Cybersecurity (opens in new tab) researchers have flagged a potential zero-day vulnerability in Apple’s new iCloud Private Relay (opens in new tab) service for iOS 15 (opens in new tab), through which it can leak users’ true IP addresses.
Offered as a free upgrade provided for paying iCloud users (opens in new tab) in Apple’s latest mobile operating system update, iCloud Private Relay allows users to hide their IP addresses and DNS requests from websites and network service providers.
However, Sergey Mostsevenko, a researcher and developer at security vendor FingerprintJS, discovered that the service leaks IP addresses through the WebRTC API.
- Shield yourself with these best identity theft protection services (opens in new tab)
- We've put together a list of the best endpoint protection (opens in new tab) software
- Here’s our list of the best VPN services (opens in new tab)
In a post (opens in new tab) detailing the vulnerability, Mostsevenko demonstrates that this leak enables websites to establish direct communication with their visitors, defeating the anonymizing purpose of the private relay service.
Leaky service
The new Apple service is similar to a VPN (opens in new tab), in that it encrypts web-browsing traffic and sends it through a relay to obfuscate its contents, including the user’s location and IP address. When browsing the web through the service, visited websites will only see the proxy IP address assigned by iCloud.
Explaining Mostsevenko’s findings, The Daily Swig says that the service relies on WebRTC to set up communications with the help of the ICE (interactive connectivity establishment) framework.
As part of that process it collects what are known as ICE candidates, which include various pieces of information such as the IP address or domain name, port, protocol, and other information, which it then returns to the browser.
However Mostsevenko found that Apple’s Safari web browser (opens in new tab) is passing ICE candidates containing the real IP addresses.
“To fix this vulnerability, Apple will need to modify Safari so it routes all traffic through iCloud Private Relay,” concludes Mostsevenko, who has reported the vulnerability to Apple, but hasn’t heard back.
- We’ve also rounded up the best business VPN services (opens in new tab)
Via The Daily Swig (opens in new tab)
