koobas.hobune.stream
Protection from hacking "In app purchase" on Android/iOS
Hey. How to protect your application from hacking "in app purchase" on Android/iOS, which are used by programs such as "Freedom"?
If someone has rooted their device, your options are pretty limited, and the right solution depends on the kind of hacks you're trying to avoid. However, most solution revolve routing purchases through a server you control. Here are the Apple docs on that. You can actually set something like that up pretty easily w/ Google App Engine.
1) You can setup a server for receipt verification 2) Once you get a purchase response from server, send another request to Google server to get all Purchase products for the user. This will cross verify the purchase. 3) Don't allow your app to run on rooted devices. 4) Freedom fake transaction id corresponds to Billing format 2. Upgrade to Google billing format 3 and easily validate the transaction id format
Good luck. Let me know which solution worked for you.
As per my understanding, server can only protect you if you are not hosting content on device. If content is already on device, client can fake server response as well. Can you please help me in understanding your solution?
Hi lilboylost, could you tell me how to implement the point 3?
"Don't allow your app to run on rooted devices."
I've tested several on the net but don't work.
Thanks a lot.
https://www.google.com/search?q=android+dev+check+rooted
I am not using rooted check as I want my app to run on rooted devices. I am doing a server side RSA validation of transaction receipt, which is sufficient. In order to fake server response, hacker need to create a cheat code app specific to your application.
Ok but, do you know how to implement the point 3 in Unity?
Thanks,
You can only do it in Android Native code (java), and need to expose it into Unity via plugin or reflection.
Thanks lilboylost, your answer has been very useful for me.
I'm serching on the assets store and there is a plugin that I think that works for this. Is called "A$$anonymous$$97 Soft Android Root Checker" I'm going to try it.
See my answer on http://answers.unity3d.com/questions/1012407/detecting-rootedjail-broken-devices.html for free root and jailbraik detection.
