Rainbow Six: Siege players are complaining that the game continues to make their global IP address available to other players, putting those players at risk for DDoS attacks from bitter opponents.
The problem seems to stem from the way the game implements voice chat between players. Back in September, Ubisoft confirmed that while the game uses dedicated servers to host matches, it still uses direct, peer-to-peer connections "strictly to support voice and chat comms for a team." Beta players began noticing almost immediately that this infrastructure decision presents a pretty big security hole when playing with strangers on the Internet. This netcode analysis from January shows how a simple packet sniffer like NetLimiter could easily reveal the IP addresses of all other players in the match, even though voice chat is only available between teammates during a match.
Armed with these IP addresses, unscrupulous players could easily use any number of services to initiate a DDoS attack to remove opposing players from the game. There's a decent amount of evidence that many players were doing just that to gain a leg up in ranked matches, with some managing to climb the in-game ranking ladder despite awful play statistics.
Ubisoft, to its credit, has responded to player concerns about the problem. In late February, the company said in patch notes that promised IP protection "is currently a priority for us," even though implementing the feature "has proven to be more complicated tech-wise than anticipated." A fix was finally rolled out in time for the version 2.3 patch in late March. "We have applied IP protection in order to help protect our players’ information, preventing players from being able to access IP information of the opposing team’s players," the company wrote at the time.
Yet there's evidence that patch hasn't completely plugged the game's IP address hole. Based on numerous reports, players are still able to find opposing players' IP addresses using third-party hacking tools that are quite easy to find online. While Ubisoft's recent patch seems to prevent the game from directly connecting to opposing players (thus hiding those IP addresses from naive packet sniffers), it appears a full list of player IP addresses is still reported to every individual game client and thus accessible with a little bit of work.
It's not clear why the game client still needs direct access to this full list of opposing player IP addresses. Ubisoft might therefore be able to easily patch out this continuing vulnerability in the future (Ubisoft representatives were not immediately available to respond to a request for comment).And the hacking tools that can currently reveal player IP addresses also reportedly allow for game-breaking manipulations like auto-aiming and the ability to shoot through walls, which should be a priority for Ubisoft to fix as well. In the meantime, some users have asked Ubisoft for the ability to disable VoIP entirely to avoid revealing their IP address, but that could be an unsatisfying solution in a game that relies heavily on team-based communication.
In any case, the game's continuing IP revelation issues seem like a problem that could have been easily avoided in the first place had Ubisoft passed its intra-team voice communications through its own dedicated servers (rather than through peer-to-peer connections). Amid Ubisoft's continuing problems with client-based hacking in The Division, these Rainbow Six: Siege issues don't do much to give us confidence in the company's handling of online security.
reader comments
39