READ THIS: How big does a tech product have to be before we take it seriously?

FTDI admits to bricking innocent users' chips in silent update

Topic: Security

FTDI admits to bricking innocent users' chips in silent update

Summary: In a move that has surprised and angered security researchers, chip maker FTDI has admitted to issuing a silent update that bricks cloned FTDI FT232 [USB to UART] chips.

Violet Blue
SHARE:
TOPICS: Security, Hardware
75
FTDI bricked Windows update

Hardware hackers and security researchers are furious at chip maker FTDI for issuing a silent update that bricks cloned FTDI FT232 [USB to UART] chips.

The chip is extremely common on a wide variety of devices and there is no way of knowing at this time which devices have cloned chips -- and the tainted supply chain could hit anyone.

FTDI appears to have used a recent Windows update to deliver the driver update to brick all cloned FTDI FT232s.

FTDI's surprise new driver reprograms the USB PID to 0, killing the chips instantly.

The hardware hackers at Hack A Day first reported that a recent driver update deployed over Windows Update is bricking cloned versions of the very common FTDI FT232 [USB to UART] chip.

In response to increasing anger and criticism from security researchers on Twitter, FTDI admitted using the remote kill switch and is adamant that this move is necessary to fight counterfeiting.

FTDI says it's not targeting users, but shifts the blame to users in a tweet suggesting users may -- somehow -- knowingly be using cloned chips:

Companies and individuals who buy and use the chip have had no reason to suspect -- and often, no way of knowing -- they might be getting chips from a cloned batch.

The FTDI FT232 is one of the most common chips on devices with USB-serial port hardware functions. It's used to add a USB serial port to a device or project.

Hack A Day explained, "The FTDI FT232 chip is found in thousands of electronic baubles, from Arduinos to test equipment, and more than a few bits of consumer electronics. It’s a simple chip, converting USB to a serial port." 

The company's evident overreach has created a situation that leaders in the security communities consider unethical and untenable -- it will no doubt damage the company's reputation, and possibly its bottom line.

Topics: Security, Hardware

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

75 comments
Log in or register to join the discussion

  • This should be illegal...

    This sound be illegal and Microsoft should blacklist this company, excluding them from ever again delivering driver updates through Windows Update. Failure to do so will damage Microsoft's credibility greatly. Imagine buying some component of eBay then having it bricked by a Windows update that was specifically designed to brick it!!! I'd be furious and it would get me exploring my O.S. options.
    dsf3g
    Reply 20 Votes

    • too much blame on MS i think

      The chip maker is the one at fault. Its the guy who makes the bad update thats wrong not the guy who offers the service to update. If ms ban all future updates from them, then you both potentially create an issue of an important security update down the line not getting through, and encourage a culture of controlling what driver updates you can have
      MarknWill
      Reply 4 Votes

      • Legal Liability

        MS is on the hook because they supposedly vetted the update and installed on users' boxes. If MS blacklists these idiots it would serve as a warning to others. The truth of the matter I do not know if any of my devices use are vulnerable.
        Linux_Lurker
        Reply 9 Votes

        • I don't think so

          Testing an update from an official source on counterfeit hardware would be over and above their responsibility.
          Buster Friendly
          Reply 7 Votes

          • But...

            This is assuming that the end user knows it's a counterfeit product. Many end-users will find out their chip is counterfeit until it gets bricked by the update. In the end, this boneheaded move will only cause the market to move away from FTDI chips altogether as it's easier to do that rather than hunting down the counterfeit batch.
            danixdefcon5
            Reply 2 Votes

          • Not sure how that applies

            I'm not sure how that applies to Microsoft's responsibility in the incident.
            Buster Friendly
            Reply 1 Vote

          • By design

            This is not about accidentally releasing something that is incompatible. This is about a deliberate design of software to destroy a product you believe infringes on your intellectual property.
            qwerty79
            Reply 3 Votes

        • They vetted it on legit chips, and it passed

          I don't see how it's MS's responsibility to find all cloned chips and test on them.
          William.Farrel
          Reply 1 Vote

    • It is Illegal

      See the UK Misuse of Computer Act (1990) which is also enacted under Scottish Law:

      This Act makes it an offence to:

      • Erase or amend data or programs without authority;

      • Obtain unauthorised access to a computer;

      • “Eavesdrop” on a computer;

      • Make unauthorised use of computer time or facilities;

      • Maliciously corrupt or erase data or programs;

      • Deny access to authorised users.

