A new three-step hack promises iPhone and iPad users a simple way to install premium in-app purchases from the App Store -- for free. Remarkably, the hack doesn't require jailbreaking or the installation of any software. Instead, iOS users are instructed to visit a website to install a security certificate and then directed to change their DNS settings. Afterward, users can fire up their favorite apps and pilfer as much in-app content as they want.
It appears only some apps are protected from this method while many are not. Developers who have fully employed Apple's purchasing recommendations are said to be immune to this crafty hack.
ZonD80, the pseudonym of the Russian developer responsible for the exploit, runs the in-appstore.com blog. The website details instructions, encourages donations and hosts a rather spine-tingling terms of service agreement. In-appstore.com makes it clear users who try this do so at their own peril -- but hey, what TOS looks reasonable these days, anyway?
According to 9to5Mac, ZonD80's exploit works on all iOS devices running 3.0 or higher. They also verified that the exploit actually works as advertised. The hack does its thing by circumventing the official App Store certificate with a custom in-appstore.com CA security cert. The certificate can be installed via Safari. Users also must configure their wireless DNS settings to point to ZonD80's DNS server(s). From then on, when purchasing in-app DLC over a wi-fi connection, users will be greeted by a special dialogue box to "LIKE" in-appstore.com which finalizes the transaction.
Unsurprisingly, Apple and PayPal have already taken action. Apple quickly banned ZonD80's DNS server from connecting to the App Store while PayPal is refusing to process donations to the project. Despite these difficulties, ZonD80 is currently seeking transparent proxies in order to circumvent Apple's IP ban.
*LoL
