Swrve Says New Fraud Filter Fights Fake In-App Purchases - Eric Johnson - Commerce - AllThingsD: "Pirates! That is, players who spend nothing and get everything a game can offer, by circumventing the in-app store. "

Avast! Pirates!

Labels: app security, in-app purchase, validation

The new release of Tighten Pro 1.0.11 is now available on the Mac App Store. This release includes a total rewrite of the Mac App Store receipt validation code generator including extensive checking of the security trust/certificate chain and new code to parse and validate in-app purchase receipts. The in-app purchase receipt validation code is 100% inline-able and as such can be used throughout your application code (ie. salted). Other new features include security code generation for DeveloperID/Gatekeeper applications and more. Tighten Pro represents a comprehensive solution for application developers dealing with the complexities of deploying to the Mac App Store and protecting their work from piracy.

Labels: app store, mac app store receipt validation, sandbox, tighten pro, validation

Update to Tighten Free version 1.0.11. Minor changes include adding obfuscation to enum symbols and eliminating warnings about unused statements.

Labels: codesign, mac app store, receipt, validation, xcode

Just added a download link to the Free edition of Tighten: generates a customized implementation of Mac App Store Receipt Validation unique to your application. Better than using free code samples from the internet. Consider upgrading to Tighten Pro for a more secure implementation.

Labels: app store, codesign, receipt, validation

In-app purchasing exploit discovered for OS X apps: "Coming on the heels of Apple's attempts to plug an iOS in-app purchasing exploit, the latest being a developer support document released on Friday, a similar workaround has reportedly been found for desktop programs running on OS X."

Not if you checked the fingerprints of the certificates used to sign the receipt. You know, like code generated by Tighten Pro.

Labels: mac app store, receipt, validation

Before DeveloperID was announced, I spent considerable time creating a 3-layer self-signed codesign certificate chain for my own applications. There are bugs (at least in Keychain Access for Snow Leopard) that make creating self-signed certificates painstakingly error-prone. Mostly due to the fact that the Certificate Assistant does not remember all settings when moving backward and forwards through the wizard.

In any event, it is possible to create your own root Certificate Authority (which you can publish on your web site, ala Apple's Root CA) and your own intermediate software-signing certificate and your own leaf certificates.

Someone conversant with OpenSSL can probably get it done faster and quicker than with Certificate Assistant.

My intent in creating a self-signed certificate chain was to verify that 3rd party codesigning certificates -- and binaries signed with 3rd party certificates -- would work with Tighten Pro. And they do. As long as the signing chain has 3 certificates.

Labels: certificate authority, codesigning, self-signed certificates, validation

anchor apple generic and identifier "com.genkiyooka.developerID.mac.GK-DeveloperID" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = MQK467HD9A)

The code has been signed with following certificate chain:
NUMBER COMMON NAME
0 Developer ID Application: Gen Kiyooka
1 Developer ID Certification Authority
2 Apple Root CA


Labels: codesigning, developerid, gatekeeper, mac app store, receipt, security, validation