      This is a criminal case, never mind a civil one.

      As for MS they should yank this immediately from WU or they may find themselves co-liable if they to continue to offer this.
      Alan Smithie
      Reply 5 Votes

      • none of this applies in this case

        each user gave authorized WTFDI by accepting the driver licensing agreement, or so FTDI think. anyway, they pulled the drivers in question from the windows update site already according to this

        http://arstechnica.com/information-technology/2014/10/windows-update-drivers-bricking-usb-serial-chips-beloved-of-hardware-hackers/
        vpupkin
        Reply 2 Votes

        • vpupkin: "[Microsoft] pulled the drivers in question

          from the windows update site"

          If true, this is a bad omen, suggesting that Microsoft doesn't vet the 3rd party updates it receives. This is yet another software update quality problem from Microsoft.

          P.S. I didn't state that Microsoft had to test this driver patch from FDTI, but it should understand what the driver patch *fixes*.
          Rabid Howler Monkey
          Reply 2 Votes

          • Microsoft may well have tested it...

            ...but they would have tested it on equipment with genuine FTDI chips.

            And FTDI would have delivered it to MS saying "Here's an update that fixes possible probems X, Y and Z..." and not added "...and, by the way, it will brick a lot of end-users' devices without warning."
            fairportfan
            Reply 2 Votes

          • Of course

            Of course they do and that vetting includes verifying the update actually came from the vendor and it installs properly. Both those are true.
            Buster Friendly
            Reply Vote

          • So who should have sent MS cloned chips to test on

            from what I read, it worked perfectly on actual FDTI chips. Are you suggesting MS should have known there are cloned chips out there, acquired some somehow, built tests boards around them, THEN try the update?
            William.Farrel
            Reply 2 Votes

          • Again...

            Microsoft "should understand what driver updates *fix*". And/or understand what improvements are included.

            Presumably, 3rd parties such as FTDI whom provide drivers to Microsoft for includsion in Windows Update communicate the nature of the fixes and improvements. It would be interesting to see the correspondence from FTDI to Microsoft regarding this driver update. For example, was the bricking of cloned chips discussed in the documentation?

            P.S. Are you certain that Microsoft vetted FTDI's driver update through its own independent testing? Am also curious as to how you know that Microsoft has not ever purchased equipment with cloned chips? I will add that I'm quite sure that Microsoft would not knowingly do such a thing.
            Rabid Howler Monkey
            Reply Vote

        • "maliciously corrupt"

          it would fall under maliciously corrupting...end users don't purchase FTDI chips...they know that...to pump out a kill switch through WINDOWS UPDATE is nothing short of malicious
          benblush@...
          Reply 3 Votes

      • FTDI is British

        So the UK's Misuse of Computers Act probably does apply. Whether the DPP or the ICO actually do anything about it is another matter.
        mrgoose
        Reply 3 Votes

    • RE: This should be illegal....

      While I enjoy a thorough Microsoft bashing, I can't see how THEY (MS) are at fault. Vendor issues a driver update, and Microsoft places it in their update catalog.

      About the only thing Microsoft can do currently is pull the driver update, and re-instate the most recent copy that does not contain the 'bricking code'.

      Any blame must go direct to the vendor. They have crossed into the world where they feel it is their 'right' to "interfere" with purchased goods. Remember Sony, and disabling the 'other O/S option'? Many have experienced DVD players getting 'bricked' by drive by firmware updates.

      How do we (as consumers) protest such actions? I can think of only one effective mechanism to get the attention of hardware vendors - vote with your wallet. Because I seriously doubt that most governmental agencies will take up the fight for consumer rights. Big business has made sure that its 'money talks', and "we, the people" don't mean s--- in the grander scheme of things.
      fatman65535
      Reply 1 Vote

    • The thing is

      The thing is that since this part involves USB technology the vendor, FTDI, probably has a properly licensed Vendor ID and Device ID from USB-IF. They could argue that the update is only applied to their devices (those that contain IDs that only they are licensed to use in hardware).
      rbgaynor
      Reply Vote

  • Pottery Barn rules

    You break it you pay for it.
    greywolf7
    Reply 9 Votes