In-App Purchase Vulnerability to Be Fixed in iOS 6; Apple Offers Best Practices to Developers

As noticed by 9to5Mac, Apple has offered developers a series of best practices to prevent the In-App Purchase vulnerability, as well as promising a full fix in iOS 6. The advisement was sent to developers in an email today.

NewImage
CNET was issued this statement by Apple:

"We recommend developers follow best practices at developer.apple.com to help ensure they are not vulnerable to fraudulent In-App purchases," Apple spokesperson Tom Neumayr told CNET. "This will also be addressed with iOS 6."

Apple issued this note to developers on the iOS Developer webpage, along with a series of suggestions to help verify that in-app purchases are legitimate:

A vulnerability has been discovered in iOS 5.1 and earlier related to validating in-app purchase receipts by connecting to the App Store server directly from an iOS device. An attacker can alter the DNS table to redirect these requests to a server controlled by the attacker. Using a certificate authority controlled by the attacker and installed on the device by the user, the attacker can issue a SSL certificate that fraudulently identifies the attacker’s server as an App Store server. When this fraudulent server is asked to validate an invalid receipt, it responds as if the receipt were valid.

News of the in-app purchase hack broke a week ago, and Apple has made several attempts to prevent users using the hack. It allows users to avoid paying for in-app purchases by using a third-party server as a "man-in-the-middle" attack. Apple now includes the UDID identifier in in-app purchase receipts in an attempt to increase the security of purchases.

Top Rated Comments

ideal.dreams Avatar
116 months ago
I'm so-so on this. I can understand paying in-app for an application you initially downloaded for free, but if you've already paid for an app, why should you have to pay MORE to gain enhancements? I'm all for supporting the developers, believe me, I know that they work hard and it's a steady income for most, but I'm not going to find myself paying additional money for something in an app that I've already paid for to get more from the app.
Score: 6 Votes (Like | Disagree)
WardC Avatar
116 months ago
Apple needs to step in and make in-app purchases illegal altogether...all that stuff is just a ploy and gimmick to make developer's more money. If I am paying for an application, I don't want "half-ass" functionality which requires 10-100x what I paid for the app to get to use all the features. That is just ridiculous!

The way I basically see it, is the in-app purchases (especially games) feed on a user's craving for "more" out of the game. When a user realizes they cannot advance in a game or achieve a goal in the game without the in-app purchase, they will tap a button and charge a fee to their Apple Store account. A few of these "taps" and the user feels comfortable using this feature....and before you know it, they have tacked on $200 in fees for a $2.99 or FREE game download originally. The whole thing feeds on an addictive-nature to get you "hooked" on using the in-app purchases with the game....and it's making developer's bookoos of money. Now that a hacker has circumvented this, devs are crying about it, but the truth of the matter is in-app purchases are an evil, luring, deceptive, scheming beast altogether to sucker the public into forking over their wallets!!!

And that, my friends, is the reason I refuse to download and use apps and games with the in-app purchase feature. It's a gimmick made by *greedy greedy* developer types, and I am not buying into any of that junk, at all. Just not worth it.
Score: 5 Votes (Like | Disagree)
jeckels Avatar
116 months ago
Some of the in-app purchases are just ridiculous but still doesn't mean you should cheat a developer out of money. They need to make a living too.
Score: 5 Votes (Like | Disagree)
charlituna Avatar
116 months ago
Apple needs to step in and make in-app purchases illegal altogether...all that stuff is just a ploy and gimmick to make developer's more money.

It's a free market. I have the power to choose how I develop and sell my IP. If you don't like it, don't buy it. Simple.

And not all IAP use is of this sort, some of it is for removing ads etc. And in some cases the games (which are what commonly use this ploy) are still playable although at a slower rate without playing. Or like Temple Run let you earn in game coins to buy the enhancements
Score: 4 Votes (Like | Disagree)
MrClam Avatar
116 months ago
What i find interesting is that when pirates normally try to justify their actions - they usually use the high price of software as an excuse, and that if prices were cheaper.. They'd stop doing it.

If you're enjoying a developers hard work and not paying for it - then you are stealing that developers time. It'd be akin to going to a barbers - getting a haircut and not paying for it... You've not stolen anything physical from him, but you have stolen his time from him - he gave you a service, you didn't pay.

