Apple Private Relay Bug May Expose Your Real IP Address

Apple’s Private Relay, the privacy‑focused feature built into iOS and macOS, promises to hide a user’s IP address by routing traffic through two separate relays. A recent investigation reported by TechCrunch, however, has uncovered a serious flaw that can expose the real IP address under certain conditions.

The service works by encrypting outbound traffic, sending it first to an Apple‑operated “ingress” server that strips identifying information, and then forwarding it to a second “egress” server that delivers the request to the destination website. In theory, the destination site should only see the IP of the egress server, not the user’s own address. The new findings reveal that a DNS resolution step in the handoff between the two relays can leak the user’s original IP, especially on networks that prefer IPv6.

Researchers reproduced the issue across Safari, iCloud, and even third‑party browsers that rely on the system‑wide Private Relay setting. When the bug is triggered, the target website receives the true client IP instead of the anonymized relay address. Apple has not yet disclosed the full scope of affected devices, but security analysts warn that the exposure could enable precise location tracking and profiling.

Apple’s response indicates that a software patch is already in development, and users are advised to temporarily disable Private Relay until the fix is released. The incident highlights that even privacy‑centric services can contain hidden vulnerabilities, emphasizing the need for continuous security audits and prompt updates. Keeping devices up to date and regularly reviewing privacy configurations remain the best defenses against unexpected data leaks.

Source: TechCrunch

ETİKETLER