Vulnerability in Apple's Hide My Email Feature Could Expose User Emails
Quick Look
- A vulnerability in Apple's Hide My Email feature, part of iCloud+, may allow hackers to link users' real email addresses to the anonymous ones created by the service.
- Researchers reported the issue to Apple a year ago, but it remains unpatched.
AI-generated summary
Why It Matters
Apple's Hide My Email feature allows iCloud+ subscribers to create anonymous email addresses to protect their privacy. A vulnerability reportedly allows hackers to link these anonymous emails back to users' real ones.
Hide My Email may not be keeping your personal information fully private. This feature is an option iCloud+ subscribers can use to create an anonymous email address rather than using their own contact info. It's used as a workaround to avoid spam and data trackers, or simply to keep personal information safe against potential future data breaches. However, according to a report by 404 Media, there is a vulnerability with this feature that allows hackers to connect users' real email contacts to the ones created by Apple.
We've reached out to Apple for comment, and will update this article if we hear back.
The issue was uncovered by the team at EasyOptOuts, and according to CEO Tyler Murphy, the group contacted Apple about the issue and how to replicate it a year ago. He had some conversation with the company via email and Apple reportedly responded at various points that it was looking into the problem or that a solution was either in the works or had been deployed. However, Murphy and 404 reporter Joseph Cox were able to exploit the vulnerability for this article. The exact details of the exploit have not been disclosed due to the potential risk to Apple users.
"We don't know why it hasn't been fixed, but we don't feel comfortable waiting any longer. Hide My Email users deserve to know that it may be possible for attackers to discover their hidden email addresses," Murphy told 404. He added, "We don't know the full scope of the issue, but in our limited tests with volunteers, 100 percent of Hide My Email addresses were exploitable."
What to Watch
AI outlook — possibilities, not facts
Apple will likely release a patch to fix the Hide My Email vulnerability.
Likely · Within weeks
Open Questions
- What is the exact technical detail of the exploit?
- Has any user's email been compromised due to this vulnerability?
- Why has Apple not fixed this issue after a year?
