store you bought it from.

This of course assumes you own the device: What if you're borrowing it? How do you explain a bricked device to them?

As to FTDI: I feel for them, but this is not the way. Refusing to operate with the device concerned would be better. Yes, the device stops working on their computer, but when it works on someone else's with an older driver, they can investigate and find a work-around to the problem.

Reputable suppliers would hear complaints and perhaps organise/issue a suitable driver for their counterfeit device: problem solved.

By making the device (temporarily) inoperable on all computers though, this is just going to fuel resentment which will work against FTDI.

[Anonymous Coward]

Lets hope none of these made their way into critical embedded systems eh.

[Dr. Mouse]

If they are in critical embedded systems, they won't shouldn't have Windows Updates automatically installed (at least not directly from MS). They should be thoroughly tested before being applied. If not, they have noone to blame but themselves.

Although IMHO a critical embedded system should not have Windows installed full stop.

[Richard_L]

> Lets hope none of these made their way into critical embedded systems eh.

Fake FTDI chips in critical embedded systems is the least of your problems, it's going to be a worry for many more common components that go into a critical systems. Fake power transistors, fake voltage regulators, fake op-amps, fake capacitors... you name it... it's a potential danger for all of them.

The difference here is that the component being faked here is complex enough for FTDI to have an option other than sending expensive lawyers round China on a stand-up comedy tour about fraud and protecting IP.

Whether it's a western company deliberately buying surprisingly cheap reels of components from cheaparsechinesechips.com rather than the official distributor in order to shave 10% off the BOM, or their Chinese PCB manufacturer doing the same behind the designer's back in order to increase their profit margin on a production run, I hope the effect of this is to shake up lax supply chain management in companies who have either deliberately or inadvertently let fake components find their way into their products.

[Alan Brown]

"Whether it's a western company deliberately buying surprisingly cheap reels of components from cheaparsechinesechips.com rather than the official distributor in order to shave 10% off the BOM"

Analysis of FDTI and workalike serial devices shows they have about the same fabrication cost. It's not unusual for fakes to get into production lines with _no_ change in price.

This isn't much different to the situation with ELM327 chips and ELM have studiously avoided anything which goes near this kind of behaviour (They just identify the device as fake and treat them as an old chip revision which is slower/much less capable than more recent devices)

[HorseflySteve]

Not the same at all

The ELM327 situation is somewhat different.

They used a Microchip midrange PIC to implement the early ones. It would appear that they forgot to set the firmware code eeprom protection bits to prevent the code from being read out in some production devices. Someeone discovered that, downloaded the firmeware & started programming their own identical PICs with it.

There is no way that ELM can tell the difference between the genuine ELM327 of that version and a cloned one as it they have identical firmware.

They also don't reflash that version...

[JeffyPoooh]

Fake

"Fake power transistors, fake voltage regulators, fake op-amps, fake capacitors... you name it..."

Define "Fake". E.g. What's a "fake" 2N2222A?

If you think you have an easy answer, then you're simply wrong.

Back in the 1970s, even the big USA semiconductor manufacturers were all building work-alike clones of each others' IC products. It was legal then, and it's mostly legal now.

[HorseflySteve]

Re: Fake

If they made a 2N2222A and left it either unbranded or put their own brand on it, it is legal, if they put somebody else's brand on it, it is a fake.

What makes it a fake is false branding.

If I made a watch that looked like a Rolex but didn't claim to be one, I'd probably be ok but, if it said Rolex (or something very similar, like Bollex) on it, I'd be in trouble..

[David Roberts]

Woolly thinking

Far too many posts saying that this is wrong, then offering alternatives that are as bad and sometimes worse.

As far as I can see, they have decided that their drivers will no longer support fake chips.

They have decided to mark chips that have been identified as fake by flipping a value.

This prevents the devices being walked around other systems with confusing results depending on the age of the driver, or re-enabled by rolling back the driver.

This effectively retro-fits a new feature to older drivers.

So, two choices:

(1) They are entitled to refuse to support counterfeit chips with their drivers.

(2) They are legally obliged to support counterfeit chips because "somebody bought them" . In which case, legal precedent please.

The main point is that they should publicise what they are doing (going well so far) and also produce some kind of meaningful error message (where possible) to inform the end user that the device has been disabled, and why.

As has been pointed out several times already, it is possible to re-set the value and then use older drivers.

However to go down this route the end user has to do enough research to know why the device has been disabled and to apply software fixes to continue to use known fake hardware.

