Apple Private Relay IP Leak: Users' Real Addresses Exposed

A significant security vulnerability has been discovered in Apple's iCloud Private Relay service, a feature designed to shield users' IP addresses from websites and network providers. Security researchers Tommy Mysk and Talal Haj Bakry revealed that due to flaws in Apple's underlying web browser engine, the Private Relay tool often fails to mask a user's true IP address, potentially exposing it to malicious actors and unsuspecting websites. The issues also impact third-party applications like OnionBrowser, which utilizes the Tor anonymity network.

The vulnerability arises from the way passkeys, a modern authentication method designed to replace passwords, interact with websites. When a user authenticates using a passkey, the request is initiated by the operating system's credential service rather than directly by the Safari browser. This bypasses the Private Relay proxy, effectively routing the request outside the privacy shield and revealing the user's genuine IP address. "In short: any website that supports, or pretends to support, passkeys can see the user’s real IP address despite having iCloud Private Relay on," Mysk stated.

Private Relay, a component of Apple's paid iCloud+ subscription, aims to enhance user privacy by masking IP addresses during web browsing in Safari. Apple's documentation explains that normally, browsing activity, including DNS records and IP addresses, can be monitored by network providers and visited sites, allowing for profiling of location and browsing history. Private Relay's intended function is to anonymize this data.

Passkey Authentication Triggers IP Exposure

Unlike traditional Virtual Private Networks (VPNs) that operate at the system level and reroute all device traffic, Private Relay is limited to Safari. This limitation, combined with the passkey mechanism, creates the exposure point. Researchers developed a test website that confirmed the IP leak, showing users' real IP addresses even when Private Relay was active. The researchers detailed that because the passkey fetch is issued by the OS credential service, it never enters the Private Relay proxied path. Consequently, the destination server receives the device's real IP address.

The implications extend beyond Safari users. All browsers on iOS are mandated to use Apple's WebKit engine, meaning the vulnerability affects other applications as well. OnionBrowser, an iOS app facilitating browsing through the Tor network, is among those impacted. While Tor is designed for anonymity by routing traffic through multiple nodes, these newly discovered issues can compromise user IP addresses within the network. Mike Tigas, the creator of OnionBrowser, informed 404 Media that for two of the identified leaks, the root cause lies within iOS and WebKit, placing the solution solely in Apple's hands. He described the situation as "dire" but noted that Apple has been informed and is investigating.

This discovery marks the second recent privacy-related issue impacting Apple's paid services. Last month, a bug in Apple's 'Hide My Email' feature was reported to be revealing users' actual email addresses, a problem Apple reportedly knew about for over a year before addressing it. The hope among researchers and users alike is that these vulnerabilities, particularly those stemming from core iOS functionalities, will be prioritized and resolved by Apple promptly.