Apple's iCloud Private Relay is supposed to protect your privacy. But researchers have found a way to expose your real IP address even when the feature is turned on. The issue lies in three WebKit features that bypass the proxy and send traffic directly from your device.
Researchers Talal Haj Bakry and Tommy Mysk uncovered the iCloud Private Relay IP leak. The problem affects Safari and all WebKit-based browsers on iOS, iPadOS, and macOS. That includes Chrome, Edge, Firefox, and Brave on Apple devices.
Let me walk through how the iCloud Private Relay IP leak works, which features are responsible, and what this means for your privacy.
How iCloud Private Relay Is Supposed to Work
Introduced with iOS 15, iCloud Private Relay uses a dual-hop architecture to protect user privacy. Safari web traffic is routed through two relays. No single third-party including Apple can determine both where the request is coming from and what sites are being visited.
The feature is available as part of the iCloud+ subscription. It is designed to prevent websites and network providers from tracking your browsing activity and location.
But the iCloud Private Relay IP leak undermines these privacy guarantees. There are three WebKit features that circumvent the set proxy settings and go straight from the device, revealing the actual network of the user.
Three WebKit Features That Are to Blame
Apple's WebKit engine is responsible for the iCloud Private Relay IP leak because of three specific features.
- First, DNS prefetching resolves hostnames through the device's normal DNS path instead of the proxy set by the browser. This means your DNS queries bypass the Private Relay infrastructure and reveal your real IP address.
- Second, WebAuthn Related Origin Requests make the operating system's credential service fetch a validation file directly from the device. When a website supports passkeys, it can trigger this request and see your real IP address.
- Third, WebTransport opens a direct HTTP/3 connection and bypasses the proxy entirely. This is a newer protocol that is not routed through the Private Relay infrastructure.
The iCloud Private Relay IP Leak can occur on any WebKit based browser that uses the WebKit proxy configuration API, including Safari on iOS, iPadOS, and macOS, along with third party WebKit based browsers on Apple devices.
The WebAuthn Connection
WebAuthn is the API used for passkeys. It lets users log into websites using biometric authentication or security keys. But the iCloud Private Relay IP leak shows that this technology has a privacy downside.
Any website that claims to support WebAuthn can view a user's real IP address even if iCloud Private Relay is on. The website does not need to use passkeys or require any user interaction. Simply supporting the API is enough.
"The website has to deliberately exploit it to associate the user's current browsing session with the leaked IP address," Mysk told The Hacker News. "This does not require any user interaction or the use of passkeys."
This is a significant privacy concern. A malicious website could identify you even when you are using Apple's privacy feature.
A Proof of Concept Is Available
The researchers have made a proof-of-concept website available at "leaks.psylo[.]app". Anyone can visit the site to check if their real IP address leaks, even when Private Relay is on.
The site shows two sections. "HTTPS Traffic" refers to the regular network traffic that WebKit generates when connecting to a website. "Possible IP leaks" shows how the device's real IP address can leak out of the configured proxy path.
Mysk added that not every browser is affected. Desktop Chrome is not affected, for example. The iCloud Private Relay IP leak is also mitigated when the user is connected to a VPN.
Apple's Response
Apple did not immediately respond to a request for comment from The Hacker News. But the company told 404 Media that it is investigating the researchers' report.
This is not the first time security issues have been discovered in iCloud Private Relay. Shortly after the feature was released in 2021, FingerprintJS highlighted a WebRTC-based mechanism that leaked a client's real IP address.
The iCloud Private Relay IP leak is part of a pattern. Privacy features can be very sophisticated, but people are finding ways to bypass these protections.
The Larger Context of Privacy
The iCloud Private Relay IP leak announcement occurs just a little more than a month after the disclosure of another Apple privacy breach involving their Hide My Email feature. For this situation, people’s email addresses would be exposed depending on certain factors.
The privacy issues bring out some concerns. To what extent should one trust Apple’s privacy feature? How reliable is it?
