Apple's Fix Failed: In-App Purchases Still Free with This Hack
A few days ago, Russian hacker Alexy Borodin found a way to get free in-app purchases on an iPhone or iPad. In-app purchases include things like items and power-ups for iOS games, as well as subscriptions and "premium" memberships for certain apps.The method is novel, not for the result, but more so because of how surprisingly easy it is to use. There's no need to jailbreak your phone and the "hack" can be done in a matter of minutes.The process circumvents Apple's authentication servers by redirecting the requests to Borodin's service, which then sends a receipt back to the device, making the app register that the purchase has been completed. Borodin's service does require a valid receipt from a particular app to get started, but in the past few days he has spent hundreds of dollars "donating" receipts in order to test his process. Apple obviously isn't very happy with this and released a statement to The Loop:"The security of the App Store is incredibly important to us and the developer community. We take reports of fraudulent activity very seriously and we are investigating."Apple is currently scrambling to do some damage control, but so far their efforts have not resulted in much. They had the YouTube instructional video disabled, had PayPal suspend the account Borodin was taking donations from, and managed to issue a successful takedown request of his original server. Unfortunately for them, Borodin responded equally as fast, moving his servers offshore and altering the process to not use Apple's own servers.As of today, Borodin's method is still working and you can see a little more of the back-and-forth between him and Apple on his website, In-Appstore.Before you run into this, dancing for joy at all of the free stuff you'll be downloading, consider the implications. I'm of course not talking about the ethical ones, as obviously this is taking money out of developers and artists pockets; that's not even up for debate. But consider the fact that you're running your phone's connection through servers in who knows where, through a process designed to illegally steal content.The process was recently changed to require the user to sign out of their iTunes account first, so, in Borodin's words, "they don't scream to the Internet that I am stealing their credentials." Still, even if Borodin insists he's not logging devices, that's an awful lot to take at his word. This is not even considering what Apple can or will do legal-wise if they manage to track the use of Borodin's process to your phone.It's a fairly murky grey area right now, so tread carefully if you intend to try it out. In any case, here are the steps to get it to work. Use at your own risk!
Step 1: Sign Out of Your Apple IDYou can do this by going to Settings -> Store -> Tapping on your Apple ID, then hitting "Sign Off".
Step 2: Install the Security CertificatesInstall the following profiles onto your device. Important! They must be installed in this order:http://91.224.160.136/certs/cacert.pem http://91.224.160.136/certs/itcert.pem Images via blogspot.com
Step 3: Begin a PurchaseGo to the app where you intend to buy in-app items, and start a purchase. Then hit "Cancel" when it asks you to verify that you want to make the purchase.
Step 4: Set-Up the DNS SettingsOpen the Wi-Fi settings on your iPhone or iPad, then tap the arrow on the right of your Wi-Fi network. Set the DNS field to this IP address:91.224.160.136 Images via blogspot.com If you're confused, there's a video tutorial available. However, it's already a little out-dated, and I have a good feeling it will be pulled soon. Please enable JavaScript to watch this video.
That's It!It's amazing just how simple this process is. It makes you wonder just how secure Apple's system is and if similar vulnerabilities could be exploited to steal entire apps, personal information, or anything like that.It's certainly going to be a back and forth battle between Borodin and Apple as word spreads about the vulnerability. Considering Apple's tremendous resources and talent, I don't doubt at all that the hole will soon be shut; my only question is what the consequences of this whole affair will be.
