Apple’s new VPN-like privacy service leaks users’ true IP addresses

guest · Sep 22, 2021

New iCloud Private Relay service leaks users’ true IP addresses, researcher claims
De-anonymizing users of VPN-like service, launched with iOS 15 yesterday, is ‘easily accomplished
September 22, 2021
https://portswigger.net/daily-swig/...aks-users-true-ip-addresses-researcher-claims

An as-yet-unpatched vulnerability in Apple’s new iCloud Private Relay service for iOS 15 means it can leak users’ true IP addresses, a security researcher has claimed.

iCloud Private Relay is a free upgrade provided for paying iCloud users in Apple’s latest mobile operating system update, which was launched yesterday (September 21).
It has similarities to a VPN in that it encrypts web-browsing traffic and sends it through a relay to hide the contents, as well as the user’s location and IP address. Any websites visited should only see the proxy IP address assigned by iCloud.
Click to expand...

WebRTC leak vector
However, a security researcher has discovered that it can leak IP addresses through WebRTC, a browser API that allows websites to establish direct communication between website visitors – and which has been associated with similar weaknesses in other browsers in the past.

However, writes Sergey Mostsevenko, a researcher and developer at browser fingerprinting library FingerprintJS, Safari is passing ICE candidates containing real IP addresses to the JavaScript environment.

“De-anonymizing you then becomes a matter of parsing your real IP address from the ICE candidates – something easily accomplished with a web application,” he says.
Click to expand...

Log in or Sign up

Apple’s new VPN-like privacy service leaks users’ true IP addresses

guest Guest

Log in or Sign up

Apple’s new VPN-like privacy service leaks users’ true IP addresses

guest Guest

Useful Searches