In-App Purchase Vulnerability to Be Fixed in iOS 6; Apple Offers Best Practices to Developers
As noticed by 9to5Mac, Apple has offered developers a series of best practices to prevent the In-App Purchase vulnerability, as well as promising a full fix in iOS 6. The advisement was sent to developers in an email today.
CNET was issued this statement by Apple:
"We recommend developers follow best practices at developer.apple.com to help ensure they are not vulnerable to fraudulent In-App purchases," Apple spokesperson Tom Neumayr told CNET. "This will also be addressed with iOS 6."
Apple issued this note to developers on the iOS Developer webpage, along with a series of suggestions to help verify that in-app purchases are legitimate:
A vulnerability has been discovered in iOS 5.1 and earlier related to validating in-app purchase receipts by connecting to the App Store server directly from an iOS device. An attacker can alter the DNS table to redirect these requests to a server controlled by the attacker. Using a certificate authority controlled by the attacker and installed on the device by the user, the attacker can issue a SSL certificate that fraudulently identifies the attacker’s server as an App Store server. When this fraudulent server is asked to validate an invalid receipt, it responds as if the receipt were valid.
News of the in-app purchase hack broke a week ago, and Apple has made several attempts to prevent users using the hack. It allows users to avoid paying for in-app purchases by using a third-party server as a "man-in-the-middle" attack. Apple now includes the UDID identifier in in-app purchase receipts in an attempt to increase the security of purchases.
Popular Stories
Game emulator apps have come and gone since Apple announced App Store support for them on April 5, but now popular game emulator Delta from developer Riley Testut is available for download. Testut is known as the developer behind GBA4iOS, an open-source emulator that was available for a brief time more than a decade ago. GBA4iOS led to Delta, an emulator that has been available outside of...
iOS 18 is expected to be the "biggest" update in the iPhone's history. Below, we recap rumored features and changes for the iPhone. iOS 18 is rumored to include new generative AI features for Siri and many apps, and Apple plans to add RCS support to the Messages app for an improved texting experience between iPhones and Android devices. The update is also expected to introduce a more...
The first approved Nintendo Entertainment System (NES) emulator for the iPhone and iPad was made available on the App Store today following Apple's rule change. The emulator is called Bimmy, and it was developed by Tom Salvo. On the App Store, Bimmy is described as a tool for testing and playing public domain/"homebrew" games created for the NES, but the app allows you to load ROMs for any...
Apple today said it removed Game Boy emulator iGBA from the App Store for violating the company's App Review Guidelines related to spam (section 4.3) and copyright (section 5.2), but it did not provide any specific details. iGBA was a copycat version of developer Riley Testut's open-source GBA4iOS app. The emulator rose to the top of the App Store charts following its release this weekend,...
Last September, Apple's iPhone 15 Pro models debuted with a new customizable Action button, offering faster access to a handful of functions, as well as the ability to assign Shortcuts. Apple is poised to include the feature on all upcoming iPhone 16 models, so we asked iPhone 15 Pro users what their experience has been with the additional button so far. The Action button replaces the switch ...
A week after Apple updated its App Review Guidelines to permit retro game console emulators, a Game Boy emulator for the iPhone called iGBA has appeared in the App Store worldwide. The emulator is already one of the top free apps on the App Store charts. It was not entirely clear if Apple would allow emulators to work with all and any games, but iGBA is able to load any Game Boy ROMs that...
Top Rated Comments
The way I basically see it, is the in-app purchases (especially games) feed on a user's craving for "more" out of the game. When a user realizes they cannot advance in a game or achieve a goal in the game without the in-app purchase, they will tap a button and charge a fee to their Apple Store account. A few of these "taps" and the user feels comfortable using this feature....and before you know it, they have tacked on $200 in fees for a $2.99 or FREE game download originally. The whole thing feeds on an addictive-nature to get you "hooked" on using the in-app purchases with the game....and it's making developer's bookoos of money. Now that a hacker has circumvented this, devs are crying about it, but the truth of the matter is in-app purchases are an evil, luring, deceptive, scheming beast altogether to sucker the public into forking over their wallets!!!
And that, my friends, is the reason I refuse to download and use apps and games with the in-app purchase feature. It's a gimmick made by *greedy greedy* developer types, and I am not buying into any of that junk, at all. Just not worth it.
It's a free market. I have the power to choose how I develop and sell my IP. If you don't like it, don't buy it. Simple.
And not all IAP use is of this sort, some of it is for removing ads etc. And in some cases the games (which are what commonly use this ploy) are still playable although at a slower rate without playing. Or like Temple Run let you earn in game coins to buy the enhancements
If you're enjoying a developers hard work and not paying for it - then you are stealing that developers time. It'd be akin to going to a barbers - getting a haircut and not paying for it... You've not stolen anything physical from him, but you have stolen his time from him - he gave you a service, you didn't pay.
You can try to justify that however you like, but that barber gave you a service you didnt pay for, and as such you have just stolen from him. Same goes for software development - people spend their time to make something for you to enjoy - if you benefit from it and havent paid for it, that is theft. Pure and simple.
If you worked for your boss for a month, only for him to refuse to pay you at the end of that.. And just laughed it off as "piracy" - how would that make you feel? He's got the benefit of your work but refused to pay you for it.
I put a LOT of time and effort into my software - if i cant put food on the table because people are ripping my work off... then i'll stop doing it.. If everyone did that - then you'd have nothing left to pirate.
I guess that's just the way the self-entitled nature of todays kids are...
Never buy a game that isn’t worth the price you paid, “right out of the box"; reviews will help, and if you get ripped off I fee your pain.
And if the game IS worth what you paid, then there’s no need to get any more value, for free, out of the programmer’s sweat and dreams.
Therefore, buy the add-ons if they’re worth it, skip them if they’re not, but don’t steal them.
Some companies charge absurd prices for their games. Some do that for their IAP. Skip those companies, rather than spreading hacks that hurt everyone.
You’re making the mistake of assuming that ALL IAP works the same and is a rip-off. It’s not.
And how do you know whether a developer is greedy or not? Maybe they should include all 500 levels in the original $1 game, say, and not just 200. But do we know what it cost him to develop that app and those levels? Do we know what his rent, food and health care cost? Are we asking him to give us more for free than we’d be willing to in his shoes?
I think it’s fair for a developer to set any kind of business model they want, as long as they’re honest about what it is. You can then skip those games that aren’t worth it to you.