Russian Hacker Sidesteps Apple iOS In-App Purchases 142
An anonymous reader tips news that a Russian developer has posted a video showing how in-app purchases for some iOS software can be acquired without payment. The hack does't require the device to be jailbroken, and can be accomplished even by users who aren't technically proficient. The method involves three steps: "The installation of CA certificate, the installation of in-appstore.com certificate, and the changing of DNS record in Wi-Fi settings. After the quick process, users are presented with the message pictured above when installing in-app purchases, opposed to Apple’s usual purchase confirmation dialog." 9to5mac notes that this doesn't affect all apps, since some of them make use of Apple's method for validating receipts.
Thanks Slashdot! (Score:5, Informative)
Before even the first 50 apple flame posts are up for this story, the loophole will be closed. The first rule of the free app hack is that YOU DO NOT TALK ABOUT THE FREE APP HACK.
Re:Thanks Slashdot! (Score:1, Informative)
Since apparently the 10 remaining people on Slashdot now all have Aspergers, you should note that my first post was meant to be sarcastic and facetious.
To any Apple Security Service (A.S.S.) personnel, I would like to note that I do not own an i/Phone/Pad/whatever and therefore have no interest in stealing your precious apps. Oh wait.. I just realized that not owning an iWhatever makes me an even bigger criminal than that Russian dude! Time to flee the country (again)!
Re:Pay the price (Score:5, Informative)
It depends on the app. Apps have two choices with regards to in-app purchases. They can go through the official Apple Store receipt mechanism, or choose not to. Usually purchases for stuff that "expire" don't (because the receipt method prevents a user from buying it again, so your $99 smurfberry pack can only be bought once), while stuff that may need to be reloaded does (e.g., DLC, so if you reinstall your app, you can redownload your previous in-app purchases because the app verifies with Apple what DLC you already own).
It's possible to do a hybrid system were some DLC is offered using the former system (usually to offer it "free" instead of requiring payment) - I believe developers host the additional content so if they wanted to give it for free, they tell the app they can get access to it. Of course, without an Apple receipt for it, if the developer removes the access, you've lost it. It's how the Atari thing let people get all games, but it goes away on next install (Atari updated the game's flags to say you own all the games, but if the app checks against Apple, it says you own none which is the case on reinstall).
The former could be acquired "for free" by using a jailbroken device with IAPCracker installed. The ones that check don't because they do confirmations with Apple to ensure it really was purchased.
Re:Thanks Slashdot! (Score:5, Informative)
It was closed before the hack. App developers just didn't bother to implement receipt authorization that's built into the store, allowing their apps to be tricked.
The question is why Apple didn't make authorization mandatory. But if they did then there'd be bitching about that too.
Comment removed (Score:5, Informative)
Comment removed (Score:5, Informative)
Liar (Score:3, Informative)
You must be one of those kiddies who shit their pants at the thought of violating a EULA or live in corporate USA. But for normal people in the free world, you are free to do anything to any bit on your computer.
EULA's cannot take away fundemental rights and I have the right to remix, video/music and data anyway I want. FOR MYSELF! As long as I do not redistribute copyright material YOU FUCKING MORON, copyright laws are not applicable.
And this guy is NOT distributing copyrighted material that does not belong to him, he is merely distributing the tool to allow others to modify theirs. So unless you were stupid enough to elect politicians who voted for the DMCA and other such bought laws, there is NOTHING illegal about any of this.
If you had a brain and did not just suck corporate dick you would know that the modding scene does this kind of thing routinely AND with encouragement. Create a new map using copyrighted resources? Go right ahead. As long as you only distribute the new map, not the textures and other resources from the game (which shouldn't be needed because the person downloading the map already has them from his own game).
Oh and it has been proven by the court that software licenses do not work as your diseased mind think it does. You can sell on software. When I buy software, I am free to modify it in any way I want. Good luck trying to enforce anything else in the free world. It would actually be rather nice if it was the other way around. Then software companies would also have to accept 100% liability for anything their software does on MY hardware. After all, it is THEIR property right?
Take Bill Gates dick out of your mouth long enough to get some fresh air and see if you can get that peanut in your head to think some independent thoughts.