Russian hacker strikes again with new ‘free in-app purchase’ exploit for Mac apps on OS X
Alexei Borodin, the same hacker who came up with the recent in-app purchase exploit that allowed free transactions for iOS users has struck again with a new method that allows users of Mac apps to do the same.
Context & Ripple Effects
This is the second act of a fast-moving story: Alexei Borodin's iOS in-app purchase circumvention surfaced just a week earlier, and Apple had already begun responding by adding unique identifiers to purchase receipts on July 18 (receipt identifiers to combat the hack). Porting the method to OS X within days shows the flaw is not an iOS quirk but a weakness in how Apple's receipt validation works across platforms.
The pickup was unusually broad for a niche security story — ZDNet, CNET, AppleInsider, 9to5Mac and others all ran it — reflecting that free in-app purchases strike directly at the freemium revenue model most App Store developers now depend on.
First-order effects
- Developers selling in-app purchases on both iOS and OS X face direct revenue loss, since the same exploit logic that gave iOS users free transactions now applies to their Mac apps.
- Apple's July 18 receipt-identifier fix is immediately shown to be incomplete, forcing the company to extend its countermeasures beyond iOS to OS X's purchasing path.
Second-order effects
- Freemium publishers may reconsider how much monetization they route through client-side receipt checks, pushing validation toward server-side verification that Apple controls.
- Rival platform holders can point to the episode when arguing that centralized, server-enforced payment systems are harder to spoof than store-client trust models.
Third-order effects
- If receipt-spoofing keeps outpacing Apple's patches, the durable fix is architectural — moving purchase verification fully server-side — which would tighten Apple's control over every transaction on its platforms.
- The episode feeds a longer pattern of consumer-facing Apple software being probed by researchers and hackers alike, pressuring the company to treat desktop and mobile store security as one problem rather than two.
The trend: App-store economies are drifting toward server-side transaction verification as client-side receipt trust repeatedly fails against determined attackers.