FTDI Windows drivers bricking work-alike clones

How to make them do what you want, not to rant on about. Slashdot is better for rants anyway.

FTDI Windows drivers bricking work-alike clones

Postby Doug Coulter » Thu Oct 23, 2014 12:58 pm

Turn off windows auto-update NOW. FTDI (who knows with or without MS's blessing) has released a new driver that gets pushed to you that bricks work-alike FTDI USB<>rs232 adaptors. Why care? Because many Arduino clones, not to mention many of the cheap serial dongles you've bought over the years of transition - computers now rarely have a serial port - will be reprogrammed by this new (windows only for now?) driver and require repair to work again, even on linux.
Many moderately legit chipmakers have used the FTDI ID's so as not to have to write their own drivers and have windows and other opsys recognize their stuff as a plain-jane serial port over USB (yeah, that's real innovation there...not a lot on either the cloners or FTDI's part, seems kind of obvious, like a connector adapter, but you know how jealous firms are of their precious eye-pee since almost none compete on innovation anymore). The new FTDI windows drivers detects these and reprograms them - yes, that's direct illegal access to a computing device (in DMCA legalese this is against the law utterly if one of us does it) to change the PID to zero, which then will not be recognized as legit by *any* opsys. Luckily, there are ways of fixing this - till the next time the device is plugged into windows, that is.
Here's a fuller explanation at Ars Technica: http://arstechnica.com/information-tech ... e-hackers/

Which lead me to some threads linked from the comments on how to un-brick your arduino (or whatever).
http://www.reddit.com/r/arduino/comment ... re/clgviyl
https://code.google.com/p/libcomm14cux/ ... eWithLinux

Being a linux user (only have windows in virtual box for someday perhaps looking into doing cross platform stuff again), this hasn't hit me yet. But I'd bet things like my seeduinos would brick if plugged into windows, or most of my no-name serial converters.

This is kind of like FTDI doing a replay of the Sony rootkit DRM attack, and they'll probably get off with a pocket change fine if even that. Having slipped it by MS - well who knows if there was a nudge and a wink..but so far, only windows is affected.
But it's not just that clones will no longer work on windows - they are bricked for all opsys till you apply one of the fixes listed above. That's pretty crappy behavior, in my rarely humble opinion. This is probably going to turn out bigger than FTDI or most anyone thought - up until the other flaws of the USB protocol get used for bricking the other direction. Turns out all those USB sticks and flash cards are programmable after leaving the factory - kind of have to be if you understand what bunnie is talking about - and that this could be used to have a malicious USB stick or whatever pwn a machine via pretending to be various other devices at various times, keylog, install badware....it's a long list of bad things that can be done once a machine trusts a peripheral.

Yes, this takes a long time and would be hard to understand for noobs. But this board isn't for noobs anyway. I strongly urge you to partake of some knowledge of what really goes on in this stuff.
http://www.bunniestudios.com/blog/?p=3554

It's inevitable that more will come of this. Keep your eyes open, this one has more potential than is generally realized for creating real havoc.
Posting as just me, not as the forum owner. Everything I say is "in my opinion" and YMMV -- which should go for everyone without saying.
User avatar
Doug Coulter
 
Posts: 3515
Joined: Wed Jul 14, 2010 7:05 pm
Location: Floyd county, VA, USA

Re: FTDI Windows drivers bricking work-alike clones

Postby Jerry » Thu Oct 23, 2014 2:53 pm

I have no problem with FTDI doing this. They have to do something about counterfeiters. If you buying something from china because it is way cheaper there has got to be a reason. Think of it like this, you buy a new laptop and it has windows installed on it. 30 days later windows is deactivated because it is a counterfeit version and microsoft killed it. This is the same thing here. FTDI has removed their UID which they paid for.
Jerry
 
