In-App Purchase Vulnerability to Be Fixed in iOS 6; Apple Offers Best Practices to Developers
As noticed by 9to5Mac, Apple has offered developers a series of best practices to prevent the In-App Purchase vulnerability, as well as promising a full fix in iOS 6. The advisement was sent to developers in an email today.

CNET was issued this statement by Apple:
"We recommend developers follow best practices at developer.apple.com to help ensure they are not vulnerable to fraudulent In-App purchases," Apple spokesperson Tom Neumayr told CNET. "This will also be addressed with iOS 6."
Apple issued this note to developers on the iOS Developer webpage, along with a series of suggestions to help verify that in-app purchases are legitimate:
A vulnerability has been discovered in iOS 5.1 and earlier related to validating in-app purchase receipts by connecting to the App Store server directly from an iOS device. An attacker can alter the DNS table to redirect these requests to a server controlled by the attacker. Using a certificate authority controlled by the attacker and installed on the device by the user, the attacker can issue a SSL certificate that fraudulently identifies the attacker’s server as an App Store server. When this fraudulent server is asked to validate an invalid receipt, it responds as if the receipt were valid.
News of the in-app purchase hack broke a week ago, and Apple has made several attempts to prevent users using the hack. It allows users to avoid paying for in-app purchases by using a third-party server as a "man-in-the-middle" attack. Apple now includes the UDID identifier in in-app purchase receipts in an attempt to increase the security of purchases.
Popular Stories
Bloomberg's Mark Gurman has high expectations for Apple's first foldable iPhone.
In his Power On newsletter today, he said the foldable iPhone will be "the most significant overhaul in the iPhone's history."
"iPhone 4, iPhone 6 and iPhone X were clearly a big deal, but this is a whole new design," he said.
Like Samsung's Galaxy Z Fold 7, the foldable iPhone will reportedly open up like ...
March has been an incredibly busy month for Apple, with the company unveiling more than 10 new products and accessories. We said hello to the MacBook Neo at the start of the month, and we bid farewell to the Mac Pro at the end of it.
Nevertheless, there is still a lot more to come this year.
Beyond the usual annual updates to iPhones and Apple Watches, Apple's all-new smart home hub is...
Apple is expected to release two new iPhone apps this year, including an Apple Business app and a Siri app with chatbot-like functionality.
With the Apple Business app, employees at businesses using the new Apple Business platform will be able to install apps for work, view contact information for colleagues, and request support. Apple Business is launching on April 14, and it replaces Apple ...
Popular Stories
Bloomberg's Mark Gurman has high expectations for Apple's first foldable iPhone.
In his Power On newsletter today, he said the foldable iPhone will be "the most significant overhaul in the iPhone's history."
"iPhone 4, iPhone 6 and iPhone X were clearly a big deal, but this is a whole new design," he said.
Like Samsung's Galaxy Z Fold 7, the foldable iPhone will reportedly open up like ...
March has been an incredibly busy month for Apple, with the company unveiling more than 10 new products and accessories. We said hello to the MacBook Neo at the start of the month, and we bid farewell to the Mac Pro at the end of it.
Nevertheless, there is still a lot more to come this year.
Beyond the usual annual updates to iPhones and Apple Watches, Apple's all-new smart home hub is...
Apple is expected to release two new iPhone apps this year, including an Apple Business app and a Siri app with chatbot-like functionality.
With the Apple Business app, employees at businesses using the new Apple Business platform will be able to install apps for work, view contact information for colleagues, and request support. Apple Business is launching on April 14, and it replaces Apple ...