Apple’s iOS in-app purchase checks have been bypassed, but you should stay well clear

A Russian hacker appears to have defeated Apple’s in-app purchase security and processing checks, allowing iPhone and iPad owners to potentially rack up thousands of purchases within apps for no charge.

9to5mac reports that (via i-ekb.ru) that developer ‘ZonD80’ has developed a technique that uses an in-app proxy method to bypass the payment processing features on all devices running iOS 3.0 and up (including the new iOS 6 betas). And it doesn’t require a Jailbroken device.

When utilised, in-app purchases are routed via external servers and the standard payment dialog is replaced with the one embedded below. Instead of entering your password, you hit LIKE on the popup and in-app credits and purchases are credited to your account.

The technique relies on the installation of two independent certificates and the amendment of a DNS setting to achieve its goal, but it should not be trusted by any means.

9to5mac points out that the following information is transmitted to a remote server: restriction level of app, id of app, id of version, guid of your idevice, quantity of in-app purchase, offer name of in-app purchase, language you are using, identifier of application, version of application and your locale.

Basically, you’re sending data (that is unique to your device) to a remote server. There are no guarantees on how your data will be stored or used, or whether Apple will log the devices that are using the above method.

[Image Credit: PhotoAtelier]