Apple's Private Relay Flaw Exposes Users' Real IP Addresses
Researchers have discovered a flaw in Apple's Private Relay feature, which can leak users' real IP addresses due to a series of vulnerabilities in WebKit. The issue affects iCloud+ subscribers who use Safari, and can be exploited by websites during passkey requests. Apple is investigating the report, but has not yet commented on a fix.
Key points
- Apple's Private Relay feature, designed to hide users' IP addresses, can be circumvented due to flaws in WebKit.
- The issue affects iCloud+ subscribers who use Safari, and can be exploited by websites during passkey requests.
- Researchers Talal Haj Bakry and Tommy Mysk discovered the vulnerability and set up a website to test it, revealing that the site could expose users' real IP addresses.
- Apple has acknowledged the report and is investigating, but has not yet commented on a fix or timeline for a resolution.
- The flaw highlights the limitations of Private Relay, which only protects traffic that passes through Safari and does not offer system-level protection like a Virtual Private Network (VPN).
Apple's Private Relay feature, designed to hide users' IP addresses, has been found to have a significant flaw. Researchers Talal Haj Bakry and Tommy Mysk discovered that the feature can be circumvented due to vulnerabilities in WebKit, the web browser engine used by all browsers in iOS.
The issue affects iCloud+ subscribers who use Safari, and can be exploited by websites during passkey requests. According to the researchers, the problem lies with three features in WebKit that allow websites to bypass Safari's Private Relay path.
The researchers set up a website to test the issue, and were able to reveal users' real IP addresses, even if they were using Private Relay. This highlights the limitations of Private Relay, which only protects traffic that passes through Safari and does not offer system-level protection like a Virtual Private Network (VPN).
Apple has acknowledged the report and is investigating, but has not yet commented on a fix or timeline for a resolution. The flaw has significant implications for users who rely on Private Relay for their online security and privacy.
In a statement, Mysk wrote that they chose not to report the issue to Apple because of their past experience with the company, citing months of delays, inconsistent communication, and in some cases, denying the issue's impact entirely. The researchers have since developed a private browser called Psylo, which they say has mitigations that prevent users' IP addresses from being exposed.
The issue has sparked concerns about the effectiveness of Private Relay and the need for more robust online security measures. As the tech industry continues to evolve, it is essential that companies prioritize the security and privacy of their users.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.