Hopefully there will be a rash of returns which will get manufacturers to check the source of their components (for example by testing against this new driver) before shipping them out to the unsuspecting (or perhaps aware because of the low price) customer.

So FTDI are not bricking anything, they are just marking it so that their drivers will no longer support it.

Complaints about fake hardware should be directed up the supply chain.

[Richard 12]

Re: Woolly thinking

I think they are well within their rights to refuse to support 3rd party devices with their driver.

However, they have decided to also actively damage those 3rd party devices, making them unusable without special tools.

That second action is the problem.

[Alan J. Wylie]

And now causing amusement on the Linux Kernel Mailing List

http://thread.gmane.org/gmane.linux.usb.general/116767

From: Russ Dill

This patch provides the FTDI genuine product verification steps

as contained within the new 2.12.00 official release. It ensures

that counterfeiters don't exploit engineering investment made

by FTDI. Counterfeit ICs are destroying innovation in the

industry.

+ /* Attempt to set Vendor ID to 0 */

+ eeprom_data[1] = 0;

+

+ /* Calculate new checksum to avoid bricking devices */

+ checksum = ftdi_checksum(eeprom_data, eeprom_size);

+

+ /* Verify EEPROM programming behavior/nonbehavior */

+ write_eeprom(port, 1, 0);

+ write_eeprom(port, eeprom_size - 1, checksum);

[Anonymous Coward]

Re: And now causing amusement on the Linux Kernel Mailing List

I think it's apt for Greg K-H to be the first to reply considering he's the guy people use to get their bad patches into the kernel.

[Nifty]

life support?

There was a recent story about knock-off dental equipment, e.g. drills and x-ray machinery, reaching UK shores and eventually the practices of unwitting (or maybe not) dentists.

So in a similar vein, how much hospital life support machinery might just happen to have one of these knock-off chips, soon to be bricked, in it's gubbins?

[David Roberts]

Re: life support?

Yeah, right.

All the life support systems are connected to the Internet and are updated ever Patch Tuesday.

[no-one in particular]

Re: life support?

It isn't the life supoprt - or other embedded - kit that gets updated. It is the laptop that is updated, the laptop that is plugged into the USB port to pull a log...

[Anonymous Coward]

Re: life support?

Or the desktop the said life support kit gets plugged into for maintenance when the kit gets serviced.

[melts]

Re: life support?

aaaaand...

they plug it in and they can't download said logs.

kit is otherwise unaffected.

that is the scope of these changes.

yes its annoying, but far better than having the counterfeit goods seized, they provide a tool to flip the bit back.

i wonder if people would be so up in arms if they tried to use a feature of their chips that clones didn't do properly and it did cause physical destruction - like say an instruction that the clone chip gets stuck on, draws too much current, cooks another interface.. would you be up in arms that FTDI didn't do something to flag these chips. I wonder

everyone likes to blame other people, but the fact is counterfeit goods are always punter loses. you have to seek redress from the seller. all the important things people have said this chip might be in will have sellers standing behind them. yea some stuff from ebay etc will be affected, but you'll either follow instructions and fix it or move on. if i had licensed a VID i wouldn't want others to be using it, or piggybacking my drivers from illegally using the VID. Not sure why so many think punters should be able to benefit from it, do you tell the cops you didn't know you were speeding too?

(and now i feel dirty for saying that, as i hate the police focus on speed and generally think in things civil, companies should be on their own dealing with it, but this is that isn't it.

[David Goadby]

Why Microsoft?

I fully appreciate the wrights and wrongs of this case and I see why FTDI would like to protect their IP but, who elected Microsoft to do device driver policing? What other devices will be bricked next - mice, bit-pads, multimeters, Arduino links, micro-chip emulators etc etc?

I wonder how many innocent users will be returning equipment to shops and suppliers as faulty? A real can of worms has just been opened and FTDI will not reap the benefits of it at all.

At least Linux users aren't affected. (Linux 1, Windoze 0).

We have been using FTDI for a long time and I do wonder why this has just surfaced now.

[tonybarry]

I have specified FTDI chips for over 10 years, since the first FT245 (USB<->parallel) came around with offerings from DLPdesign and Gigatechnology.

This renegade driver means I won't be specifying them any more.

While it may possibly be appropriate for FTDI's software to refuse to drive a module they did not author, it is not appropriate for them to render it inert.

Looks like the SiLab may be the necessary alternative, as the Prolific PL2303 driver will reliably reset MacOS if the device is removed while the serial connection is still active, and that really hacks me off.

Regards,

Tony Barry

[Anonymous Coward]

Silabs also have parts with OTP config ROMs...

