Apple offers developers a workaround for in-app purchasing exploit

apple app store apps

In an unusual move, Apple is offering iOS application developers a workaround for the exploit that enables iOS users to make free in-app purchases. Apple says the exploit will be fixed in the forthcoming iOS 6.0, but in the meantime Apple is explicitly giving developers permission to tap into private Apple iOS APIs to verify certificates that purport to be from the App Store. Historically, Apple has summarily rejected iOS applications that rely on accessing any private API.

The exploit, which gained notoriety last week, was developed by Russian hacker Alexey Borodin, although there’s really nothing from stopping other motivated individuals from using the same approach. Borodin forged security certificates that claim to be from Apple, then set up his own DNS servers to respond as if they were Apple’s App Store. When applications tried to make in-app purchases, Borodin’s exploit essentially hijacked the process and provides spoofed receipts so the apps will unlock or access additional features or content.

Apple’s workaround is not exactly painless for developers — they will have to update their existing iOS applications to be able to validate store receipts — but at least it’s a solution that can be deployed now and support in-app purchasing prior to iOS 6. Similarly, if applications have not saved their store receipts, they will not be able to validate purchases.

Apple has steadily recommended that developers using in-app purchases follow “best practices” and validate receipts using their own servers or services independent from the App Store to avoid these kinds of man-in-the-middle attacks. Of course, developers should also take care their their own validation process cannot be attacked in a similar manner.

Mobile

Updating to Apple’s iOS 12 will make your iPhone a whole lot smarter

iOS 12, the latest version of Apple’s iOS, is officially here. We took it for a spin to check out its new noteworthy features, and if it truly changes our smartphone habits for the better.
Deals

The best Apple Watch deals for October 2018

The Apple Watch has surged to prominence in recent years. If you're in the market for an iOS wearable, we've sniffed out the best Apple Watch deals available right now for all three models of this great smartwatch.
Music

How to convert and play FLAC music files on your iPhone or iPad

The high-resolution revolution is upon us, and FLAC files are a popular way to store hi-res sound. But what if you’re an iOS user? Check out our article to find out more about FLAC files, and how to use them on Apple devices.
Mobile

Pocket transforms articles into podcasts with an assist from Amazon

Read-it-later app Pocket is adding an option to turn articles into easily navigable podcasts with its new app redesign for iOS and Android. The feature relies on Amazon's voice-to-text service Polly.
Mobile

Got gadgets galore? Keep them charged up with the 10 best USB-C cables

If you weren't already aware, USB-C is quickly becoming mainstream. That's why we've rounded up some of the better USB-C cables on the market, whether you're looking to charge or sync your smartphone.
Computing

How to protect your iCloud account

From Chinese hacking to identity theft, it's not surprising if you're a little worried about your iCloud data. Here's how to protect your iCloud account with a few simple security steps. It will only take a few minutes, and we'll walk you…
Mobile

Preapproval for iPhone Upgrade Program now available for iPhone XR

Apple took the wraps off of its new set of iPhones, including the iPhone XS, iPhone XS Max, and the new iPhone XR. The iPhone XR is being offered as the "affordable" iPhone, and it's a little different than the more expensive models.
Mobile

Upcoming iPad may lose a few millimeters, along with its headphone jack

The new iPhone XS, iPhone XR, and Apple Watch aren't the last devices we'll see from Apple in 2018. There are plenty of rumors about a new iPad coming this year too, and it may share some design similarities with the new phones.
Computing

Which is best: The Lenovo ThinkPad X1 Extreme or the 15-inch MacBook Pro?

To try and help nail down the best 15-inch laptops in the world, we compared the Lenovo ThinkPad X1 Extreme vs. MacBook Pro 15 in a head to head that looked at their power, design, and portability.
Mobile

Google Pixel 3 vs. Apple iPhone XS: Does Google’s A.I. take down Apple?

The Google Pixel 3 is here, boasting top-tier specs like a Qualcomm Snapdragon 845 and 4GB of RAM, and some of the world's best artificial intelligence features on a phone. But can it take out the Apple iPhone XS?
Mobile

Hinge's new feature wants to know who you've gone out on dates with

With its new "We Met" feature, Hinge wants to learn how your dates are going with matches in its app. That way, it can inject the information into its algorithm to provide future recommendations that better suit its users' preferences.
Mobile

Which Verizon plan is best for you? We check out family, individual, and prepaid

Verizon offers lots of plans for individuals, your family, and folks who want prepaid service. Here is everything you need to know about Verizon's plans, from data packages and smartphones to Big Red's prepaid plans.
Mobile

Safeguard your new Apple smartphone with one of our favorite iPhone XS cases

If the iPhone XS is your next phone, then you’ll want to shop for some proper protection now. That glass sandwich design is all too easy to scratch or crack, so make sure you snag one of the best iPhone XS cases to keep it looking good.
Mobile

Here are our favorite wireless phone chargers for Android devices and iPhones

We checked out the best wireless phone chargers to make tangles and uncooperative ports a thing of the past. Whether you have an iPhone or Android, find out which wireless charging pads are worth buying, and how their features compare.