You can try to justify that however you like, but that barber gave you a service you didnt pay for, and as such you have just stolen from him. Same goes for software development - people spend their time to make something for you to enjoy - if you benefit from it and havent paid for it, that is theft. Pure and simple.

If you worked for your boss for a month, only for him to refuse to pay you at the end of that.. And just laughed it off as "piracy" - how would that make you feel? He's got the benefit of your work but refused to pay you for it.

I put a LOT of time and effort into my software - if i cant put food on the table because people are ripping my work off... then i'll stop doing it.. If everyone did that - then you'd have nothing left to pirate.

I guess that's just the way the self-entitled nature of todays kids are...
Score: 4 Votes (Like | Disagree)
nagromme Avatar
116 months ago
I'm so-so on this. I can understand paying in-app for an application you initially downloaded for free, but if you've already paid for an app, why should you have to pay MORE to gain enhancements? I'm all for supporting the developers, believe me, I know that they work hard and it's a steady income for most, but I'm not going to find myself paying additional money for something in an app that I've already paid for to get more from the app.
How will I pay for making new levels for my game (no, I don’t really have one—right now) if you think all additions should be made free?

Never buy a game that isn’t worth the price you paid, “right out of the box"; reviews will help, and if you get ripped off I fee your pain.

And if the game IS worth what you paid, then there’s no need to get any more value, for free, out of the programmer’s sweat and dreams.

Therefore, buy the add-ons if they’re worth it, skip them if they’re not, but don’t steal them.

Some companies charge absurd prices for their games. Some do that for their IAP. Skip those companies, rather than spreading hacks that hurt everyone.


Apple needs to step in and make in-app purchases illegal altogether...all that stuff is just a ploy and gimmick to make developer's more money. If I am paying for an application, I don't want "half-ass" functionality which requires 10-100x what I paid for the app to get to use all the features. That is just ridiculous!

The way I basically see it, is the in-app purchases (especially games) feed on a user's craving for "more" out of the game. When a user realizes they cannot advance in a game or achieve a goal in the game without the in-app purchase, they will tap a button and charge a fee to their Apple Store account. A few of these "taps" and the user feels comfortable using this feature....and before you know it, they have tacked on $200 in fees for a $2.99 or FREE game download originally. The whole thing feeds on an addictive-nature to get you "hooked" on using the in-app purchases with the game....and it's making developer's bookoos of money. Now that a hacker has circumvented this, devs are crying about it, but the truth of the matter is in-app purchases are an evil, luring, deceptive, scheming beast altogether to sucker the public into forking over their wallets!!!

And that, my friends, is the reason I refuse to download and use apps and games with the in-app purchase feature. It's a gimmick made by *greedy greedy* developer types, and I am not buying into any of that junk, at all. Just not worth it.
You’re making the mistake of assuming that ALL IAP works the same and is a rip-off. It’s not.

And how do you know whether a developer is greedy or not? Maybe they should include all 500 levels in the original $1 game, say, and not just 200. But do we know what it cost him to develop that app and those levels? Do we know what his rent, food and health care cost? Are we asking him to give us more for free than we’d be willing to in his shoes?

I think it’s fair for a developer to set any kind of business model they want, as long as they’re honest about what it is. You can then skip those games that aren’t worth it to you.
Score: 4 Votes (Like | Disagree)

Top Stories

YouTube Picture in Picture Feature

YouTube Says iOS Picture-in-Picture Coming to All US Users

Friday June 18, 2021 9:41 am PDT by
After a long wait, YouTube for iOS is officially gaining picture-in-picture support, allowing all users, non-premium and premium subscribers, to close the YouTube app and continue watching their video in a small pop-up window. In a statement to MacRumors, YouTube says that picture-in-picture is currently rolling out to all premium subscribers on iOS and that a larger rollout to all US iOS...
Top Stories 63 Feature

