Russian Hacker Bypasses iOS Microtransactions

Karloff

New member
Oct 19, 2009
6,474
0
0
Russian Hacker Bypasses iOS Microtransactions



The iOS in-app purchase system has been hacked, and Apple isn't sure what to do about it.

Last Friday Apple's iOS store was faced with its worst nightmare: a hacker who'd discovered a way to bypass its in-app purchasing system. The hacker in question, Russian Alexey Borodin, was allowing Apple's customers to download premium app store content for free. Although Apple took steps, forcing Borodin to change his IP and abandon PayPal as a means of getting payment for his service, the hacker is still out there and Apple currently has no way to cut him off.

Borodin's hack allows users to bypass the in-app purchase system used by so-called "free" apps, so that they can download app content while avoiding the iOS payment system."Why must pay for content [sic]," Borodin argued in a video release since pulled from YouTube, "I think, you must not." In a separate message to Macworld, Borodin claimed to be a hobbyist who has a grudge against developers who promote free games that then nickel-and-dime the customer. Though Borodin was using PayPal as a means of collecting donations, he told Macworld he's just as happy for people to use it free of charge.

The hack means that payments which would normally be authorized by the Apple store now get their content via Russian servers. This system doesn't work on all in-app purchases; those authorized by the developer, not by Apple, are secure against the Borodin hack. However many developers validate via Apple because to do it themselves they would need to run their own server, and that can get both complicated and expensive.

Apple currently has no means of defending itself against Borodin, so the 30% cut that developers have to give them to use the service isn't buying developers the security they need. Even Borodin's customers have no way of defending against the hack, since in order to make use of Borodin's service they have to give his servers access to their Apple ID and password. If Borodin is the hobbyist he claims to be perhaps there is no risk; if not, Apple isn't the only one who may find themselves out of pocket this time out.

Apple has yet to say whether or not developers affected by this hack will be compensated for their losses.

Sources: Macworld [http://www.guardian.co.uk/technology/appsblog/2012/jul/16/apple-app-hack]


Permalink
 

NightHawk21

New member
Dec 8, 2010
1,273
0
0
This is genius. I really do hope that these people don't get there money or whatever stolen, but I honestly don't even care about apple. The situation is too funny.
 

Teoes

Poof, poof, sparkles!
Jun 1, 2010
5,174
0
0
DVS BSTrD said:
If this is what it takes for Apple to take security seriously, then So-vi-et.
I CCCP what you did there.

EDIT - fudged my own pun -.-
 

kuolonen

New member
Nov 19, 2009
290
0
0
"Why must pay for content [sic]," Borodin argued in a video release since pulled from YouTube, "I think, you must not."
Communism is alive and well in good old mother Russia. Prepare for the Red Dawn!

<youtube=BulFwGSi8bc>


And Apple has no way to counter this? Well, my day sure got a brighter turn!
 

Zeckt

New member
Nov 10, 2010
1,085
0
0
This guy is a criminal scum who is breaking the law and must face the ... oh wait its apple? go right ahead!
 

Jhooud

Someone's Dad
Nov 29, 2011
224
0
0
Karloff said:
Even Borodin's customers have no way of defending against the hack, since in order to make use of Borodin's service they have to give his servers access to their Apple ID and password. If Borodin is the hobbyist he claims to be perhaps there is no risk; if not, Apple isn't the only one who may find themselves out of pocket this time out.
Oh boy. This'll end well for all involved, I'm sure.
 

Quiet Stranger

New member
Feb 4, 2006
4,409
0
0
I support this man! Take ALL MY MONEY!


I can't wait to shove this in the face of some Apple Fanboy who tries to convince me Apple is un-hackable
 

Aeshi

New member
Dec 22, 2009
2,640
0
0
Because cheating companies out of money is perfectly ok if they're cool to bash!
 

mxfox408

Pee Eye Em Pee Daddy
Apr 4, 2010
478
0
0
Well deserved justice, about time crapple finally had their asses handed to them, I guess they hate the competition when it comes to stealing software. Why don't they just sue him like the rest of their competition? Lol
 

Steve the Pocket

New member
Mar 30, 2009
1,649
0
0
Krat Arona said:
And they say Apple products don't get hacked... Poppycock.
Quiet Stranger said:
I can't wait to shove this in the face of some Apple Fanboy who tries to convince me Apple is un-hackable
Isn't the claim that other people can't hack your device, not that you can't hack your own? Because, geez, we've known people can do that for years. It's called jailbreaking, and nobody but Apple objects to it being doable.
 

galaxygamer

New member
May 23, 2008
47
0
0
I just read this article, and it seems I agree with this guy's [em]reasoning[/em], not his actions. Yes, it is shady that everything seems to be based on "micro-transactions" now. I understand why developers do this: They try to mitigate production costs while giving consumers more choices. I'm OK with that. I just also feel that it is disingenuous to state something as "free," when it is really gimped, and the only way to get a full experience is to "nickel-and-dime" the consumer.

Perhaps Apple, and others, should list the real, total price of software. Total prices spent might seem higher, but in actuality, people would be spending a same amount (they would spend otherwise through micro-transactions) all at once, instead of over time. It might make people feel less ripped-off. Apparently, that was the driving force behind this Russian hacker.
 

Aeshi

New member
Dec 22, 2009
2,640
0
0
Steve the Pocket said:
Krat Arona said:
And they say Apple products don't get hacked... Poppycock.
Quiet Stranger said:
I can't wait to shove this in the face of some Apple Fanboy who tries to convince me Apple is un-hackable
Isn't the claim that other people can't hack your device, not that you can't hack your own? Because, geez, we've known people can do that for years. It's called jailbreaking, and nobody but Apple objects to it being doable.
Only a mindless iSheep Apple Nazi would dare question an anti-Apple argument! Start hating them like a good little anti-conformist!
 

mygocarp

New member
Apr 2, 2012
22
0
0
While I have no such love of freemium stuff, his actions are utterly reprehensible.

Sure some of the "nickel and dime" devs may lose out, but I'd argue that legit devs would be the ones that stand to take real harm.

As for the people claiming that the price should be stated upright, the current system is basically a single app version of a lite/full model.
Generally they do state what the limitations are and what you gain by paying for it.