It is unclear though whether Apple or developers will be able to detect – or take action – against users who have taken advantage of the system, nor whether the company will refund developers who have lost payments as a result of the hack.
The system, described and demonstrated in the video by Alexey Borodin, would let users make in-app purchases – a key method used by many free apps to charge users, rather than having an upfront price on the App Store.
A significant number of apps appear to be affected, but there are risks implicit in using Borodin's system, because his site could see users' Apple ID and password – which could then be used to defraud users.
Affected apps use a method of in-app purchase checking that Apple has deprecated, where validation of an in-app purchase is made on the device, not by checking with the app developer's servers, and then Apple's own servers.
On the video, Borodin justifies his method, saying "This project allows you to buy in-app content for free. Why you must [sic] pay for content, already included in purchased app? I think, you must not." The hack does not need the device to be "jailbroken", and appears to work on all versions from iOS 3.0 up to the as-yet unreleased iOS 6.
Normally when a payment is made for an in-app purchase, the app checks against Apple's App Store, which authorises the transaction.
But there are two ways to carry out the transaction; the other method uses a server operated by the app developer, a method that is more complicated but offers greater security, and is not affected by Borodin's hack.
Macworld explains that "Borodin's hack works with purchases validated solely on iOS, because those purchases look only at the fake Apple server addresses the hack provides. Apps that instead rely on their own web servers to validate receipts, of course, talk to the genuine Apple servers - which in turn respond that the receipts are invalid, since Apple didn't really generate them."
Those who use Borodin's system may be putting their Apple ID and password at risk. First they have to install two security certificates apparently self-certified by Borodin and use a domain name server (at 184.108.40.206) based in Russia. That creates certificates for an in-app purchase server and its associated DNS system – in effect creating a closed world to "validate" the in-app purchase against a faked Apple Store.
However that will not work against all in-app purchases. Apple's recommended method, highlighted in its Store Kit documentation for purchases of apps, says that in-app purchases should also be validated against Apple's servers: "Your application should perform the additional step of verifying that the receipt you received from Store Kit came from Apple. This is particularly important when your application relies on a separate server to provide subscriptions, services, or downloadable content. Verifying receipts on your server ensures that requests from your application are valid."
Natalie Harrison, an Apple spokesperson, said in a statement on Friday that "The security of the App Store is incredibly important to us and the developer community. We take reports of fraudulent activity very seriously, and we are investigating."
Apple declined to comment further on Monday morning. It is unclear whether Apple can prevent Borodin's hack on its own; developers choose which method of in-app purchasing system to use, and embed it in their code. Craig Hockenberry, a Mac and iOS developer, told Macworld that "I'm willing to bet that 99 percent of all developers validate on iOS because it's a lot of extra work to setup a server that does the validation." That would imply that huge numbers of apps will have to be updated – but equally, people who want to get the in-app purchases for free won't update them
At in-appstore.com, where Borodin has been showing off his technique, commenters have been posting games and apps for which the workaround is effective, and those for which it isn't. Both are presently small compared to the hundreds of thousands of apps in the App Store, but if developers do not move to fix the hole, it could be catastrophic to their revenues.
Greg Boyle, director of mobile product marketing at the online security company Trend Micro, said: "Security of a mobile platform is not just about protecting users, for a successful platform developers need to be protected as well. I think there will be strong calls on Apple to reimburse app developers who have been caught up in this scam. If you take a retail analogy, if a shoplifter steals from a retail store the developer of the product stolen doesn't foot the bill. The difference being the developer has the ability to take their business elsewhere and use alternate distribution channels. In this case however, the developers do not have much control over protecting against the scam, and they can't use alternate in app payment methods.
"It will also be a wake up call to the big three, Apple, Google and Microsoft. Cybercriminals won't stop looking for ways to make money from their respective platforms, regardless of how secure they think their technology is. As smartphone usage and commerce grows, the focus from criminals will only increase, if app distribution is locked down and controlled, criminals will find a new way to attack. In this case it was a flaw in the billing system, in others it will be security holes in popular apps."
guardian.co.uk © Guardian News and Media Limited 2010