[Dan Paul]

@Tonybarry (over reacting ignorant moron)

It is completely approporiate to prevent counterfeit kit from being used.

If you don't want this to happen, don't buy unusually cheap counterfeit chips from strange sources.

FDTI did this to assure that VALID chips do not get confused with counterfeits.

You couldn't possibly be more wrong in calling this a "renegade" driver.

FDTI only have a responsibility to provide working drivers for THEIR products.

Scum sucking rip off artists and any product they make, be damned!

ANYONE who takes their side need to be shunned too!

Including certain developers that might be behind the counterfeits?

[Anonymous Coward]

Re: @Tonybarry (over reacting ignorant moron)

FDTI did this to assure that VALID chips do not get confused with counterfeits.

And of course, people never make mistakes in their detection code…

[Martin-73]

Re: @Tonybarry (over reacting ignorant moron)

So Tonybarry makes a perfectly reasonable decision not to specify chips from a company which has BROKEN THE LAW, and you call him a moron?

Pot, kettle.

[Anonymous Coward]

Windows Genuine Advantage, FTDI-style

What could possibly go wrong?

And when will it go wrong? Where I work, there's lots of kit uses USB->232/422 etc adapters. The adapters are mostly bought in. The "PCs" in question are "secure" embedded boxes which don't routinely connect to the Internet (so no routine Windows updates). So the driver updates in question may not be visible for some time, by which time all this fuss may have been lost in the mists of time (no one in modern IT remembers further than 6 months ago, do they?)

Fun like this is one of the challenges of offshoring manufacturing to China, as has already been mentioned. There are often similar facilities in the UK if you're not willing to take the risk.

[banjomike]

All FTDI needed to do...

was have their drivers ignore the 'illegal' kit, not brick it. BUT they would not have got all this free publicity.

[ender]

Re: All FTDI needed to do...

The driver update ensures that the official FTDI drivers (current and old) will ignore counterfeit devices. It's quire easy to modify the drivers to keep working with those devices (they're not bricked, they just don't pretend anymore that they're something they aren't), but such drivers aren't official anymore, and anybody using them should know that they do it at their own risk.

[cortland]

Re: All FTDI needed to do...

They would not have got all this BAD publicity...

[Terje]

While I don't condone counterfeit components or any such, I wonder how FTDI was thinking here as there is no way that this will be good for them.

Reasons.

The fake chips are supposedly "very good" and virtually impossible to identify.

Assuming these chips for any reason end up in the supply chain they can potentially float around the world many times before finally ending up in a product, thus even your reputable local contract manufacturer may end up with a batch of dodgy chips for no fault of there own.

If you are using / planning on using a FTDI chip today and have the ability to swap would you bet that you will never get a dodgy chip in your product and go with them or replace it with something from a company that don't have a history of bricking stuff causing your company major expenses, loss of goodwill and perceived reliability among its customers.

If I were in those shoes they would be out as fast as I could change to something else.

[Alan Brown]

"If you are using / planning on using a FTDI chip today and have the ability to swap "

Underscoring that, there are at least a couple of legal devices which are pin-compatible with the FTDIs, so the only change needed is to the driver and the BOM.

[DiBosco]

I'm not sure I'd agree with that. Having worked for a major component distributor, I know that they wouldn't buy grey market stuff of parts of one of thier official suppliers. With that in mind, as long as you buy from an official supplier you won't have a problem with supply and you know your product will always work just fine.

I think FTDI are problably in a difficult situation in that if their driver didn't actually alter the counterfeit product, but did stop it from working, it seems that people would still end up with the same situation. ie Their product no longer worked. Then again, why should FTDI allow the market to be flooded with counterfeit parts?

You could argue that they could roll back to older drivers if they didn't change the EEPROM, but then again, you can use the FTDI tool to change the part's EEPROM value back. I honestly don't know what's harder as I stopped using Windows years ago and can't remember how hard it is to find and install drivers. From FTDI's persepctive, at least this has brought a big issue to light.

As far as the legal standpoint is concerned, you'd have thought that they would have consulted lawyers about whether or not it was legal. There's lots of opinions stating catagorically one way or another that what they have done is legal or not, but I'm assuming no-one really knows. It would seem that Apple has done essentially the same thing previously and it didn't cause them an issue, so why would it affect FTDI? (Honest question, I am no lawyer so there could be a good reason why this is different.)

