Immue discovers new vulnerability in Apple’s private relay

Immue, an Israel-based cyber security company that provides holistic solutions against bot and fraud defense, claims it is found on vulnerabilities in one of Apple’s latest privacy features – the iCloud Private Relay. While helping organizations across various industries to stop cyber-scams and bot-targeted attacks on their companies, Immue said many of these attacks come from Internet Protocols (IPs) used with Apple and their two supporting Akamai and Cloudflare servers are associated.

In an exclusive interview with VentureBeat at the ongoing CyberWeek Tel Aviv, co-founders Amit Yossi Siva Levi (CTO) and Shira Itzshaki (CEO) confirmed that threat actors are taking advantage of Apple’s anonymity and web page privacy features around their IPs to mask and introduce. multiple undetectable attacks.

How Apple’s Private Relay Works

In June 2021, Apple hosted its annual global developer conference to showcase its latest technology. Among the technologies introduced, the most important and controversial was the private redemption technology that would be part of the iCloud + subscription. With this service, users on iOS 15, iPadOS 15 and macOS Monterey can browse safely without having to worry about their browsing activities being tracked and sold to the highest bidder.

By enabling this feature on an upgraded Apple device, users’ browsing activities on Safari are guided by two separate Internet “relays” using a sophisticated multi-hop architecture. This redirection guarantees that no single party – including Apple – can trace the exact origin of the request, making it impossible for websites to create a detailed profile of users. Some experts have even called it “internet privacy on steroids”.

The vulnerability

How private data is managed and shared has always been a concern for the average internet user. Mckinsey reports that Internet users are becoming more and more intent on the kind of data they share online and with whom, as no industry has achieved a 50% trust rating. With multiple data breaches popping up worldwide, many providers and even the government have made efforts to combat the threat – so much so that Gartner predicts that by 2025 the personal data of more than 75% of the world population will be protected by new privacy regulations.

The McKinsey report also revealed that these violations lead users to resort to tools that give them more control over their data and its privacy – such as the private relay. In solving this problem, however, Apple accidentally created a playing field for cyber-attackers to thrive.

In what Levi described as ‘a new kind of attack’, he explained that masking IP addresses with proxies, VPN or the Tor network to avoid IP-based detection (such as rate limit or IP score) is the only most important rule in cyber attack is. I added that over the past two months, Immue has seen attackers exploit Apple’s new feature to mask their IPs and send thousands of bots to attack their customers. These private relay IPs are also whitelisted by Apple, giving opponents unrestricted access to any website. Immue reports the attackers used 192 different IPs to generate three attacks with a volume of up to 50,000 bot requests each time.

Although Apple said the private redemption technology was equipped with anti-fraud and anti-abuse systems such as rate-limiting, one-time verification tokens and consistent IP address per browsing session, it advised that IP-only fraud detection systems should be updated to control the situation.

Founded in January 2021, Immue claims that its offering helps various organizations in various industries such as travel, finance, e-commerce, cryptocurrency and more – to outsmart the most experienced human fraudsters and untraceable bots. The company says it offers powerful anti-bot and anti-fraud defenses in one holistic solution that mitigates the impact of cyber attacks on businesses.

Immue’s unique value proposition, according to its co – founders, is its ability to detect cyber threats that no one knows exist. The company does this by monitoring and collecting data on the latest fraud mechanisms, tooling strategies and using that information to detect, prevent or stop cyber attacks before they even materialize.