When Apple unveiled iCloud+ at its Worldwide Developers Conference (WWDC) in June 2021, one of its key features was a secure VPN called Private Relay. Yet a fresh report claims the service has been leaking user data on MacOS, potentially meaning it’s not as secure as previously thought.
Private Relay works by obfuscating various identifying pieces of information when you browse the internet. It encrypts your data, separates your page requests from your IP address, then assigns you a spoof IP address. The idea is that it becomes impossible for anyone (including Apple) to see which websites you are visiting.
However, it seems there are cracks in its defenses. Doubts were raised by VPN service Mullvad, which alleges that Private Relay can cause the system it’s installed on to ignore network firewall rules. When that happens, Private Relay can leak that the system is communicating to Apple servers.
That might not seem like much, but the upshot of this is that it signals to your local network and your ISP that you are likely using a Mac computer. It’s not the most damaging information out there, but if a bad actor is snooping on your network traffic, that could give them ideas for a line of attack.
Calling home to Apple
Digging into the specifics, Mullvad spotted QUIC data (that is, data from a protocol designed to make web traffic faster and more secure) leaving its test computer outside of the Private Relay VPN tunnel. In other words, this data had somehow escaped Private Relay’s secure connection and was leaking to the outside world. Disabling Private Relay stopped the leak in its tracks.
While Mullvad couldn’t determine what data was leaked (it was encrypted, after all), the fact that any data at all was leaking was cause for concern. The report’s authors explain that, “We believe [the leaked information is] just some heartbeat signal calling home to Apple.” As previously noted, that could flag up the user’s system to other network users.
Mullvad’s report claims that, for now, the only way to prevent this data leak is to disable Private Relay entirely. Until Apple patches the flaw, that might be the best course of action if you are concerned.
In the meantime, if you are looking for a replacement for Private Relay, we’ve put together a list of the best VPN services that will keep your data safe and protected.
