Connect with us

An issue with iCloud Private Relay can reveal real IP addresses of users

Published

on

The problem affects users of devices running the latest version of the iOS operating system.

Vulnerability in Apple iCloud Private Relay could be used to leak real IP addresses of users of devices running the latest version of the iOS operating system.

iCloud Private Relay was introduced in beta with iOS 15 and is an additional layer of security that protects users’ privacy while browsing the web through its dual-hop architecture. Security is ensured by routing users’ Internet traffic in the Safari browser through two proxy servers.

This feature is only available to iCloud + subscribers on devices running iOS 15 or macOS 12 Monterey and earlier.

“If you read the IP address from the HTTP request received by the server, the result is the IP address of the outgoing proxy. However, you can get the IP of a real client through WebRTC, ”said cybersecurity researcher Sergei Mostsevenko from FingerprintJS.

WebRTC (Web Real-Time Communication) is an open source real-time multimedia communication standard that runs directly in a web browser. The project is intended for organizing the transfer of streaming data between browsers or other applications that support it using point-to-point technology.

Media exchange is established through a discovery and negotiation process called signaling, which involves the use of an infrastructure called Interactive Connectivity Establishment (ICE). The vulnerability discovered by FingerprintJS is related to Server Reflexive Candidate, which is generated by the STUN server when data from an endpoint needs to be transmitted through the Network Address Translator (NAT). Session Traversal Utilities for NAT (STUN) is a tool used to obtain the public IP address and port number of a networked computer located behind NAT.

The vulnerability is due to the fact that such STUN requests are not transmitted through the iCloud Private Relay proxy, leading to the disclosure of the client’s real IP address.

An expert warned Apple about the problem. The company has already released a fix for the vulnerability in the latest beta version of macOS Monterey, however, using iCloud Private Relay on iOS 15, the leak has not been fixed.

Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Security

Facebook Papers Sheds Light on Social Media Moderation Issues

Published

on

The media, to which the company’s internal documents were leaked, claim that the company prioritizes profits over users.

The so-called Facebook Papers (an array of documents released to the public by former Facebook product director Francis Haugen) shed light on the problems with content moderation and the fight against disinformation on the platform. Major media outlets to which Haugen handed the documents, including Reuters, Bloomberg and The Washington Post, argue that the company prioritizes profit over user safety, although Facebook employees have repeatedly warned it of the potential risks.

For example, The Washington Post accuses Facebook head Mark Zuckerberg of downplaying the importance of reports that the site contributed to incitement to hatred, while addressing the US Congress. According to the newspaper, Zuckerberg knew that the problem was actually much more serious than it was reported to the public.

According to internal company documents, the platform removes less than 5% of hateful posts, and senior management (including Zuckerberg) was well aware of the platform dividing people into opposing camps. Facebook denies the allegations and claims its internal documents were misinterpreted.

Zuckerberg is also allegedly responsible for the decision not to suppress misinformation about COVID-19 in the early stages of the pandemic, as there could be a “significant trade-off with the influence of MSI” (meaningful social interaction – an internal Facebook metric). Facebook denies this, claiming that the documents have been misunderstood.

In turn, the news agency Reuters accused Facebook of regularly neglecting developing countries, which were allowed to publish publications inciting hatred and calling for extremist action. In other words, the company did not hire enough moderators with knowledge of the language and culture of these countries to effectively remove such content. Instead, it unjustifiably relied on its automatic moderation systems, which are ineffective in non-English-speaking countries. Again, Facebook denies these allegations.

According to reports from The New York Times, Facebook was well aware that the “Like” and “Share” functions (key elements of the social network) contributed to the spread of hate speech. As stated in a document titled “What Is Collateral Damage”, Facebook’s failure to address this issue will ultimately result in the company “actively (not necessarily knowingly) promoting such activity.” Again, Facebook claims the document was misinterpreted because the company would not harm its users.

Continue Reading

Security

Discourse team has released an urgent patch to fix a critical vulnerability

Published

on

The vulnerability allows remote code execution using a specially crafted request.

Discourse Development Team let out steele update to address a remote code execution vulnerability in the platform.

Discourse is a popular open source Internet forum and mailing list management software with a client base of over 2,000 customers, including Amazon Seller Central, which has a monthly audience of 30 million users.

The vulnerability (CVE-2021-41163) is a validation error in the aws-sdk-sns gem upstream stream that can be exploited to remotely execute code using a specially crafted request. The highest severity vulnerability (CVSS 10) exists due to a lack of validation in the subscribe_url values.

The issue was fixed in Discourse 2.7.9 (stable) and 2.8.0.beta7. The Discourse team did not provide full information about the problem, but the information security expert who discovered the vulnerability, known as joernchen, published some details about her.

Developers are advised to upgrade to Discourse 2.7.9 and higher as soon as possible, and if this is not yet possible, apply protective measures, in particular, block requests containing the / webhooks / aws path at the upstream proxy level.

Continue Reading

Security

The skimmer on the SCUF Gaming website stole the data of 33 thousand bank cards

Published

on

The company warned its customers about possible suspicious activity with their bank cards.

Major manufacturer of custom gaming PCs and console controllers SCUF Gaming International notified its users that in February of this year, attackers hacked into his website and introduced a malicious script that steals bank card data.

SCUF Gaming users have fallen prey to web skimming, also known as e-skimming, digital skimming, or the Magecart attack. In the course of such attacks, attackers inject JavaScript scripts (so-called skimmers or Magecart scripts) into compromised online stores, which allow them to collect and steal payment and personal data of customers. Typically, the stolen information is then sold on hacking or carding forums or used for fraudulent purposes.

In this case, the script was injected into the online store SCUF Gaming after hackers gained access to the company’s backend server on February 3 using credentials belonging to a third-party vendor. Three weeks later, on February 18, the payment processor notified SCUF Gaming of unusual activity related to in-store credit cards. A month later, a skimmer was discovered on the site, which was subsequently removed.

“The investigation found that orders processed through PayPal were not compromised, and the incident is limited to payments and attempted payments using credit cards between February 3 and March 16,” the company said in a notice sent to affected users.

According to the notification, the names and surnames of cardholders, their email and billing addresses, card numbers, their expiration dates and CVVs could have been compromised.

The notification did not indicate the number of victims, but a letter to the attorney general says that the incident affected 32,645 people.

“This notification does not mean that fraud with your account has already taken place. You should monitor your account and notify the card issuer of any unusual or suspicious activity. As a precautionary measure, we recommend that you request a new payment card number from the issuer,” the notification says …

Continue Reading

Most Popular