ZonD Eighty, the Russian hacker who brought App Store fraud to unjailbroken iPads and iPhones, has extended his “service” to OS X users.

Mac owners can now join their iDevice brethren in ripping off developers.

The procedure starts off the same way on OS X as it does on devices running iOS:

• load and trust a fake CA (certificate authority) SSL certificate,
• load a fake SSL certificate signed by the fake trusted authority,
• change your DNS settings so you’ll be redirected to the fake App Store.

There’s one more step for OS X users:

• install and use an app called Grim Receiper.

Apple has already publicly admitted that this is a vulnerability, and provided some workarounds for iOS programmers to protect their in-app purchases.

According to Apple, the vulnerability will be addressed in iOS 6, which is expected in October 2012.

But with just days to go until Mountain Lion (OS X 10.8) drops, a proper fix for OS X is going to have to wait for a security update.

As Chester and I made clear in the latest Chet Chat podcast, there’s no inadvertent danger to users of Apple products here, only to developers.

If you get “infected” with this stuff, it’s because you went out of your way to avoid paying for something you knew wasn’t free – to “still developers’ money”, in ZonD Eighty’s own words.

Developers will probably want to read the Apple Release Notes mentioned above, and to make sure they’re protecting their in-app purchases as well as they can until Apple closes the door on this exploit entirely.

–