FSUIPC URGENT

[TSR2]

The following announcement comes from Pete with respect to all Free and Payware versions of FSUIPC.

Due to a breach in the security of the GlobalSign certificate used to confirm that FSUIPC is a valid and safe package, the certificate is being revoked. This will require ALL users of the software – whether registered or otherwise and using FSUIPC3 or FSUIPC4 – to need to download and install new versions.



Full details are available by clicking “Read more” below, or by visiting Pete Dowson’s post here on his support forum, here at simFlight. Download links are available at simFlight; here, or Schiratti.com; here. For a short time, the following direct links to FSUIPC3 (3.999z2) and FSUIPC4 (4.90) at Dropbox are also live.



https://dl.dropboxusercontent.com/u/475 ... IPC490.zip



https://dl.dropboxusercontent.com/u/475 ... 3999z2.zip



Please note that this is not a security breach within FSUIPC itself – it is only the security certificate that has been compromised.



If you aren’t sure what FSUIPC is, or whether you have it, full details can be found on the product pages at simMarket and it can be found within your Flight Simulator 9/modules, Microsoft Flight Simulator X/modules or Prepar3D/modules folder. If you have a file entitled “FSUIPCx.dll” (x is dependant on the FS version) then you need to update, in order for FSUIPC to keep working.





Full Press Release text:



FSUIPC will need replacing on all user systems!



For the last ten years FSUIPC has been protected against both unwanted alteration and virus infection by the use of a Code Signature, purchased from and protected by GlobalSign, an officially recognised Windows Certificate Authority.



It has come to my attention that within the last two weeks the same Code Signature has been used to sign malicious software, apparently in the form of Java updates, to make it look valid and safe. Whilst the FSUIPC packages themselves are not affected in any way by these, it does mean that we have had to ask GlobalSign to revoke the signature. This in turn will cause the signature to appear incorrect, and because FSUIPC actively checks it every time it is started the end result is that all versions of FSUIPC3 and FSUIPC4 before today’s date will cease to function.



After due consideration it has been decided that we will dispense with Code Signing henceforth, and over the next few days unsigned versions of all of my programs will be released, replacing the signed versions and with incremented version numbers, but with no other changes.



Because only FSUIPC has the Signature self-checking built in, it is the main priority, and versions 4.90 and 3.999z2 have been released today free of this check. All users will need to update for continued use of the program, and software producers who include FSUIPC in their packages are asked to update those as soon as is convenient and practical.



Apologies to all for this unprecedented event. We still don’t know how the break in the signature’s security occurred but we will be following this up with GlobalSign.



Best Regards

Pete

[DaveG]

Thanks for the HU Ben

[NigelC]

Oooh err missus!!!!

[PeteP]

FSUIPC is at the heart of Tangmere's Lightning sim - all the flying and engine controls, buttons and switches run through it - so I'm wondering if I'm going to have to make an unscheduled trip to the museum tomorrow to install a new version.

I say 'wondering' because - and it's probably me being incredibly dense - what I don't understand is why our particular FSUIPC installation will fail tomorrow. It's a stand-alone installation not connected to the internet so how will it "know" that its security certificate has been revoked?

As I said, probably me being dim but I just can't see how the self-checking system will know anything has changed if it can't communicate with the outside world.
A rather puzzled Pete

[Kevin Farnell]

Thanks for the heads up, Ben (I recieved the same email) but like Pete, I'm concerned that this might be a scam.

Any way of checking?

Regards

Kevin

[nigelb]

Thanks for the heads up, Ben (I recieved the same email) but like Pete, I'm concerned that this might be a scam.

Any way of checking?

Regards

Kevin

Yes you can go directly to Pete Dawson's site at http://www.schiratti.com/dowson.html and scroll down the page. Both versions of FSUIPC have 5 May 2013 dates listed as the current version.

Nigel²

[Airspeed]

Thank you Ben.
You being a trusted soul, I had both DLs done & dusted before even reading that anyone feared it might be a scam.
Still, if I'd received an email myself, things would have been different. I thought I was registered, but apparently I'm not.

[PeteP]

Just to make it clear, I don't think it's a scam although - old cynic that I am, - that thought did pass through my mind. No, it's genuine but my puzzlement was how it could affect a system like the Lightning simulator which was not connected to the internet. Presumably it needs such a connection to do it's checking?

Obviously, I will update FSUIPC on my next trip to the museum but until then I don't think, without an internet connection, the current version will have the problem stated. Anyone any thoughts on this?
Pete

[TSR2]

Hi Pete,

You are absolutely correct. If its not connected to the internet, there is no way for it to pick up the latest revocation list, so you will be fine.

It does sound a bit odd, but I did check in a couple of places before posting.

[PeteP]

Thanks, Ben.
Pete