Apple's ‘Private Relay’ Is Exposing Users’ Real IP Addresses

Apple's iCloud Private Relay tool, designed to conceal users' IP addresses while browsing in Safari, has been found to have significant vulnerabilities. A series of issues within Apple's web browser engine, which underpins all iOS browsers, means that this tool often fails to effectively protect users' real IP addresses. Instead, malicious attackers can exploit these flaws to uncover users' genuine IP addresses, or many websites may already have collected this information inadvertently.

The problems also affect OnionBrowser, an iOS app enabling web browsing via the Tor anonymity network.

Tommy Mysk and Talal Haj Bakry, the security researchers who uncovered the issues, reported that any website supporting or pretending to support passkeys can see users' real IP addresses even with iCloud Private Relay enabled. Passkeys, considered a secure alternative to traditional usernames and passwords, use the WebAuthn standard.

However, a peculiar characteristic of passkeys causes a device's web request to bypass Private Relay, exposing a user's real IP address during what seems like a normal interaction with a website.

Further examination revealed that all web browsers on iOS, due to their reliance on Apple's WebKit engine, also fall victim to these issues. Notably, the Tor anonymity network's unofficial browser, OnionBrowser, was also impacted. Apple has been informed about these issues, but as of now, no specific timeline for addressing them has been provided. The researchers are available for further discussion via Signal at joseph.404 or email at joseph@404media.co.