Longitudinal Analysis of iOS In-App Purchase Implementation Vulnerabilities - Melo, Izabella C.; Pinheiro, Vitoria; Campelo, Divanilson R. (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg), 2026)
In-app purchases are a vital monetization strategy for developers, but improper implementation leads to security vulnerabilities. This paper presents the first longitudinal analysis of the evolution of these vulnerabilities in iOS apps’ in-app purchases. Initially, we manually analyzed 34 native apps and found three main client-side vulnerabilities in 21 of them. Then, using an app-agnostic tool, we tested 100 trending apps and identified vulnerabilities in 30 of them. Two years later, 23 of these apps still had vulnerabilities, and five new ones emerged, showing minimal improvement. These findings underscore the ongoing issues with in-app purchase implementations and highlight the need for iOS developers to strengthen their security practices.