Recent findings have unveiled vulnerabilities within Apple’s WebKit browser engine that can reveal users’ actual IP addresses, even when utilizing iCloud Private Relay. This discovery raises significant concerns about the efficacy of Apple’s privacy tools.
iCloud Private Relay, introduced with iOS 15, is designed to enhance user privacy by routing Safari web traffic through two separate relays. This dual-hop architecture ensures that no single entity, including Apple, can ascertain both the origin and destination of a user’s web requests. The feature is available to subscribers of iCloud+.
Security researchers Talal Haj Bakry and Tommy Mysk have identified three specific WebKit features responsible for these IP leaks:
DNS Prefetching
This feature aims to speed up web browsing by resolving domain names before a user clicks on a link. However, it performs these resolutions through the device’s standard DNS path, bypassing any configured proxies, including iCloud Private Relay. Consequently, the user’s real IP address is exposed during the DNS resolution process.
WebAuthn Related Origin Requests
WebAuthn facilitates passwordless authentication using passkeys. When a website implements WebAuthn, the browser may fetch validation files directly from the device, circumventing proxy settings. This direct connection can inadvertently disclose the user’s actual IP address to the website.
WebTransport
WebTransport is a protocol that enables efficient, low-latency communication between browsers and servers. It establishes direct HTTP/3 connections, which can bypass proxy configurations. As a result, when WebTransport is used, the device’s real IP address may be exposed.
These vulnerabilities affect not only Safari but also any iOS and iPadOS browsers that rely on WebKit, such as Google Chrome, Microsoft Edge, and Mozilla Firefox. The issue extends to macOS and other platforms utilizing WebKit’s proxy configuration APIs.
To demonstrate the impact of these flaws, the researchers have developed a proof-of-concept website, leaks.psylo[.]app, where users can test if their real IP addresses are exposed, even with iCloud Private Relay enabled.
Apple has acknowledged the report and is currently investigating the matter. This isn’t the first time iCloud Private Relay has faced scrutiny. Shortly after its 2021 release, a WebRTC-based mechanism was found to leak users’ real IP addresses, highlighting ongoing challenges in maintaining robust privacy protections.
These revelations underscore the complexities of implementing comprehensive privacy features. Users should remain vigilant and consider additional privacy measures, such as using reputable VPN services, to safeguard their online anonymity. As the digital landscape evolves, continuous assessment and enhancement of privacy tools are essential to address emerging threats.
