1 - someone got their hands on Apple's private encryption keys
2 - some got their hands on a list of Apple id's or device UDID's
3 - Apple knows this, but wants to fix the problem behind the scenes and keep it under the radar.
My memory of Apple's in App Purchase system is a bit rusty, but my guess is a combination of 1 and 2 is enough to cheat it into buying products on someone else's behalf.
Then again, it could also just be a reused password.
If it was a reused password, I'm an idiot. But, I'm willing to assume I am an idiot. My point is two-fold:
1. Allowing new devices to buy stuff without two-factor auth is weak sauce.
2. The larger meta-point that when we rely on the cloud in a big way, it hurts when we are locked out.
If someone tried to buy an app "manually" using their own device and your account, they would need to know your email address and password. There's plenty websites out there that store password in plain text, some of them even email it to you so everyone can intercept it. Other sites use some encryption, but could be still be compromised.
The possibility I hinted at is that someone just "pretends" they have an iPhone and communicate with the Apple server directly. I don't know how their algoritm works, but it may be the case that they only need an Apple id and some secret key that is stored on the device. In that case asking the user for their password is just a way to protect the user when they lose their actual device. That would be pretty insecure from Apple's side. They should at least use the password to generate a key pair. (This doesn't necessarily require anyone to steal secret keys from Apple I just realize)
1 - someone got their hands on Apple's private encryption keys
2 - some got their hands on a list of Apple id's or device UDID's
3 - Apple knows this, but wants to fix the problem behind the scenes and keep it under the radar.
My memory of Apple's in App Purchase system is a bit rusty, but my guess is a combination of 1 and 2 is enough to cheat it into buying products on someone else's behalf.
Then again, it could also just be a reused password.