A series of issues in Apple’s web browser engine — the tech underlying all browsers on iOS — means that Apple’s iCloud Private Relay tool, which is supposed to hide a user’s IP address, in many cases doesn’t actually work. Instead, the issues mean a malicious attacker can set up a website to learn a Private Relay user’s real IP address, or that many websites have also already collected this information incidentally. The issues also impact OnionBrowser, an iOS app for browsing the web through the Tor anonymity network, the researchers who discovered the issues say.
The Private Relay leak is the second issue to recently impact Apple’s paid-for privacy products. Last month 404 Media reported a bug in Apple’s Hide My Email feature was actually revealing peoples’ real email addresses. Apple knew about that issue for more than a year before fixing it.
“In short: any website that supports, or pretends to support, passkeys can see the user’s real IP address despite having iCloud Private Relay on,” security researcher Tommy Mysk, who discovered the issue along with Talal Haj Bakry, told 404 Media.
💡
Do you know about any other privacy issues like this? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at joseph@404media.co.
The researchers developed a site that lets Private Relay users check if the issues impact them. In 404 Media’s tests, the site did return the real IP address of a user that was supposed to be protected by Private Relay.
Private Relay is part of Apple’s paid iCloud+ subscription. It is designed to mask a user’s IP address while they browse the web in Safari. “Normally when you browse the web, information contained in your web traffic, such as your DNS records and IP address, can be seen by your network provider and the websites you visit. This information could be used to determine your identity and build a profile of your location and browsing history over time,” Apple’s website reads.
Private Relay is not a true virtual private network (VPN) in the sense that it only masks a user’s IP address when using Safari. VPNs typically work at the operating system level, and route all traffic from a device, be that from a web browser or installed apps.
That is part of the problem, the researchers found. In a quirk of how passkeys work — a broadly secure alternative to usernames and passwords which use the WebAuthn standard — a user’s device makes a web request outside of the browser itself. Meaning, that request essentially bypasses Private Relay and exposes a user’s real IP address, even though to them it may look like they are simply interacting with a website as normal.
“Because the fetch is issued by the operating system’s credential service rather than by Safari, it never enters Private Relay’s proxied path. The destination server sees the device’s real IP address either way,” the researchers write in their research.
Because all web browsers on iOS have to use Apple’s WebKit engine, the researchers also found the issues impact at least one Tor browser, called OnionBrowser. The Tor anonymity network routes users’ traffic through multiple nodes located all over the world. But some of the newly discovered issues can expose their IP address too.
“We have already informed them. They said the issue was ‘dire,’ but they let us disclose the issue. They didn’t provide any time when they will address this,” Mysk said.
For two of those leaks, the issues are “entirely based on how iOS and WebKit work and solely in Apple’s hands. (That’s the part that’s kind of dire),” Mike Tigas, the creator of OnionBrowser, told 404 Media. The third doesn’t apply to the app when it is run in its default settings. “Because these affect iCloud Private Relay (and not just third-party browsers like ours), we hope the root causes of these leaks get handled by Apple.”
This issue does not impact the official Tor Browser available from the Tor Project itself, which is generally recommended as the best way to use the anonymity network.
Apple told 404 Media it is investigating the researchers’ report.
Update: this piece has been updated to include comment from Mike Tigas.
