Question by roat · Jul 29, 2016 at 06:11 PM · c#security in app purchase google-play-store

Unity's IAP Security alert google play

Hello,

I have an game published on google play store that uses they unity IAP SDK. It works fine but after tree months I now get a message from the google play store that there is a Security alert.

I just the integrating instructions provided here https://unity3d.com/learn/tutorials/topics/analytics/integrating-unity-iap-your-game

I called they IAP like this com.companyname.gamename.itemname. and just followed they instructions provided in the link above.

But I don't know how to fix the Security alert google is giving me. I have tried to change the IAP names but that was not the problem, I also re-imported the AIP SDK again in hoop there might have ben an update, but this also did not do the trick.

So I hoop someone can help me fix the Security alert. If I need to give more information just tel me I will try to provide it.

the security alert tels me this :

In-app Billing Vulnerability

This information is intended for developers of apps that have a vulnerable implementation of In-app billing.

If your app is invoking the In-app billing service without setting a target package for the intent. This can enable a malicious package to bypass the Play store billing system and access items that have not been purchased.

Steps to fix:

If you are using IabHelper, please start using the latest SDK. If you are manually invoking the In-app billing service, please ensure that you are calling Intent.setPackage(“com.android.vending”) on any intents to "com.android.vending.billing.InAppBillingService.BIND". Sign in to your Developer Console and submit the updated version of your app. Check back after five hours - we’ll show a warning message if the app hasn’t been updated correctly.

For other technical questions, you can post to Stack Overflow and use the tag “android-security”. Note that questions about Play policy should not be posted to Stack Overflow.

Note that apps must also comply with the Developer Distribution Agreement and Content Policy. If you feel you have received this vulnerability warning in error, contact our policy support team through the Google Play Developer Help Center.

Add comment · Show 1