One of the best new iOS 15 features may also have a serious security flaw
iCloud Private Relay service leaking users’ true IP addresses
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Cybersecurityresearchers have flagged a potential zero-day vulnerability inApple’s newiCloud Private Relayservice foriOS 15, through which it can leak users’ true IP addresses.
Offered as a free upgrade provided for payingiCloud usersin Apple’s latest mobileoperating systemupdate,iCloudPrivate Relay allows users to hide their IP addresses and DNS requests from websites and network service providers.
However, Sergey Mostsevenko, a researcher and developer at security vendor FingerprintJS, discovered that the service leaks IP addresses through the WebRTC API.
We’re looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won’t take more than 60 seconds of your time, and we’d hugely appreciate if you’d share your experiences with us.
Click here to start the survey in a new window«
In apostdetailing the vulnerability, Mostsevenko demonstrates that this leak enables websites to establish direct communication with their visitors, defeating the anonymizing purpose of the private relay service.
Leaky service
The new Apple service is similar to aVPN,in that it encrypts web-browsing traffic and sends it through a relay to obfuscate its contents, including the user’s location and IP address. When browsing the web through the service, visited websites will only see the proxy IP address assigned by iCloud.
Explaining Mostsevenko’s findings,The Daily Swigsays that the service relies on WebRTC to set up communications with the help of the ICE (interactive connectivity establishment) framework.
As part of that process it collects what are known as ICE candidates, which include various pieces of information such as the IP address or domain name, port, protocol, and other information, which it then returns to the browser.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
However Mostsevenko found that Apple’sSafari web browseris passing ICE candidates containing the real IP addresses.
“To fix this vulnerability, Apple will need to modifySafariso it routes all traffic through iCloud Private Relay,” concludes Mostsevenko, who has reported the vulnerability to Apple, but hasn’t heard back.
ViaThe Daily Swig
With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’sTechRadar Pro’sexpert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.
Cisco issues patch to fix serious flaw allowing possible industrial systems takeover
7 myths about email security everyone should stop believing
Google TV will require more RAM for future upgrades – which might leave older TVs and streaming boxes behind