Posts: 573
Joined: Sun Jul 18, 2010 12:07 am
Location: Beaverton, OR

Re: FTDI Windows drivers bricking work-alike clones

Postby Donovan Ready » Thu Oct 23, 2014 3:08 pm

Thanks, Doug. Good links. Bunnie's blog is awesome, and it's now bookmarked.
Donovan Ready
 
Posts: 239
Joined: Thu Apr 17, 2014 1:22 pm
Location: Austin, Texas

Re: FTDI Windows drivers bricking work-alike clones

Postby Doug Coulter » Thu Oct 23, 2014 10:44 pm

If they are that clever - why not just pop up an error message and refuse to work, rather than stealing value from an end consumer who has and had no way whatever of knowing (and no reason to care either)? They didn't commit a crime. They just bought something at the computer store or Amazon or whatever, they never tell you what parts are in that dongle, ever.

What they are doing is criminal under US law; not that I agree with all of US law on computers and IP - not hardly. But I suppose, like Sony and their rootkit, they get at most a wrist slap fine, whereas one of us would go to jail for decades for doing 1/100th as much damage as either one of those guys.
After all, Sony's rootkit only kinda hampered software and took about a full day of your time to recover from, if you knew how to save all your stuff and re-install windows and had a full install disk (which they haven't shipped in awhile), it didn't break "hardware", eg normally not-programmable stuff. The average user will simply have to toss their paid-for stuff in the garbage.

Oh, that's right, all Chinese companies involved? No IP laws that have any effect, then. So they steal from us (and the rest of the planet, no problem), but when they steal from each other...still no law, so they have to take matters into their own hands, is that it? Think this through. It's not like it's super novel IP, it's that windows is stupid about USB stuff and how it matches a driver with a device. Non-FTDI vendors could still use the driver and just provide a .inf file saying to do that - it's worked for microchip dev boards for quite some time from CCS (some of the microchip parts have built-in USB hardware that oops, emulates the utterly obvious). Why is it so easy to clone that every uP with USB hardware in the SOC does it? This is big-company lock-in, not anything fair. I'm pretty sure Microchip wrote their own USB stack, it's pretty obvious how, and the spec well-documented. Kind of like trying to patent/copyright windows.h or "structure, selection and methods" of Java....you gotta be kidding, that's the spec book, not the creative work.

What should worry people far more, as bunnie points out and others have since extrapolated from, is that a USB stick (really, anything with a plug) can be programmed to be, well, anything. More than one thing at a time, even, it's in the broken USB protocol spec. So, a bad stick pretends to be a keyboard and a disk both - and tells your opsys to load badware off a hidden file on it, dismissing all the "are you sure?" dialogs so fast you never see them. A little key logging here...a little privilege escalation there...you can go really far with just a dime store stick. What FTDI is doing is the wrong approach, and wouldn't fix that one anyway. It doesn't even hurt the guy who made the fake - he's been paid long since.

Edit, oops, looked up FTDI's company profile. They're not Chinese. This is a product - their latest one according to them - from the '90s and they're just trying to get by without having to innovate. Bigger guys just litigate when they can't innovate of buy their stock back with cheap loans to keep earnings/share up. Still a dirty trick. I'm not impressed with any of that. Why not do something new and good/better? We never had to worry about setting things like code protect bits - by the time 6 months had gone by and the Chinese or others had reverse engineered our stuff, we were already top of the market and had already started selling the next great thing - we were the goose, we didn't have to care about each egg. Now everyone wants to be paid forever for having had one idea. That's not the same thing, and it's not admirable in my book (speaking of books, though a succession of publishers that have owned mine, I've now sold a negative total number of books despite getting some 10k+ emails from the fact that the code that came with it had my email address in it).
Posting as just me, not as the forum owner. Everything I say is "in my opinion" and YMMV -- which should go for everyone without saying.
User avatar
Doug Coulter
 