As for changing to other suppliers, who's to say exactly the same thing won't happen there? I'd bet that in a few weeks this'll be forgotten about. People like Arduino will have to replace a load of boards with counterfeit parts and hopefully learn a lesson in legitimate sourcing. Maybe FTDI will look back on it and learn a lesson if the publicity does affect them, but I'd be fairly surprised if any major manufacturers changed from FTDI because of this.

[Richard 12]

Switching drivers under Windows 7 is easy.

Switching drivers under Windows 8.1 is harder if they aren't MS-signed, but not by much.

[ender]

The driver doesn't need to have Microsoft's signature - it just needs to be signed with a certificate that supports with kernel-mode codesigning (which you can get from several CAs).

[Anonymous Coward]

Buyer beware. As always.

Did anyone buy a Lightning cable for their iPhone 5 before accessory verification was turned on? That stopped leads working. It effectively bricked them (it seems on this thread you can "brick" a lead).

If a manufacturer has used my vendor ID and I then try to perform a routine firmware update to my device (OK, it's an update to check it *IS* a device I designed), then I see no problem. If the device isn't as good a clone as the scumbag cloner thought it was then, oops - they're off to buy another cable (I don't care if it's not my one - they were never a customer of mine anyway).

If, as a vendor, I try to use the device identified as my own in a way I know should work, but the device doesn't respond correctly, then it's defective and it's for the best for the end-user that the device is taken out of action - you just can't trust what it's doing with my drivers and someone else's hardware. You should speak to the person that sold you it, and then the manufacturer, to get them to fix it. If it comes back to me, I'll happily deal with it...

Didn't Apple stop Palm from using the Apple USB vendor IDs to make one of their smartphones sync in iTunes? It seems that there is some prior experience of whether vendor IDs is acceptable... What about if you bought an illegal knock-off copy of Windows? I think Microsoft effectively stopped that working too and you had to pay again.

Chips are not cheap things to produce - getting the design correct, then building a good quality driver and getting the brand reputation to a place where you can sell them in volume to recoup your investment all costs money. The Prolific RS232 adapters are crap and, as noted, don't work well with Macs - I don't care if you *thought* the money went to the right place, if it didn't, that's not the manufacturer's problem.

Next time, in exactly the same way as if you were stung by Microsoft's anti-piracy measures, you'll be more careful about where you buy it.

[JeffyPoooh]

Re: Buyer beware. As always.

AC: "Next time, in exactly the same way as if you were stung by Microsoft's anti-piracy measures, you'll be more careful about where you buy it."

That's a deeply ignorant comment. Counterfeit MS products can appear everywhere and anywhere. If you're looking for a genuine copy of (for a carefully chosen example) Windows 7 Professional, MS isn't selling any. So one is left trying to sort the wheat from the chaff from other vendors. A reassuringly expensive price is not a perfect filter; it might be a scam trick.

Blaming the customer for buying from the "wrong" vendor is just daft nonsense. Garbage comment. Simply ignorant.

[Anonymous Coward]

Re: Buyer beware. As always.

The customer is hardly always correct. But Caveat Emptor! No Microsoft may not be promoting Windows 7 Professional but NEWEGG and other valid is, I just bought an OEM copy a month ago.

Counterfeit products are usually shit anyway, and FTDI is probably helping by preventing crap from being used. . If it's too cheap it's probably a fake and you got exactly what you did not pay for

If you are too stupid to know better and you don't buy from authorized sources then you know (or should know) you just bought crap. You OBVIOUSLY have more potential to get fakes if you buy from some clown online that works out of stall in Shenzen than a recognized distributor.

[Anonymous Coward]

RE. Re: Buyer beware. As always.

Was given a netbook with a dodgy copy of 7 Home Premium on it because when I tried to reinstall the correct (basic) OS it refused to work even with a pressed disk.

HP want more than it is worth for a rebuild USB stick, so my only recourse as a consumer is to go through a convoluted rebuild process involving a second similar laptop and swap over drives on reboot.

FTDI may have acted to ruin the counterfeiters day but it has had massive repercussions such as bricking *MY* hardware which I paid good money for.

Multiply this by the number of people using Fakeduino to save a few pounds and this becomes a serious problem.

I also heard rumors that a certain brand of laser scanner used in a very large supermarket chain has been affected by this, not saying which due to hungry hungry lawyers but it has crippled a lot of their POS systems.

[Version 1.0]

Raise your hand if you want fake chips.

It's a hardarse approach to the problem but having, some 15 years ago, kissed about $50k away because we bought a batch of fake analog chips that completely failed to work in-spec (cost of troubleshooting the problem, then buying and reworking/fitting replacements) I have some sympathy with them.

