iCloud Private Relay Is Exposing Users' Real IP Addresses

iCloud Private Relay, part of the paid iCloud+ subscription, is supposed to mask a user's IP address while they browse in Safari. But as researchers Tommy Mysk and Talal Haj Bakry have found, a number of quirks in Apple's browser engine — the engine on which every browser in iOS is built — mean that this protection simply doesn't work in many cases. An attacker can build a site that learns a visitor's true IP address, and many sites, the researchers say, have already collected that data unintentionally. The 404 Media newsroom tested the problem: on a site the researchers built specifically for this, a protected user's real address was indeed exposed.

What passkeys have to do with it

The root of the problem is that Private Relay isn't a full-fledged VPN. It hides the address only for Safari traffic, whereas a VPN usually operates at the operating-system level and routes all of a device's traffic through itself. Passkeys — a supposedly secure alternative to passwords based on the WebAuthn standard — are what lay this bare.

When a site claims to support passkeys (or merely pretends to), the device sends a network request not from the browser but from the system credentials service. “Because the request is made by the operating system's credential service rather than Safari, it never enters the Private Relay proxied path at all. The destination server sees the device's real IP address either way,” the researchers explain. To the user, though, it all looks like an ordinary interaction with the site.

The Tor browser is at risk too

Because every browser on iOS is required to use Apple's WebKit engine, the problem also affects the OnionBrowser app, which provides access to the Tor network. Some of the discovered vulnerabilities are capable of exposing its users' real addresses as well. The developers were warned: they called the situation “severe,” but allowed publication and gave no timeline for a fix. This does not affect the official Tor Browser from the Tor project itself, which remains the recommended way to use the network.

This is already the second stumble by Apple's paid privacy services in a short span. Last month, that same 404 Media reported a bug in the Hide My Email feature that, conversely, exposed users' real email addresses; Apple had known about it for more than a year before fixing it. Regarding the current leak, the company said it is reviewing the researchers' report.

Source: 404 Media