Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses

WebKit Proxy Bypasses Expose Real IPs Through iCloud Private Relay

Cybersecurity researchers have disclosed a security issue with Apple's iCloud Private Relay tool that can expose a user's real IP address. Introduced with iOS 15, iCloud Private Relay employs a dual-hop architecture to ensure users' privacy by routing their Safari web traffic through two relays so that no single third-party, including Apple, can determine where the request is originating from and what sites are being visited.

The issue is rooted in three features in Apple's WebKit: DNS prefetching, WebAuthn Related Origin Requests, and WebTransport. WebKit is the default web browser engine used by Safari and all third-party browsers on iOS and iPadOS, such as Google Chrome, Microsoft Edge, Mozilla Firefox, Brave, and others.

The three features 'bypass the configured proxy and send traffic directly from the device, which exposes the user's real network,' the researchers said. 'The same leaks also affect Apple's iCloud Private Relay.'

The issues also affect macOS, as well as any other WebKit-based browser that relies on WebKit's proxy configuration APIs. In each of these cases, the device's actual IP address is leaked - DNS prefetching resolves hostnames through the device's normal DNS path instead of the proxy set by the browser, WebAuthn Related Origin Requests make the operating system's credential service fetch a validation file directly from the device, and WebTransport opens a direct HTTP/3 connection and bypasses the proxy.

Given that WebAuthn lets users log into websites using passkeys, any website that claims to support the web standard can view a user's real IP address even if iCloud Private Relay is on. 'Any website can configure WebAuthn (the API used for passkeys) in a way that causes WebKit to reveal the browser's real IP address, bypassing both proxy configurations and iCloud Private Relay in Safari,' Mysk told The Hacker News.

'A proof-of-concept (PoC) website named 'leaks.psylo[.]app' has been made available for anyone to check if their real IP address leaks, even when Private Relay is on. While the 'HTTPS Traffic' section refers to the regular network traffic that WebKit generates when connecting to a website, 'Possible IP leaks' shows how the device's real IP address can leak out of the configured proxy path,' Mysk added.

Apple did not immediately respond to a request for comment. But the company told 404 Media that it's investigating the researchers' report. This is not the first time security issues have been discovered in iCloud Private Relay. Shortly after the feature was released in 2021, FingerprintJS highlighted a WebRTC-based mechanism that leaked a client's real IP address.

The disclosure comes a little over a month after Cupertino addressed another vulnerability in its Hide My Email service that enabled users' real email addresses to be unmasked under certain conditions, undermining the feature's privacy guarantees.