New in OS X: Get MacRumors Push Notifications on your Mac

Resubscribe Now Close

Apple Now Including Unique Identifiers for In App Purchase Receipts to Combat Hack

Wednesday July 18, 2012 12:49 pm PDT by Eric Slivka
Following last week's launch of a hack that allowed users to obtain In App Purchase content free of charge by routing their purchase requests through a server run by a Russian hacker, Apple began taking steps to thwart the method. The hacker has, however, continued to develop his method to skirt around Apple's roadblocks.

One of the suggestions for a method by which Apple could improve the security of In App Purchasing was to include a unique identifier in validation receipts, and we've received word that developers are now seeing something along those lines coming from receipts issued by Apple since late yesterday. The receipts carry a new field called "unique_identifer" that appears to include the Unique Device Identifier (UDID) for the device making the In App Purchase.

As one developer noted to us, apps are no longer supposed to be collecting the UDID and thus it is unclear whether Apple's use of the identifier for this purpose is simply a first step toward a broader implementation of unique receipt identifiers for increased security or if Apple is attempting to identify those users and devices who are sharing their receipts with the Russian hacker to allow the method to function.

[ 46 comments ]


Top Rated Comments

(View all)

Avatar
Nabby
86 months ago
Mulitple devices/replacement devices

How will this impact those of us that have an iPad and an iPhone? Will we be required to pay for the app 1 time, but the in-app stuff twice?? :confused::confused::confused:
Rating: 12 Votes
Avatar
roland.g
86 months ago
Maybe a UK judge can require the hacker to include the text "this receipt is a copy of a legitimate and cool receipt" for the next 6 months on all receipts and on his website.
Rating: 11 Votes
Avatar
daxomni
86 months ago

It's a shame that Apple even needs to do this. The world we live in today...

Yes. The world we live in today is almost unbearable. All these wars of opportunity complete with extrajudicial killings funded by casino capitalism. While a naive self-absorbed population frets endlessly about... pirated software? What a shame indeed.
Rating: 8 Votes
Avatar
Rudy69
86 months ago

As one developer noted to us, apps are no longer supposed to be collecting the UDID and thus it is unclear whether Apple's use of the identifier for this purpose is simply a first step toward a broader implementation of unique receipt identifiers for increased security or if Apple is attempting to identify those users and devices who are sharing their receipts with the Russian hacker to allow the method to function.

They might allow developers to use it to check if the purchase is valid. There's a huge difference between that and developers using it to track users and possibly logging these IDs on their own servers
Rating: 5 Votes
Avatar
Mjmar
86 months ago
It's a shame that Apple even needs to do this. The world we live in today...
Rating: 5 Votes
Avatar
iSee
86 months ago
I thought we won the cold war! But now Russia is crushing our corrupt capitalist country, just like they said they would!!! ;)
Rating: 5 Votes
Avatar
BC2009
86 months ago

How will this impact those of us that have an iPad and an iPhone? Will we be required to pay for the app 1 time, but the in-app stuff twice?? :confused::confused::confused:


Not if they do it right. They can record the purchase with your account so a "restore purchases" event would trigger that your other devices get their own authorization to run the app. If done right it should create a serious hurdle for the hack.

I'd like to know if they have fixed the sending of the credentials in clear text. I am not sure if there was really a vulnerability here since the overall communication is encrypted according to the installed certificates on the device, but the hacker seemed surprised or disappointed that faking the certs gave him access to the credentials of any user exploiting his hack. I'm not sure if another layer of encryption would make sense here (i.e.: using a public key from Apple with Apple being the only holder of the private key -- then again, that public key would still have to be stored among the device certificates so I am not really seeing any additional layer of protection -- I am seeing that as being a good way to use the hack without exposing your credentials to the hacker's server).
Rating: 4 Votes
Avatar
daxomni
86 months ago

That happened to me already - because the old system had sometimes setups where this wasn't tracked. In my opinion, in-App-purchases should be handled the same way App purchases are. Put it on the "purchased" list in the App store.

Agreed. I've never understood why this wasn't the case from day one.
Rating: 4 Votes
Avatar
gkpm
86 months ago
The Next Web are reporting this is NOT the same as the UDID:


The addition of the field was reported by Macrumors, but contrary to its article, it does not appear to contain a Unique Device Identifier (UDID), something that Apple has been instructing developers to move away from.


http://thenextweb.com/2012/07/18/apple-adds-uniqueidentifier-to-in-app-purchase-receipts-not-udid-may-be-related-to-recent-breach/

----------

As a developer, and one who is just starting to get into paid apps, I wish there were things Apple could implement to allow better control of piracy. I'm worried that my $50 app* would get pirated, or even my $0.99 ones. Setting up push servers is one thing (and expensive), but validation servers would be a pain as well.

* It's a medical database thing, thus sadly it's expensive, hopefully it'll have sales.


If you can't run your validation server, check out these guys who seem to do it for free:

http://thenextweb.com/apple/2012/07/18/developers-beeblex-offers-super-secure-and-completely-free-in-app-purchase-validation-for-ios-apps/
Rating: 3 Votes
Avatar
Mjmar
86 months ago

Yes. The world we live in today is almost unbearable. All these wars of opportunity complete with extrajudicial killings funded by casino capitalism. While a naive self-absorbed population frets endlessly about... pirated software? What a shame indeed.


There's a difference between fretting and having a conversation. :rolleyes:
Rating: 2 Votes

[ Read All Comments ]