With the release of iOS 6, Apple is patching a hole that allows for users to download in-app purchases without having to pay. This is a problem for developers because it allows people to download said apps without any sort of fancy tools, downloads or jailbreaks.
For now, Apple has posted a how to that will help developers fix the problem in the meantime. It’s not a sure fix, but it will help reduce the problem:
A vulnerability has been discovered in iOS 5.1 and earlier related to validating in-app purchase receipts by connecting to the App Store server directly from an iOS device. An attacker can alter the DNS table to redirect these requests to a server controlled by the attacker. Using a certificate authority controlled by the attacker and installed on the device by the user, the attacker can issue a SSL certificate that fraudulently identifies the attacker’s server as an App Store server. When this fraudulent server is asked to validate an invalid receipt, it responds as if the receipt were valid.
iOS 6 will address this vulnerability. If your app follows the best practices described below then it is not affected by this attack.