Apple's in-app purchasing process circumvented by Russian hacker
Today we received some disturbing tips that a Russian developer has published a method of obtaining in-app purchases from iOS apps for free. First noticed by Russian blog i-ekb.ru, the “in-app proxy"method does not require a jailbreak …
Context & Ripple Effects
This is not the first crack in the App Store's trust model — back in November 2008 an iPhone exploit let developers run arbitrary code through the update mechanism. What makes the 'in-app proxy' method different is where it strikes: not the approved code, but the purchase handshake itself, and it works on stock, non-jailbroken devices, which removes the small-user-base limit that kept earlier hacks niche.
The story travelled unusually fast for a security write-up: The Next Web, Ars Technica, ZDNet, PC World, Gizmodo and four other outlets all carried it on or about July 13, with The Next Web's framing citing more than 30,000 illegal virtual transactions. That breadth reflects what is at stake commercially — by mid-2012 the App Store's half-million iPhone apps increasingly run on a freemium model where in-app purchases, not the upfront price, are the revenue.
First-order effects
- Developers whose income sits in consumable virtual goods — games above all — have their paid items obtainable for free by any user running the proxy, with no jailbreak requirement narrowing who can do it.
- Apple's purchase flow is exposed as trusting the device: App Review vets submitted code, but the in-app purchase validation step ran client-side, and that assumption has now been publicly broken.
Second-order effects
- Apple faces pressure to move receipt validation off the device and behind server-side checks — a fix that would touch every app using in-app purchases, not just the titles being exploited.
- Freemium publishers confront a pricing-integrity problem: if premium currency and virtual goods can be proxied for free, the scarcity and timed-sales mechanics their economies depend on stop holding.
Third-order effects
- Read against the 2008 arbitrary-code exploit, a second successful attack on the store's plumbing points toward platform owners treating transaction integrity as core infrastructure rather than leaving validation to individual apps.
- If client-trust exploits keep surfacing on the purchase pipeline, the burden shifts toward Apple proving its closed-distribution model also guarantees commerce integrity — the same gatekeeping power it defends in antitrust fights becomes the thing it must justify.
The trend: App Store security is shifting from policing approved code to hardening the transaction pipeline itself, as repeated exploits show the store's client-side trust assumptions are the real attack surface.