A bug in iOS 5 allows for in-app purchases to be accessed for free, which can be exploited by redirecting the server. According to Apple, this bug will be fixed in iOS 6. Thanks to the iOS 5 bug, fraudulent developers can trick the actual App Store server into authenticating an app.

However, Apps requiring authentication aren't affected. Apple acknowledged the issue on its developer blog.

"A vulnerability has been discovered in iOS 5.1 and earlier related to validating in-app purchase receipts by connecting to the App Store server directly from an iOS device. An attacker can alter the DNS table to redirect these requests to a server controlled by the attacker. Using a certificate authority controlled by the attacker and installed on the device by the user, the attacker can issue a SSL certificate that fraudulently identifies the attacker's server as an App Store server. When this fraudulent server is asked to validate an invalid receipt, it responds as if the receipt were valid,"

Worryingly, the bug can be exploited through basic steps: installing the CD and in-appstore.com certificates and changing the DNS record in Wi-Fi settings. It means that the notification pop-up, usually asking for an e-mail address and password, changes to "Like in-appstore.com?" Two options are then available to the attacker, a "LIKE" option and an in-Russian pop-up. Choosing the former helps gain access to in-app content for free.

The free in-app content access means that games like Tiny Tower and its business model, free-to-play titles based around in-app purchases if users want to expedite progress, is bypassed.

9to5Mac reported that the exploit didn't work for all in-app purchases, perhaps down to differing regions. A developer speaking to the tech website urged users to not use the exploit and then assisted them in exploiting. Apple didn't comment on the developer specifically.

"The security of the App Store is incredibly important to us and the developer community. We take reports of fraudulent activity very seriously, and we are investigating," Apple representative - Natalie Harrison - said to The Loop earlier in July.

iOS 6 is currently in beta version 3. The mobile OS officially releases during the "fall," according to Apple. Mobile & Apps covered the main features of the operating system, announced during WWDC in June.