Cybersecurity researchers have flagged a potential zero-day vulnerability in Apple’s new iCloud Private Relay service for iOS 15, through which it can leak users’ true IP addresses.
Offered as a free upgrade provided for paying iCloud users in Apple’s latest mobile operating system update, iCloud Private Relay allows users to hide their IP addresses and DNS requests from websites and network service providers.
However, Sergey Mostsevenko, a researcher and developer at security vendor FingerprintJS, discovered that the service leaks IP addresses through the WebRTC API.
- Shield yourself with these best identity theft protection services
- We've put together a list of the best endpoint protection software
- Here’s our list of the best VPN services
In a post detailing the vulnerability, Mostsevenko demonstrates that this leak enables websites to establish direct communication with their visitors, defeating the anonymizing purpose of the private relay service.
Leaky service
The new Apple service is similar to a VPN, in that it encrypts web-browsing traffic and sends it through a relay to obfuscate its contents, including the user’s location and IP address. When browsing the web through the service, visited websites will only see the proxy IP address assigned by iCloud.
Explaining Mostsevenko’s findings, The Daily Swig says that the service relies on WebRTC to set up communications with the help of the ICE (interactive connectivity establishment) framework.
As part of that process it collects what are known as ICE candidates, which include various pieces of information such as the IP address or domain name, port, protocol, and other information, which it then returns to the browser.
However Mostsevenko found that Apple’s Safari web browser is passing ICE candidates containing the real IP addresses.
“To fix this vulnerability, Apple will need to modify Safari so it routes all traffic through iCloud Private Relay,” concludes Mostsevenko, who has reported the vulnerability to Apple, but hasn’t heard back.
- We’ve also rounded up the best business VPN services
Via The Daily Swig
