CODEWITHSUNDEEP
iosiphonein-app-purchase
AJ222
AJ222

Reputation: 1134

IAP cracks that seem to have valid receipts

We have a successful app on the iOS app store with in-app purchases. Every time a purchase is completed we send the receipt to our server, our server than checks the receipt with Apple's servers and logs apple's response(including whether the purchase was valid and that they come from our app in that same time and date).

We have quite a few users who use iap cracks that send us receipts that apple says are invalid. However we started now to see cheaters that have receipts that apple replies that are VALID. What is strange in these cheats, that when such a cheater user purchases in our app, he usually purchases all of the purchases with the exact same receipt.

Have you heard of such a way to 'fool' apple receipt validation?(to generate receipts that apple will say they are from our app in the time of the 'purchase')

Is there something we can do to find those cheaters in their 1st purchase (for the next purchases we can simply check times of the next receipts or make sure that our receipts are unique)

Thanks!

Upvotes: 6

Views: 872

Answers (2)

aniket.ghode
aniket.ghode

Reputation: 86

We also faced similar issue while developing a game of iOS app store where business model was based on In App Purchase only.

Initially we used to check with Apple Servers for the receipts directly from the device. But some hacker has created a hack for the users where they can install the DNS server certificate on their device which spoofs the response from Apple.

The way to do this is let web server check for the receipts from Apple directly with some kind of hashing or md5 check to make sure the response if from Apple.

here is a link which have a detailed information on this https://www.objc.io/issues/17-security/receipt-validation/

Hope this helps.

Upvotes: 0

Alex Curylo
Alex Curylo

Reputation: 4770

Is there something we can do to find those cheaters in their 1st purchase

Actually, if this is the same hack I've seen discussed as a proof of concept recently, the first purchase is legitimate. The "innovation" is in decoding that legitimate receipt and rejigging its IAP ID with a different one while the receipt overall still appears valid. So simply avoiding the duplicates is enough. Didn't think that one was anywhere near production-ready though, so this might be something different.

Upvotes: 2

Related Questions