iOS应用内支付安全分析

应用内支付是开发者盈利的重要手段。然而，由于开发者在具体实现中未对交易进行有效性验证，导致攻击者可以通过控制流劫持和会话劫持两类攻击方式实现免费内购，给开发者权益造成了极大危害。本文以iOS平台应用内支付为研究对象，介绍了其支付流程，分析了支付过程中存在的安全问题及当前存在的攻击方法，最后总结了应用内支付攻击防御思路。

An Analysis of Vulnerability in iOS In-App Purchases

In-App Purchase （IAP） has become an important profit mode for iOS developers. However, a large number of iOS applications containing IAP functionality fail to perform sufficient verification on IAP transactions. By forging a transaction response, attackers can cheat the application and obtain the digital content in in-App store without paying. In this paper, we introduce the procedure of in-App Purchases, analyze the security feathers of IAP and summarize the defensive methods of IAP attacks.