Previewed at WWDC, launching in the fall.
Apple Now Including Unique Identifiers for In App Purchase Receipts to Combat Hack
Following last week's launch of a hack that allowed users to obtain In App Purchase content free of charge by routing their purchase requests through a server run by a Russian hacker, Apple began taking steps to thwart the method. The hacker has, however, continued to develop his method to skirt around Apple's roadblocks.
One of the suggestions for a method by which Apple could improve the security of In App Purchasing was to include a unique identifier in validation receipts, and we've received word that developers are now seeing something along those lines coming from receipts issued by Apple since late yesterday. The receipts carry a new field called "unique_identifer" that appears to include the Unique Device Identifier (UDID) for the device making the In App Purchase.
As one developer noted to us, apps are no longer supposed to be collecting the UDID and thus it is unclear whether Apple's use of the identifier for this purpose is simply a first step toward a broader implementation of unique receipt identifiers for increased security or if Apple is attempting to identify those users and devices who are sharing their receipts with the Russian hacker to allow the method to function.
[ 46 comments ]
Top Rated Comments
(View all)
77 months ago
Mulitple devices/replacement devices
How will this impact those of us that have an iPad and an iPhone? Will we be required to pay for the app 1 time, but the in-app stuff twice?? :confused::confused::confused:
How will this impact those of us that have an iPad and an iPhone? Will we be required to pay for the app 1 time, but the in-app stuff twice?? :confused::confused::confused:
77 months ago
Maybe a UK judge can require the hacker to include the text "this receipt is a copy of a legitimate and cool receipt" for the next 6 months on all receipts and on his website.
77 months ago
It's a shame that Apple even needs to do this. The world we live in today...
Yes. The world we live in today is almost unbearable. All these wars of opportunity complete with extrajudicial killings funded by casino capitalism. While a naive self-absorbed population frets endlessly about... pirated software? What a shame indeed.
77 months ago
As one developer noted to us, apps are no longer supposed to be collecting the UDID and thus it is unclear whether Apple's use of the identifier for this purpose is simply a first step toward a broader implementation of unique receipt identifiers for increased security or if Apple is attempting to identify those users and devices who are sharing their receipts with the Russian hacker to allow the method to function.
They might allow developers to use it to check if the purchase is valid. There's a huge difference between that and developers using it to track users and possibly logging these IDs on their own servers
77 months ago
I thought we won the cold war! But now Russia is crushing our corrupt capitalist country, just like they said they would!!! ;)
77 months ago
How will this impact those of us that have an iPad and an iPhone? Will we be required to pay for the app 1 time, but the in-app stuff twice?? :confused::confused::confused:
Not if they do it right. They can record the purchase with your account so a "restore purchases" event would trigger that your other devices get their own authorization to run the app. If done right it should create a serious hurdle for the hack.
I'd like to know if they have fixed the sending of the credentials in clear text. I am not sure if there was really a vulnerability here since the overall communication is encrypted according to the installed certificates on the device, but the hacker seemed surprised or disappointed that faking the certs gave him access to the credentials of any user exploiting his hack. I'm not sure if another layer of encryption would make sense here (i.e.: using a public key from Apple with Apple being the only holder of the private key -- then again, that public key would still have to be stored among the device certificates so I am not really seeing any additional layer of protection -- I am seeing that as being a good way to use the hack without exposing your credentials to the hacker's server).
77 months ago
That happened to me already - because the old system had sometimes setups where this wasn't tracked. In my opinion, in-App-purchases should be handled the same way App purchases are. Put it on the "purchased" list in the App store.
Agreed. I've never understood why this wasn't the case from day one.
77 months ago
The Next Web are reporting this is NOT the same as the UDID:
http://thenextweb.com/2012/07/18/apple-adds-uniqueidentifier-to-in-app-purchase-receipts-not-udid-may-be-related-to-recent-breach/
----------
If you can't run your validation server, check out these guys who seem to do it for free:
http://thenextweb.com/apple/2012/07/18/developers-beeblex-offers-super-secure-and-completely-free-in-app-purchase-validation-for-ios-apps/
The addition of the field was reported by Macrumors, but contrary to its article, it does not appear to contain a Unique Device Identifier (UDID), something that Apple has been instructing developers to move away from.
http://thenextweb.com/2012/07/18/apple-adds-uniqueidentifier-to-in-app-purchase-receipts-not-udid-may-be-related-to-recent-breach/
----------
As a developer, and one who is just starting to get into paid apps, I wish there were things Apple could implement to allow better control of piracy. I'm worried that my $50 app* would get pirated, or even my $0.99 ones. Setting up push servers is one thing (and expensive), but validation servers would be a pain as well.
* It's a medical database thing, thus sadly it's expensive, hopefully it'll have sales.
If you can't run your validation server, check out these guys who seem to do it for free:
http://thenextweb.com/apple/2012/07/18/developers-beeblex-offers-super-secure-and-completely-free-in-app-purchase-validation-for-ios-apps/
77 months ago
Yes. The world we live in today is almost unbearable. All these wars of opportunity complete with extrajudicial killings funded by casino capitalism. While a naive self-absorbed population frets endlessly about... pirated software? What a shame indeed.
There's a difference between fretting and having a conversation. :rolleyes:
[ Read All Comments ]
A USB-based vulnerability that allows for the brute forcing of a passcode on an iOS device has been discovered by security researcher Matthew Hickey, reports ZDNet.
The method, which bypasses...
For this week's giveaway, we've teamed up with Fuse to offer MacRumors readers a chance to win a Side Winder, which is an accessory that's designed to let you quickly and easily wind up...
Alongside a major version 3.0 update that rolled out to its iOS app [Direct Link] earlier this week, Turner Classic Movies has also expanded support for its "Watch TCM" app to tvOS devices....
Nanoleaf's new 12-sided light-up remote joins its existing Nanoleaf Light Panels and Nanoleaf Rhythm, adding a whole slew of smartphone-free physical control options for your HomeKit setup in one...
Apple Maps vehicles equipped with LiDAR sensors have begun collecting street-level data in Japan for the first time this month.
Apple will be surveying the Tokyo and Urayasu areas between...
Microsoft has announced a new visual search feature for its Bing app that lets users snap a picture with their phone's camera and use it to search the web.
The new visual search function...
Some 60 billion messages are sent over the WhatsApp chat platform every day. One of the reasons for the service's massive popularity is that it lets users send and receive as many media-rich...
eBay today launched its latest sitewide coupon code, offering customers the chance to save $15 on orders that reach or exceed $75. The code isn't as enticing as eBay's previous...
