Apple Investigates iCloud Private Relay Flaw That Exposes Real IP Addresses via Passkeys

Apple's paid privacy feature iCloud Private Relay has been found to contain a security vulnerability. Security researchers Tommy Mysk and Talal Haj Bakry discovered that the service fails to hide users' real IP addresses in certain circumstances, exposing their privacy while browsing the web. iCloud Private Relay, part of the iCloud+ paid subscription service, is designed to hide IP addresses and DNS information for Safari users through encrypted traffic and a dual-proxy mechanism.

The flaw is related to passkeys technology. When a webpage involves passkeys, the system uses the WebAuthn standard to store the key locally on the device rather than in the Safari browser. WebKit then hands the relevant authentication request directly to the operating system's credential service, and the HTTPS requests made by that service do not pass through iCloud Private Relay's proxy path, thereby exposing the device's real IP address directly to the server. An attacker could set up a webpage with embedded WebAuthn functionality and obtain a visitor's real IP address in the background without any pop-up prompts or user awareness.

Apple said it is investigating the report. Because the issue stems from the underlying workings of WebKit, some third-party browsers based on the same engine are also affected. The researchers have created a dedicated test website.