Apple App Store Vulnerability

Mr.Sehgal 

all you need are two things

1.    An Apple App Store account.

2.    A Bank Account which would allow you to create a Virtual Credit Card or NetSafe Virtual Card.

A Virtual Credit Card is an offering which allows you to generate a virtual card number via your credit or debit card in real time for the said amount and is usually valid for the next 48 hours only. VCC is a single online use card, which can’t be used only once by the creator himself.

§  Now you need to ensure that your App Store account does not contain any card payment information. It’s advised to create a free account for that purpose with no card information.

§  Next up, create a virtual credit card with just Rs.50 / $1 in it.

§  Go onto any paid app of any amount (Yes ANY amount) you wish to download from the App Store click on “Buy App”.

§  Enter the virtual credit card information when prompted for payment details.

§  The transaction would go through even if you are downloading an app for a value of a higher amount.

§  Once the app is downloaded you will find that the said amount, i.e. if the app is for a dollar then that amount has not been deducted from your account. And even if the amount was greater than a dollar there is no way for it to get deducted as your card only had a dollar in it.

The only glitch here in the process is that the next time when you login using the same account and try to download an app you will find that the App store account is locked due to previous payment issues and it’ll ask you again for payment details to resolve the earlier issue.

The few applications we downloaded using the above procedure worked completely fine and the above steps can also be used for in-app purchases as well.

So in case you want to download another app for free you’ll have to create another account and go through the above process again. And yes, we agree that it can be cumbersome.

Oh and coming back to the Rs. 50 or $1 on your virtual credit card, those get credited back to your account, which means that you get to download a paid app without paying a single dime for it.

But the idea here isn’t to promote app piracy, but to point out the flaw in the payment system on the iOS App Store.