Posts: 3515
Joined: Wed Jul 14, 2010 7:05 pm
Location: Floyd county, VA, USA

Re: FTDI Windows drivers bricking work-alike clones

Postby Jerry » Thu Oct 23, 2014 11:32 pm

That doc you linked to is 12 years old.
Jerry
 
Posts: 573
Joined: Sun Jul 18, 2010 12:07 am
Location: Beaverton, OR

Re: FTDI Windows drivers bricking work-alike clones

Postby Doug Coulter » Fri Oct 24, 2014 3:39 pm

You are right. it's old. It's their current latest on their own website. What can I say?
Posting as just me, not as the forum owner. Everything I say is "in my opinion" and YMMV -- which should go for everyone without saying.
User avatar
Doug Coulter
 
Posts: 3515
Joined: Wed Jul 14, 2010 7:05 pm
Location: Floyd county, VA, USA

Re: FTDI Windows drivers bricking work-alike clones

Postby Doug Coulter » Sat Oct 25, 2014 7:46 pm

Well, the world spins on and Microsoft and FTDI have pulled the illegal driver from windows push updates. I guess they are hoping it hasn't borked enough stuff to get a good class-action suit going, and that the government will, as usual, give the big boys a pass for their crimes that we'd go under the jail for.
http://www.theregister.co.uk/2014/10/24 ... _response/

The comments on this one are particularly interesting in revealing some details. These chips that the driver borked are NOT copies - in fact, FTDI is taking advantage of a bug in their own firmware that these "copies" don't have.
EG, they are not copies, someone made their own and actually DIDN'T have the bug FTDI has...because the fake is better, not worse, at least insofar as meeting the standard.

I'm not saying I would support those guys who use FTDI's logo etc on the chip and sell theirs as FTDI's - that's also a crime (trademark violation). But the driver can't see that, nor can the customer in nearly all cases (molded inside some connector).
But it turns out, it's so trivial an idea that FTDI doesn't have a patent they can enforce...because, duh, it's trivial. Copyright doesn't apply here as the "fakes" are work-alike, not copies.

While there is room for differences of opinion, I'd agree with the guy that says a driver costs about $25k to write (Microsoft will then about double that cost for signing it...jerks), but it's small potatoes in the scheme of things.
I'm not sure how much a VID and PID cost from the org that provides management of these, but clearly there is more than one driver out there for USB<>serial dongles - a work alike that does not violate any copyright, patent and so on.
The copyists could simply move along and use someone else's driver by declaring a pid and vid for that one, or gasp - actually write a driver and an .inf file to have it installed, or just a .inf file to declare what existing driver to use (saving bloat on the customer's machine, after all, this is decades old bog standard tech).

The entire affair reminds me of the MIT paper on safe combination locks designed in the early '30s and the furor of locksmiths around the revelation of how insecure they are. They'd be cruising on a profit center created by grampa for too long to, you know, actually design a good lock and promote that instead of one that was seriously limited by '30s machining tech and can be easily picked with no stethoscope, no sandpapered fingers...and so on. One turn of the dial reveals all the numbers in the combo to anyone feeling for the clicks...then all you have to do is get them in the right order. You can just look hung over and take a couple tries...yet it's all MITs fault. Yeah, right. Raised a similar amount of controversy and humor when it was on Bruce Schneieir's security blog. Even though it didn't actually brick anything at all, it simply revealed that locksmiths had been ripping off their customers for decades, more or less.

I had to learn how to make a decent copper plating solution, even though the tech has been around 100's of years as a trade secret, from a grad student study on how to use copper with silicon (they were trying to dupe the intel tech for that). This "secret" allows the plating companies to sell you a few bucks (tops) of chemicals for 100s of bucks. Cruising on gramps again....and you gotta love grad students. They just tried everything...and then published it.
Posting as just me, not as the forum owner. Everything I say is "in my opinion" and YMMV -- which should go for everyone without saying.
User avatar
Doug Coulter
 
Posts: 3515
Joined: Wed Jul 14, 2010 7:05 pm
Location: Floyd county, VA, USA


Return to Operating systems

Who is online

Users browsing this forum: No registered users and 1 guest