Who cares. Out of all the emails to choose. Go with yahoo. It's easy to do shady stuff from there.
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Hacker Releases Tools for Bypassing Apple's In App Purchase Mechanism [Updated]
- Thread starter MacRumors
- Start date
- Sort by reaction score
Who cares. Out of all the emails to choose. Go with yahoo. It's easy to do shady stuff from there.
A developer can't exploit a single user who knows those berrydots (or whatever) are NOT worth their silly price, and just stops playing their stupid little app. Consider those freemium items a excellent tax on stupidity and a wasted life.
Thank you! One thing I love about the app store is that developers can easily provide apps while cutting down on cost of advertising. While there are hackers, few are able to penetrate into the app store. This results in lower priced software. I think apps over $9.99 should be approved through Apple under a fair and reasonable pricing negotiation. In-app purchases should be covered under the same standards. A specific example are games that charge $49.99+ for "coins" or "tokens". This is unreasonable. These purchases add no extra features for the app and should be emlinated. Most current in-app purchases are stifling innovation. The developers are simply looking for more money, and it's unfair. These purchases are too tempting and deploy what I like to call a "casino effect" where you pay your money and get nothing more than a few fun hours out of the app.
Apart from the consumers that understand how these things work, most blindly pay money for relatively nothing.
I know I'm a bit of an extremist. But I'd be willing to meet in the middle.
On a different note, I wish Apple would drop support for iPhone apps on the iPad with iOS 6. These apps look terrible. It may force developers to release an iPad version. But that's a different subject entirely.
Passwords sent in plain text?? 
Unacceptable. If not for this Russian hacker, we wouldn't have known about this. I'd like to thank him for that.
Unacceptable. If not for this Russian hacker, we wouldn't have known about this. I'd like to thank him for that.
I think it is kinda cool someone without malicious intent did this first (if it even is the first), then made it as widely public as possible, even giving interviews. It will help Apple to plug this hole and also to think along these lines for other issues.
Rocketman
Rocketman
Whenever you make an IAP purchase, your Apple ID and password is sent.
So, if you use this hack, you will have a truckload of Russian hackers logging into your Apple account
in the next few days. Great.
I don't think a lot of people will be reading the instructions too closely om this hack.
All they see is FREE COINS, FREE COINS!
So, if you use this hack, you will have a truckload of Russian hackers logging into your Apple account
in the next few days. Great.
I don't think a lot of people will be reading the instructions too closely om this hack.
All they see is FREE COINS, FREE COINS!
I thought a little bit about how this hack works. And while I don't know whether this hacker intended to defraud only app developers, or if he intended to defraud gullible users as well, it is quite obvious that this hack opens users like Hawkeye411 to massive fraud.
Here's what the hack does (not technically accurate, but the principle is correct): Whenever a user wants to do an in-app purchase, the in-app purchase code on your iPhone or iPad talks to a server at Apple, lets say at inapppurchases.apple.com. As a user, you modified settings on your device so that all web traffic to inapppurchases.apple.com goes to inapppurchases.russianhackers.com instead. However, that wouldn't just work, because your device wants a certificate for "inapppurchases.apple.com", and only Apple can produce this. Here's where the second step comes in: The user also modifies their certificate store, so that any certificate issued by www,russianhackers.com is automatically trusted.
Now you are wide open to fraud: First, your Apple ID and password are sent. Normally, they would be sent to inapppurchases.apple.com, safely encrypted with a key that only Apple has, so only Apple can read them. But now they are sent to inapppurchases.russianhackers.com, safely encrypted with a key that only the russian hackers have, so only they can read it... I guess you see what the problem is.
Another problem is that your device has now been changed to trust anyhing with a certificate created by www,russianhackers.com. So if you go to the Amazon website, or your banks website, then someone can redirect your web traffic to go to a fake site (which is difficult, but not impossible), and if that fake site has a certificate that says "this is www,amazon.com, signed by: www.russianhackers.com", then your device will trust that fake site!
So hawkeye, enjoy as long as there is money in your bank account.
-10 downvote. Think very, very hard about who are the dirty rotten scumbags here. And nobody will cry any tears for you if your bank account is emptied.
No, Marco. If a user is dishonest enough to try to get in-app purchases for free, and stupid enough to install certificates from an unknown hacker, then they only get what they deserve. The Apple ID and password are sent safely to the intended recipient, and nobody but the intended recipient can read them. It's not Apple's fault if a user redirects the data to some hacker.
Last edited:
So, you think you can out-smart the Russian hacker by giving them a fake Apple ID and password?
Lol. You're still installing some untrusted certificates. Who knows what worms that will open.
Do you think all jailbreakers are thieves?
I think all installous users are thieves.
There is one truly good usage for installous. There was a time when I was using an original iPhone and accidentally upgraded an app which no longer gave support to 3.1.3 which I think the original iPhone ran that last time I owned one. Of course that app no longer would run on the original and I no longer had the version that would so I would go and grab the old version that last ran on the iOS version. In that case, I was not a thief, just wanting an app version that would still run on my old original iPhone.
Easy fix - set up a brand new free iTunes Account and use that one instead for in-app "purchasing". No one will be then able to obtain your real information.
I'm all for jailbreaking and customizing your device to make it your own, but when it comes to stealing from developers, that's where you have to draw the line.
Uh...
No, but they don't publish step by step instructions on how to get away with murdering people.
No, but they don't publish step by step instructions on how to get away with murdering people.
They typically do explain how the criminal committed the crime if they have details on it.
If i buy a game..I expect the apps not to be selling me in-app crap. Secondly, regardless how much the app cost..it's still money.
Realistically, which do you think there will be more of as a result of this article being published, developers getting rid of in-app purchases or consumers stealing in-app content?