Apple may be inadvertently sharing user IP addresses with the Internet – even for those who’ve opted into a privacy feature called Private Relay.
The vulnerability stems from three flawed features in WebKit, the browser engine that Apple requires all iOS browsers (Safari included) to use. The flaws were flagged on Aug 5 on a cybersecurity blog, which noted that they resulted in DNS leaks on certain websites and exposure of a device’s real IP address – even if a user subscribed to Apple’s iCloud+ Private Relay feature.
“Since Apple’s App Store policy requires every iOS browser to use WebKit, any iOS browser that relies on this API for proxying is affected, including all iOS Tor browsers and Psylo. These leaks are also present in Apple’s iCloud Private Relay,” the blog states.
Talal Haj Bakry and Tommy Mysk are the cybersecurity research and app developer duo who published the original blog post on Aug 4, which was first reported by 404 Media. They were alerted to a potential issue after a user of Psylo, the private browser the two developed, reported DNS leaks on certain sites. After digging, the researchers found the source of that leak, as two others that expose a device’s actual IP address.
In an ironic twist, the flaw affecting Private Relay users results from the use of an additional safety feature. Private Relay is a premium offering for subscribers to Apple’s iCloud+. Originally introduced in 2021, it is meant to provide extra insurance against tracking and IP address exposure through a two-relay system that ensures that no party – including Apple – can see both a user’s identity and the websites they are visiting.
But the problem arises when users use passkeys, which are a more secure alternative to passwords. As 404 Media noted, passkeys require a user’s device to make a request outside of the actual browser, meaning it bypasses Private Relay altogether and exposes a user’s IP address. The researchers noted that they updated their Psylo browser to protect against the flaws, and as well as notifying the Tor Project and Onion Browser developers.
IP addresses, or Internet protocol addresses, are unique numbers assigned to devices that access the Internet. They serve as an online address that enables Internet navigation and data exchange, according to Mozilla. There are a number of reasons that individuals may want to hide the IP addresses of their devices. They reveal a user’s approximate location down to the postal code, and enable Internet service providers, website operators, and others to track Internet activity. Plus, malicious actors can exploit IP addresses to launch certain types of cyberattacks, according to cybersecurity company Fortinet.
Apple has touted its products as being designed with user privacy in mind, and even launched an ad campaign in June that touted the superiority of its Safari browser compared with competitors like Chrome. As far back as 2017, Apple introduced its Intelligent Tracking Prevention, which has a feature that is meant to hide a user’s IP address from trackers. The Private Relay feature was meant to make that even more secure. Private Relay should not be confused with Safari’s Private Browsing feature, which Apple describes as providing “additional privacy protections for tabs.” For example, Private Browsing doesn’t save someone’s history in that tab.
Apple did not respond to Inc.’s request for comment. – Inc./Tribune News Service