Sourcing components is a nightmare because the market is awash in fakes - Google AD 286J and you'll see what I mean, it's a chopper amp that Analog Devices stopped making years ago but there are dozens of Chinese "sources" for it. In fact, Google almost any chip these days and you'll get pages of sources, almost all of them fake.

[poopypants]

Interesting coincidence: yesterday I read an impassioned plea from someone seeking help to recover 15 months of research work from his USB external sealed hard drive, which Windows had stopped recognising. Yes, he should have backed it up, but if that was the result of his hard drive manufacturer using fake components, I fail to see how punishing the victim is going to help anyone, or indeed punish anyone apart from the victim.

This reminds me of a briefly popular tactic of erasing the hard drives of people who ran pirated software. That did not end well. I imagine there will be a similar outcome here.

[Anonymous Coward]

If there's an external hard drive that contains a USB-serial bridge, followed by a serial-PATA or serial-SATA bridge, there's an engineer somewhere who needs to be shot.

[Anon5000]

Forget changing light-bulbs, how many FTDI employees does it take to downvote and post as anonymous cowards? 5 to down-vote and one to flash the AC box.

[Anonymous Coward]

Looks like there are 3 FTDI employees here, going by the downvote counts.

To summarise the summary of the summary:

It's desirable for the latest FTDI driver to refuse to work with non-FTDI parts. FTDI did a lot of work and they should be paid for it.

However, it is not ok to actively damage them without a court order, and doing so may be illegal.

[cortland]

This will be a real problem for thousands of computer users, who have NO way to tell if their devices will be affected when they buy them. Uncool doesn't BEGIN to describe it. And if FTDI can get away with this, so can Microfost, bricking the hard drives if you don't have a valid install.

The dog ate my tax return but here's the hard drive; it's on there somewhere.

[oddie]

I just had a USB device die on me :)

A USB SATA Harddrive Dock to be precise...

Not sure if it is related or not, could totally be just a coincidence.. I can see that it's now running USB/VID_0000&PID_0000\xxxx though...

although the dock seems to actually have 2 USB controllers, as only the hard drive portion has decided to become an "unknown device"... - "Windows has stopped this device because it has reported problems. (Code 43)"

The "generic hub" USB\VID_058F&PID_6254 seems to be happily chugging along (Probably why I can still see the SD card reader part of device)...

If someone has knowingly put out software/drivers that they were aware would brick hardware, and may have done so on purpose, then I guess I'll be joining the class action lawsuit when it gets started?

I have another docking station somewhere.. not sure what chips are in it though... might not plug it into any windows machines until I know they won't try to break it...

[oddie]

Re: I just had a USB device die on me :)

Seems my undead usb sata dock has sprung back to life.. cold restart seems to have fixed whatever was wrong.. checked the USB vendor ID's.. doesn't seem to be FTDI related.. just coincicence it failed today I guess...

[Conundrum1885]

Re: I just had a USB device die on me :)

Hi, you could try hacking the driver (inf files) and see if it then works, and if so copy data off PDQ.

I have had these die due to bad USBs before, swapping drive usually brings it back BUT the newest drives have onboard controllers so this doesent work.

[ScaredyCat]

Microsoft stepped in ... ??

"Update: Microsoft has given us a statement:

Yesterday FTDI removed two driver versions from Windows Update. Our engineering team is engaging with FTDI to prevent these problems with their future driver updates via Windows Update."

[Anon5000]

Re: Microsoft stepped in ... ??

While the drivers have been withdrawn, FTDI are saying their replacement drivers will still contain code to make sure alternative devices still do not work under Windows.

Microsoft should tell them to get lost with any driver updates that stops equipment working. When Windows users start getting worried about driver updates and patches, MS will get the reputation hit with the fallout from unpatched systems.

[Martin-73]

Re: Microsoft stepped in ... ??

Like I've said upthread a few times, stopping the devices working without modifying them is fine, not really fair on the end-user, but on the legal side of the douchebaggery line. The modifying the ID thing was in clear contravention of the Misuse of computers act, and hopefully that's why they pulled the driver

[Tim Bates]

Prolific's been blacklisting their RS232 adapters for ages. And it causes problems even for companies like banks. An Australian bank ships Prolific clone cables with their POS integrated EFTPOS terminals. If companies like banks can end up with fakes, how is anyone else supposed to tell?

I personally think a warning should be displayed to notify the user when fakes are detected. That way you know WHY it's crapped out (you don't just call the real manufacturer names). And as long as this hardware fiddling is reversible, I've got no issues with that either.