How To: SSH into your iPhone or iPod Touch with an easy method How To: SSH into your iPod Touch or iPhone without wifi How To: SSH into a iPod Touch or iPhone using Filezilla How To: Use your iPad, iPhone, or iPod touch as an external display
How To: Connect to Your iPhone Via SSH | iSource
isource.com/2008/04/01/how-to-connect-to-your-iphone-via-ssh/
How To Connect to Your iPhone Via SSH. Topic Description: SSH (secure shell) is a network protocol that allows data to be exchanged over a secure channel, in this case between a computer and your iPhone. If you have a jailbroken iPhone, an SSH connection over a wireless network is often the best way to browse your iPhone, carry out simple file
How to SSH to an iPhone or iPad - OS X Daily
osxdaily.com/2011/08/04/ssh-to-iphone/
You may know already that iOS has the same underlying unix architecture as Mac OS X, and because of this you can SSH into an iPhone or iPad just like you would connect to any other Mac or unix based machine. As it turns out for us nerdier users, this ability is disabled without a jailbreak, so in
How to SSH into iPhone/iPod Touch using WinSCP (Windows)
Apple Releases First Beta of New watchOS 6 Operating System to Developers and it must be in range of the iPhone. It would be wise to install the beta on a Apple has made the first beta of
Apple releases iOS 13 beta 1 to developers - Geeky Gadgets
White hat SEO refers to SEO tactics that are approved by the major search engines and compliant with their terms and conditions. These techniques are safe, ethical, AND more effective. Learn how to improve your organic search performance while maintaining your integrity.
Top 7 White Hat SEO Techniques to Boost Site's Google
How To: Use Color Adjustments in Photoshop Express for More Vibrant Images. gadgethacks.com - Courtney Raphael. Imagine an Instagram feed filled with a wild array of vivid color. Beautiful right? But when you look at the photos in your iPhone or Android phone's …
How to Use Split Tones in Photoshop Express to Create
I haven't been hit with any ads on my machine, but it's probably due to the fact that I log in locally, not with a Microsoft account. Windows 10 has you log in via a Microsoft account by default (you can change that if you want), and there are a couple easy steps for you to take to get rid of any future lock screen ads if you'd like to continue logging in with your Microsoft account.
How to Enable or Disable Wallet app on Lock Screen iPhone:iOS
Download faster: How to speed up your internet. Now let's dive into a few ways that you can improve your internet speed. Remember, some Internet companies advertise huge speeds as a theoretical "potential" but in reality you will never get near it.
How to boost your Steam download speed - CNET
CarPlay units usually have eight app icons on each home screen page, so there's not a lot of room for your favorites apps without having to swipe — unless you have a bigger screen. Even then, a car that can display 10 apps on each screen might still need some app prioritization to get your most used apps up front and center.
How to Make Your Mac's Dock & App Icons Look Like Yosemite's
Filter: A Snapchat filter is a fun way to jazz up your Snaps by adding an overlay or other special effects. Filters can change based on special events or holidays, location, or time of day. Snapchat lens: Snapchat lenses allow you to add animated special effects to your photos or videos. Unlike filters, you use lenses while you are taking a Snap.
Seven Hidden Snapchat Features for Chatting With Friends
Make Google your homepage If you have Tools in the top menu, click on it From art to instruments to games, have fun with the Doodles you love.
How to Hack Google Images « Internet :: Gadget Hacks
Take a look at everything that goes on inside an Apple Store, with some helpful tips as well. to Get a Free Replacement for Your Broken iPhone; to get a free replacement iPhone from Apple
How to Repair an iPhone from Water Damage (with Pictures)
Two-factor authentication is one of the most important things you can do to protect yourself against getting your accounts hacked, and you should enable it now if you haven't already.
How to Easily Switch Your Two-Factor Security to a New Phone
Do you listen to a lot of music on your smartphone or MP3 player? Ever wished the built-in speaker was louder? You're in luck, because this simple amplifier can increase your volume by 14 decibels and make your device look totally steampunk while you're at it.
How to Set Google Online Timer « Internet :: Gadget Hacks
Next, you'll be prompted to choose a different app to open this link, and just like with Android's share menu, the options are "Just Once" and "Always." However, these settings only pertain to links shared via Open Link With, so choosing "Always" here won't affect your existing, system-wide link-handling settings.
Outlook 101: How to Customize Swipe Actions & Clear Your
0 comments:
Post a Comment