Top Stories: Beats Studio Buds Announced, Apple Watch Series 7 Rumors, and More

Saturday June 19, 2021 6:00 am PDT by
The Apple news cycle started to move beyond WWDC this week, but that doesn't mean there still wasn't a lot to talk about, led by the official debut of the much-leaked Beats Studio Buds that might give us a hint of what to expect for the second-generation AirPods Pro. With no hardware announcements at WWDC, we also took a look at when we might finally see the long-rumored redesigned MacBook...
ios wifi settings

iOS Bug Causes Specific Network Name to Disable Wi-Fi on iPhones

Sunday June 20, 2021 4:15 am PDT by
A wireless network naming bug has been discovered in iOS that effectively disables an iPhone's ability to connect to Wi-Fi. Security researcher Carl Schou found that after joining a Wi-Fi network with the name "%p%s%s%s%s%n" his iPhone's Wi-Fi functionality was left "permanently disabled." Changing a hotspot's SSID did nothing to correct the problem, with even a reboot failing to make a...
maxresdefault

Video: 20 Annoyances Apple Fixed in iOS 15 and macOS Monterey

Friday June 18, 2021 11:36 am PDT by
With iOS 15 and macOS Monterey, Apple is adding several quality of life improvements, which are designed to address some of the complaints that people have had with these operating systems for years now. Subscribe to the MacRumors YouTube channel for more videos. In our latest YouTube video, we're highlighting some of our favorite "fix" features that address long-running problems in iOS and...
16 inch macbook pro m2 render

When Can We Expect the Redesigned MacBook Pros Now?

Wednesday June 16, 2021 7:11 am PDT by
With no sign of redesigned MacBook Pro models at this year's WWDC, when can customers expect the much-anticipated new models to launch? A number of reports, including investor notes from Morgan Stanley and Wedbush analysts, claimed that new MacBook Pro models would be coming during this year's WWDC. This did not happen, much to the disappointment of MacBook Pro fans, who have been...
space gray magic accessories trio

Apple Stops Selling Magic Accessories in Space Gray

Friday June 18, 2021 9:16 am PDT by
Apple this week stopped selling its Magic Keyboard with Numeric Keypad, Magic Mouse 2, and Magic Trackpad 2 accessories for the Mac in a Space Gray color, around three months after discontinuing the iMac Pro, which also came in Space Gray. Last month, Apple listed the Space Gray accessories as available while supplies last, and the company has now removed the product pages from its website...
m1 v intel thumb

Intel Processor Market Share May Fall to New Low Next Year Due to Apple Silicon

Friday June 18, 2021 2:06 am PDT by
Intel may see its market share fall to a new low next year, in large part thanks to Apple's decision to move away from using Intel processors in its Mac computers and instead use Apple silicon. Apple announced last year that it would embark on a two-year-long journey to transition all of its Mac computers, both desktops, and laptops, to use its own in-house processors. Apple is expected to...
3nm apple silicon feature

Apple Supplier TSMC Readies 3nm Chip Production for Second Half of 2022

Friday June 18, 2021 6:59 am PDT by
Apple supplier TSMC is preparing to produce 3nm chips in the second half of 2022, and in the coming months, the supplier will begin production of 4nm chips, according to a new report from DigiTimes. Apple had previously booked the initial capacity of TSMC's 4nm chip production for future Macs and more recently ordered TSMC to begin production of the A15 chip for the upcoming iPhone 13,...
2021 back t0 school

Apple Launches 2021 Back to School Promotion: Free AirPods With Eligible Mac or iPad Purchase

Thursday June 17, 2021 4:56 am PDT by
Apple today launched its seasonal back-to-school sale for the upcoming school year in the United States and Canada, offering students free AirPods alongside purchases of select Macs and iPad models. Similar to last year's promotion, this year's offer includes free AirPods alongside the purchase of a MacBook Air, MacBook Pro, the new 24-inch iMac, the Mac Pro, Mac mini, and the new M1-powered ...
applecare lower prices

Apple Lowers Prices of AppleCare+ Plans for M1 MacBook Air and MacBook Pro

Thursday June 17, 2021 7:33 am PDT by
Apple today lowered the prices of AppleCare+ plans for MacBook Air and 13-inch MacBook Pro models equipped with the M1 chip. Coverage offered by the plans, as well as accidental damage fees, appear to remain unchanged. In the United States, AppleCare+ for the MacBook Air now costs $199, down from $249. The new price applies to both M1 and Intel-based MacBook Air models, although Apple no...