Apple's iCloud Private Relay Vulnerability Exposes Real IP Addresses
Security researchers have discovered a flaw in Apple's iCloud Private Relay service, which is meant to protect users' real IP addresses. The issue affects websites that use or pretend to use passkeys, potentially exposing users' IP addresses despite having the service enabled.
Key points
- Apple's iCloud Private Relay service has a vulnerability that can leak users' real IP addresses to websites that use or pretend to use passkeys.
- The issue affects Safari users on devices with paid iCloud+ plans, as the service is not a VPN and only protects IP addresses in Safari.
- Security researchers Tommy Mysk and Talal Haj Bakry discovered the problem, which is due to a series of issues in Apple's WebKit engine and how it handles passkeys.
- Websites can set up a WebAuthn ceremony to obtain users' real IP addresses, even if they have iCloud Private Relay enabled.
- Apple has not commented on the issue, and it is unclear how many users are affected.
- The vulnerability highlights the need for users to be cautious when using online services and to consider using a VPN for added protection.
Apple's iCloud Private Relay service has been found to have a vulnerability that can expose users' real IP addresses to websites that use or pretend to use passkeys. The issue affects Safari users on devices with paid iCloud+ plans, as the service is not a VPN and only protects IP addresses in Safari.
The problem was discovered by security researchers Tommy Mysk and Talal Haj Bakry, who detailed the issue in-depth on their website. According to the researchers, the issue is due to a series of problems in Apple's WebKit engine and how it handles passkeys.
Websites can set up a WebAuthn ceremony to obtain users' real IP addresses, even if they have iCloud Private Relay enabled. This can be done without the user's knowledge or interaction, and can potentially expose their IP address to attackers.
It is unclear how many users are affected by the issue, and Apple has not commented on the matter. However, the vulnerability highlights the need for users to be cautious when using online services and to consider using a VPN for added protection.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.