iCloud Private Relay Vulnerabilities Could Expose User IP Addresses, Researchers Say

Security researchers have uncovered vulnerabilities in Apple's iCloud Private Relay feature that could expose users' real IP addresses and DNS information. The privacy tool, designed to enhance user privacy in Safari by masking IP addresses and locations, can be bypassed by certain WebKit functionalities, according to findings by Talal Haj Bakry and Tommy Mysk.

These vulnerabilities stem from legitimate browser technologies: DNS prefetching, a WebAuthn feature related to passkeys, and WebTransport. These methods can circumvent WebKit's proxy configuration, leading to the leakage of sensitive network data. The issue affects users on both iOS and macOS.

How Private Relay Works

iCloud Private Relay is available to iCloud+ subscribers and functions by routing Safari browsing traffic through two internet relays. The first relay encrypts DNS records, and the second assigns a temporary IP address to the website, preventing any single entity from seeing both the user's identity and their browsing activity. This system is intended to limit the amount of location and browsing data that websites can collect.

Identified Leaks

The researchers identified three distinct mechanisms that can bypass Private Relay's protections:

• DNS Prefetching: WebKit can use a device's normal DNS connection for prefetching, a process that anticipates website link lookups to speed up loading. This can allow websites to see DNS requests originating from the user's real network, rather than through the Private Relay proxy. This issue has been present in iOS since version 26.0.
• WebAuthn (Passkeys): A feature within WebAuthn, used for passkeys, can contact a website directly to verify if related domains share the same passkey. This verification request may occur outside of Safari's proxied network path, potentially revealing the device's actual IP address to the destination server. The researchers emphasized that this does not compromise passkey security itself but exposes network information.
• WebTransport: This feature allows websites to establish fast, low-latency connections with servers. Researchers found that WebKit can initiate WebTransport connections directly from the device, bypassing the proxy. Consequently, the server receiving the connection can see the user's real IP address. WebTransport has been publicly available on iOS since version 26.4.

Potential Impact and Affected Users

These findings are most relevant to users who rely on Safari with iCloud Private Relay for IP address privacy. Browsers or applications that use WebKit's proxy configuration might also be affected. The researchers noted that traditional VPNs are generally not susceptible to these specific WebKit proxy leaks, as VPNs tunnel traffic at the system level.

While these leaks do not directly reveal a user's home address, an IP address can indicate an internet provider and approximate location, serving as an identifier that websites can correlate with other collected data. For users employing Private Relay specifically to prevent such disclosures, this exposure is significant.

Protecting Privacy

Despite these vulnerabilities, users are advised not to disable Private Relay, as most Safari traffic still benefits from its protection. Keeping Apple devices updated with the latest iOS, iPadOS, and macOS versions is recommended, as security and privacy fixes are often included in software updates. For situations where hiding an IP address is critical, the researchers suggest considering a reputable full-device VPN. Passkeys are still considered a secure authentication method, as the vulnerability affects the network request during verification, not the passkey itself. Browser developers like Psylo have already begun implementing measures to block these specific bypass methods.