Security fail for Apple as hacker cracks iOS in-app purchasing A Russian hacker claims to have found a way to crack the in-app purchasing mechanism used in iOS so that users can get free content in a variety of applications. The hacker, dubbed ZonD80, posted a video of the crack on YouTube and claims that the technique makes it possible to beat Apple's payment systems by installing a …
A bit harsh.
Russian is a very different language from English, it has a different word order and rules, different alphabet no word for 'the' or 'a' and no present tense of the verb to be.
He's not doing too badly, when you know that. (Certainly much better than Google translate, and definitely better than I could do in the opposite direction.)
and no present tense of the verb to be
My Russian is rusty and overall bad but that's a common misconception. There is such verb -- есть, it's just usually skipped unless it means 'have'. Yes, it's the same verb that means "I am" and "I have". And even Russian is not the single language to have the same verb for 'to be' and 'to have'
Reference: http://en.wiktionary.org/wiki/есть
""Why you must to pay for content, already included in purchased app? I think, you must not."
Ah, the logic of the pirate never more clearly put. Doesn't matter what you agree to, doesn't matter what the people who create the work want to sell it for work for or how, ZonD80 "thinks you must not".
This post has been deleted by its author
Harms the freemium game market
How selfish - a number of apps are free or are cheap given the production costs as they rely on users paying (not a lot) for content when they enjoy a game and feel like investing more than time. This hack will mainly harm the investment of freemium developers or put many small developers out of business. I can't see Apple allowing that to happen for long.
Freemium? What you mean those free games aimed at children, which entice your child to hand over the GDP of a Central American country, for a few pointless virtual trinkets? The apps which only continue to make money because people don't know (how) to make there App Store settings sane before handing their phone over to a child?
Android recently had a colouring game that was a great example of the worst sort of freemium. Appears that most/all platforms are afflicted.
BTW, I wouldn't use, recommend or condone the use of this crack, for many reasons. However, if it kills the freemium model, that has to be good.
This post has been deleted by its author
The whole thing seems to be breaking into pieces already, his server having been blocked from Apple's servers so it's already more complicated to setup.
His Paypal account has been blocked as well so he's down to accepting Bitcoins. I guess his Blogger account will be next.
Not to mention the huge dumb move that is accepting this guy's root security certificate.
It's all a bit pathetic, especially since most apps are available cracked.
apparently 30,000 people have given him their usernames and passwords via this method, but he's only gotten less than $7 in paypal donations.
turns out, the kind of people who want to get free in-app purchases by any means aren't all that generous towards the hackers that help them either. who'da thought it?
http://www.macrumors.com/2012/07/13/hacker-releases-tools-for-bypassing-apples-in-app-purchase-mechanism/
I can add another point of logic:
The kind of people who think it's OK to steal in-app content, and will go so far as to provide their itunes information (if it's even theirs) to a stranger in order to do so, are not going to ever purchase any in-app content.
So as a developer, I can tell you, I couldn't care less that these people do what they do--they weren't going to buy anything from my apps anyway.
Is publishing that video legal? According to the UK Copyright act of 1988 a copyright owner has rights against a person "publishes information intended to enable or assist persons to circumvent that form of copy-protection,"
http://www.legislation.gov.uk/ukpga/1988/48/part/VII/enacted?timeline=true
Or has this changed?
Do you mean publishing the link to the video?
Since it is Russian, and unlike us, they take their sovereignty seriously, our law won't apply there.
You might be confusing the situation with the situation here, where if you commit an act that is a crime in the US but not, here you get extradited.
Actually since the video was hosted in the US, it's Russian laws that don't apply.
As for this article, the video was embedded, not linked, in a UK publication, so surely UK law regarding publishing applies.
Anyway it's all rather moot now, the video was removed under US law.
If it's client based authorization, i.e. asking apple if something has been bought - it's only normal to be able to "hack", no much security can save the case.
If the application relies on the server (3rd party) to provide content then the hacking won't be viable. I really see no news here.
According to Borodin, only developers using their own servers to verify in-app purchases are able to dodge the hack.
I found that quote a bit later - and it has always been known to be the case. It's not possible to reliable authenticate anything without a 3rd party doing the authentication That's why there are root certs.
As a last note: If Apple is willing to sign explicitly all transaction tickets responses with a private key, then it will work. SSL alone can be fooled by root cert installation but an explicit offline public key - not so much.
This post has been deleted by its author
Tried to watch the video in the article, I get this most frightening mouthful....
""In-appstore.comGet in-app" video ei ole enää käytettävissä käyttäjän Apple, inc tekemän tekijänoikeus vaatimuksen vuoksi."
Which means (had to use Google Translate, can't be bothered to fathom it out, but you'll get the drift...)
"In-appstore.comGet in-app" the video is no longer available to the user of Apple, inc copyright claim by reason."
Freenium is bulls*ht anything that destroys that business model is for the greater good.
(Compared to a Sega or Square Enix classic the quality is dire - The humble Android bundles have content that is fairly mediocre but you get allot for even the average price - Freenium is totally and utterly dire. (Zen Pinball I suppose is ok one free table and you pay for more but not micro transactions or adware).
This post has been deleted by its author
Sounds like lazy developers who do not bother to ensure they are calling back to validate the transaction with Apple's servers.
If you want to hand over your DNS resolution etc. to some Russian hackers please accept everything you deserve - probably much more than the £0.59 you saved on buying the game legitimately.
Why should I spend time, effort and server resources to set up a verification server when I can use my time and skill to make my app better? Or to make new apps?
As has been pointed out by many, these folks weren't going to buy content anyway.
So don't call me lazy.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
