Strange network connection requests when FSUIPC starts

[quantumleap]

I have a firewall on my system which alerts me to outgoing network requests.

When FSUIPC is enabled in the FSX dll.xml, when I start FSX it flags that it is attempting to connect to four sites in Europe (Verizon Business in Belgium, Cybertrust Ubizen in Belgium, CloudFlare EU and Telecom Italia Mobile) and one in the US (CloudFlare Inc). Why is this?

If FSUIPC is disabled in the FSX dll.xml these network requests do not happen. I do not get this notification for any other software on my system, just FSUIPC.

Regards,

Jeff

[Pete Dowson]

When FSUIPC is enabled in the FSX dll.xml, when I start FSX it flags that it is attempting to connect to four sites in Europe (Verizon Business in Belgium, Cybertrust Ubizen in Belgium, CloudFlare EU and Telecom Italia Mobile) and one in the US (CloudFlare Inc). Why is this?

There is no code in FSUIPC which has any possibility of connecting to the Internet, and there never has been.

If FSUIPC is disabled in the FSX dll.xml these network requests do not happen. I do not get this notification for any other software on my system, just FSUIPC.

Then something else which relies on FSUIPC being installed for some other purpose is doing this. It is an absolute certainty that it is not FSUIPC itself.

Regards

Pete

[quantumleap]

Pete,

Thanks for the information. Not sure what is happening then (maybe I'll snoop the packets and see what is being transmitted).

In my tests I had disabled all other entries in the dll.xml apart from FSUIPC and removed all lines in the [Trusted] section of the FSX.cfg to make sure nothing else was running which used FSUIPC.

This was with version 4.80. I noticed that a newer update was available and installed it. Interestingly the installer for 4.827 also made a similar network request to one of the previously listed sites (Cybertrust Ubizen in Belgium). I then updated the FSUIPC.dll further to 4.839b. With this newer version, I no longer get the network requests.

Regards,

Jeff

[Pete Dowson]

In my tests I had disabled all other entries in the dll.xml apart from FSUIPC and removed all lines in the [Trusted] section of the FSX.cfg to make sure nothing else was running which used FSUIPC.

Generally things which use FSUIPC don't get loaded by SimConnect (which is what DLL.XML is primarily for), and do not get "trusted" or otherwise by FS -- because FS is not aware of them. they interface through FSUIPC, not directly to FS.

This was with version 4.80. I noticed that a newer update was available and installed it. Interestingly the installer for 4.827 also made a similar network request to one of the previously listed sites (Cybertrust Ubizen in Belgium). I then updated the FSUIPC.dll further to 4.839b. With this newer version, I no longer get the network requests.

The installer has no Network related code in it whatsoever.

However, all my products are codesigned, so maybe all this is to do with the Windows trust mechanism. maybe there's something missing in your Windows setup and it doesn't have the correct trust authority certificates installed. At least two of the sites you mention are Trust Authority sites (Cybertrust and Verizon are part of the same Trust Authority I think). CloudFlare is listed as "a content delivery network and distributed domain name server service marketed as improving website performance and speed and providing security", so perhaps relates to this as a DNS source, But where Telecom Italia Mobile comes into it I've no idea.

Check the Install log file. If the installer finds the needed certificates missing it automatically runs a little program supplied by GlobalSign to fix that.

Right click on any of my signed programs (the Installer or the DLL itself), select "Properties" then "Digital Signatures". Select the signature and click "Details". Make sure it tells you that the signature is ok. Does this process try to access any websites?

If the signature is not confirmed as "ok" then the file has been tampered with or become corrupted.

Pete

[quantumleap]

I agree that it does look like it is related to checking of code signing based on the packet analysis. As a recent Windows Update revoked a number of certificates, I am wondering if at that time, it cleared them all out so they are slowly being re-added.

Have checked and the digital signature for the FSUIPC DLL is "OK".

Thanks,

Jeff