Help
Post your comments for Hacker exploits iOS flaw for free in-app purchases here
Hacker exploits iOS flaw for free in-app purchases
#2
joellimberg 
- Newbie
-
- Group: New Members
- Posts: 1
- Joined: 13-July 12
Posted 13 July 2012 - 11:54 AM
"Borodin said that he was "shocked" that passwords were passed in plain text and not encrypted."
This data is normally passed through a secure connection. How is it Apple's fault if the user decides to install a middleman and pass data through them?
This data is normally passed through a secure connection. How is it Apple's fault if the user decides to install a middleman and pass data through them?
#3
hayesk
- Veteran
-
- Group: Members
- Posts: 1,809
- Joined: 07-August 04
Posted 13 July 2012 - 12:03 PM
Borodin's rationalization for stealing from the developer is pure BS. If you don't like that the developer expects you to pay for extra parts of the game, then don't play it.
Kudos for him for showing Apple a flaw, but that doesn't justify his actions.
Kudos for him for showing Apple a flaw, but that doesn't justify his actions.
#4
johndrake
- Member
-
- Group: Macworld Insiders
- Posts: 655
- Joined: 11-December 07
Posted 13 July 2012 - 12:09 PM
They will hire me, this guys had his head up somewhere, and it's not a cloud!
I'm not at all surprised by the greed this all points out, but hopefully those eager to exploit the hack end up on the short end of the stick, by getting hacked in return, and that their accounts are are cleaned out and credit shot to he!! !!
I'm not at all surprised by the greed this all points out, but hopefully those eager to exploit the hack end up on the short end of the stick, by getting hacked in return, and that their accounts are are cleaned out and credit shot to he!! !!
#5
jdb8167
- Veteran
-
- Group: Members
- Posts: 2,541
- Joined: 30-August 04
Posted 13 July 2012 - 12:10 PM
Thanks for the thorough explanation of the hack and work arounds. This is the best analysis I've seen so far. Including the problems with iOS vs server validation was the information that I've been searching for but was missing from other reports.
#6
lgladdy
- Newbie
-
- Group: New Members
- Posts: 2
- Joined: 13-July 12
Posted 13 July 2012 - 12:26 PM
I'm pretty sure this bypasses the "secure, web-based receipt validation" - it's why you have to install the itunes.com/apple.com certificates onto the phone. Apps can phone back, but they don't get to talk to apple, they get the fake server which simulates a "yes, this is all good" response...
#7
lgladdy
- Newbie
-
- Group: New Members
- Posts: 2
- Joined: 13-July 12
Posted 13 July 2012 - 12:30 PM
And this bit, "According to Tabini, though, “Apple presumes it’s talking to its own server with a valid security certificate.” But that was clearly a mistake—"This is entirely Apple’s fault,” Tabini added." is kinda annoying too.
They're just using standard SSL encryption. You've always been able to install your own certificates to something, that's how SSL works. Apple trusting the device certificate chain is hardly their fault. It's potentially something they've overlooked, but in order to make this stuff compliant with things like revocation, they don't have any other choice.
The hacker has clearly figured out how to generate the responses properly for an in-app purchase, just like jailbreakers figured out how to generate SHSH blobs in the early days of jailbreaking, until Apple started signing them.
They're just using standard SSL encryption. You've always been able to install your own certificates to something, that's how SSL works. Apple trusting the device certificate chain is hardly their fault. It's potentially something they've overlooked, but in order to make this stuff compliant with things like revocation, they don't have any other choice.
The hacker has clearly figured out how to generate the responses properly for an in-app purchase, just like jailbreakers figured out how to generate SHSH blobs in the early days of jailbreaking, until Apple started signing them.
#8
leftnotrackswzdv
- Member
-
- Group: New Members
- Posts: 22
- Joined: 17-September 11
Posted 13 July 2012 - 02:18 PM
“I’m a happy user of iPhone 4S … I think they will hire me.”
If not for his hacking skill, then certainly for his balls.
If not for his hacking skill, then certainly for his balls.
#9
erikftaylor
- Newbie
-
- Group: New Members
- Posts: 1
- Joined: 13-July 12
Posted 13 July 2012 - 02:34 PM
Hhmm... I tried this out of early morning, droopy-eyed curiosity. I "purchased" a few low cost IAPs and removed the DNS and certs from my iPad. I also changed my iTunes credentials. I feel super guilty for even trying it out 
#11
lightnquick
- Member
-
- Group: Members
- Posts: 30
- Joined: 13-October 10
Posted 13 July 2012 - 02:37 PM
hayesk, on 13 July 2012 - 12:03 PM, said:
Borodin's rationalization for stealing from the developer is pure BS. If you don't like that the developer expects you to pay for extra parts of the game, then don't play it.
Kudos for him for showing Apple a flaw, but that doesn't justify his actions.
Kudos for him for showing Apple a flaw, but that doesn't justify his actions.
I agree - it's BS. BUT - at the same time I expect developers to make it clear up-front that a game requires x amount of in-app purchases to play x amount of levels, etc. Many fail to be open about this, and, honestly, my empathy for them is, uhmm, limited.
#13
JustinDd7kn
- Newbie
-
- Group: New Members
- Posts: 1
- Joined: 13-July 12
Posted 13 July 2012 - 02:52 PM
"...he didn't seem particularly concerned about what Apple does next"
"Asked if he was afraid about what Apple's response to him directly might be..."
Three shots center mass, set of two white Apple stickers left on body as a calling card. Watch.
"Asked if he was afraid about what Apple's response to him directly might be..."
Three shots center mass, set of two white Apple stickers left on body as a calling card. Watch.
#14
StratigosSec
- Newbie
-
- Group: New Members
- Posts: 1
- Joined: 13-July 12
Posted 13 July 2012 - 03:11 PM
We have also noticed the same thing and are investigating. This is not just a threat to the Apple and iOS App Store developers' business model, but to the security of iOS devices as well. http://stratigossecu...purchases-free/