Apple has a strong track record of privacy advocacy. However, the iCloud Private Relay IP leak proves that a feature designed as securely as possible could still have some inherent vulnerability.
Implications for You as a User
- If you are using iCloud Private Relay, the iCloud Private Relay IP leak would mean that the actual IP address of yours would be leaked to websites exploiting these features of WebKit. This is particularly concerning if you rely on Private Relay to protect your identity.
- For most users, the risk is relatively low. It needs to intentionally exploit the iCloud Private Relay IP leak in order to tie your browsing session to your IP address. The iCloud Private Relay IP leak is not a passive one that takes place during every visit to the website.
However, iCloud Private Relay IP leak remains a privacy concern. Malicious actors could use it to track users who believe they are protected.
What You Can Do
Until the problem of iCloud Private Relay IP leak is solved by Apple, here are a few measures you could undertake.
- First, use a VPN. Mysk noted that the iCloud Private Relay IP leak is mitigated when the user is connected to a VPN. The VPN will hide your real IP address even if the WebKit features bypass the Private Relay proxy.
- Second, be very careful of the websites you access. The iCloud Private Relay IP leak only occurs when a website deliberately exploits the WebKit features. Avoid suspicious sites.
- Third, you may want to use another browser. The iCloud Private Relay IP leak affects WebKit-based browsers. Firefox on desktop uses a different engine and is not affected.
The Technical Details
The iCloud Private Relay IP leak highlights the complexity of proxy configurations. While Apple came up with Private Relay for user privacy, the following WebKit features do not use the proxy path.
The DNS prefetch feature is an optimization strategy. It involves resolving hostnames before their time to enhance web page loading times. However, it employs the DNS path of the device rather than the proxy.
WebAuthn Related Origin Requests are included in passkeys technology. In this case, the credential service obtains the validation file of the domain using the request that bypasses the proxy.
WebTransport is the protocol for HTTP/3 connections. It is designed for low-latency communication. But it does not respect the proxy configuration.
Each of these features has legitimate uses. But together, they create the iCloud Private Relay IP leak.
Wrapping It Up
ICloud Private Relay IP Leak is a privacy exploit that reveals the actual IP address of the user even if the Apple privacy feature is active. The three main WebKit features responsible for this exploit include DNS prefetching, WebAuthn Related Origin Requests, and WebTransport bypass the proxy and send traffic directly from the device.
It affects Safari and all other WebKit browsers running on iOS, iPadOS, and macOS. All websites that support WebAuthn can abuse the iCloud Private Relay IP leak without the consent of the user.
The company is looking into the problem right now. But until then, people can reduce the risk of the iCloud Private Relay IP leak by installing a virtual private network (VPN).
The iCloud Private Relay IP leak is an indication that the privacy feature is not perfect and users must know about this limitation and take additional steps to protect their privacy.
FAQ Section
What is the iCloud Private Relay IP leak?
It is a privacy vulnerability where three WebKit features—DNS prefetching, WebAuthn Related Origin Requests, and WebTransport—bypass Apple's privacy proxy and expose a user's real IP address even when iCloud Private Relay is enabled.
Which Browsers Are Affected by the iCloud Private Relay IP Leak?
The issue affects Safari and all WebKit-based browsers on iOS, iPadOS, and macOS, including Chrome, Edge, Firefox, and Brave on Apple devices. Desktop Chrome on other operating systems is not affected.
Passkeys Required for Leak?
Not necessarily. All that the website requires is that it should support the WebAuthn API. Neither any user action nor passkey involvement is required for the iCloud Private Relay IP leak.
Is there a way to check if I am affected?
Yes. The researchers have published a proof-of-concept website at leaks.psylo[.]app where you can test if your real IP address is exposed.
How can I safeguard myself from the iCloud Private Relay IP leak?
Using a virtual private network (VPN) will definitely prevent any leaks because it masks your IP address even when the WebKit features bypasse the Private Relay proxy. Not visiting suspicious websites is another way to avoid getting into trouble.
