Apple's Private Relay Is Leaking Your IP

Summary of the Surveillance Report (Techlore)

1) Apple privacy features showing new leaks (and slow fixes)

Apple iCloud Private Relay (Safari)

Researchers from MISC identified multiple issues that can leak identifying data even when Private Relay is enabled:

1. DNS prefetching bug: Safari incorrectly resolved domain queries outside the Private Relay tunnel, potentially exposing users’ real DNS server.
2. Web Transport protocol leak: the protocol could expose the user’s real IP address.
3. Passkey system bypass: passkey/passwordless logins may bypass the proxy and reveal IP addresses.

Presenter’s takeaway: Apple’s recurring problem pattern and criticized response time/transparency. The presenter also argues that Private Relay being Safari-only is a major limitation for threat models.

Action guidance: The presenter says Apple has not fixed the Private Relay problem; users who need IP protection in Safari should stop using Private Relay until clarified/fixed.

Apple “Hide My Email”

Easy Opt Outs founders discovered that real email addresses appeared alongside Hide My Email addresses in bounce logs while investigating delivery issues.

• Apple reportedly took months to fix.
• The issue was patched on July 7.

Action guidance: Hide My Email is said to be fixed now, but the presenter still views it as evidence of broader Apple handling concerns. They also recommend dedicated aliasing services as an alternative with potentially more control.

macOS screen sharing vulnerability (remote login without a password)

A bug allowed remote attackers to log in without a password via screen sharing.

The presenter recommends:

• Update macOS (patched in Tahoe, Sequoia, Sonoma).
• Check/disable Screen Sharing if unused.
• Ensure the macOS firewall is enabled, since enabling Screen Sharing opens a port; routers/firewalls may not block it without configuration.

Apple spyware-targeting notifications (more alerts than usual)

Apple sent more notifications than normal to people targeted by spyware—often state-sponsored tooling exploiting unknown vulnerabilities.

• iVerify and Access Now reported a spike in such notifications.

Guidance: If notified, enable protections like Lockdown Mode, update devices, and seek help from digital rights organizations. The presenter notes this still matters even if it usually affects a smaller subset of users.

---

2) Browser privacy/security updates: extension scams + ad blocker tech changes

Fake Chrome VPN/proxy extensions

At the time of reporting, 737 extensions impersonated well-known services (including ProtonVPN, NordVPN, Surfshark, ExpressVPN, and Cloudflare’s 1.1.1.1) on the Chrome Web Store.

• Google removed 200+, but 500+ remained.

Advice: Avoid extensions where possible; if needed, go to the official developer site rather than relying on search results/ads or ambiguous listings.

Edge moving away from Manifest V2

Microsoft Edge is preparing to move away from Manifest V2 and toward Manifest V3.

Manifest V3 is portrayed as making ad-blocking and filtering harder due to:

• limited rule counts,
• restrictions on certain filtering techniques,
• more dependency on updates shipped with the extension.

Comparative guidance: The presenter suggests Firefox still supports MV2 longer, while many Chromium-based browsers have largely moved on. Firefox forks (e.g., Brave, noted for allowing MV2 via settings) are mentioned as partial exceptions.

---

3) Antitrust and child-safety regulation: small wins, ongoing concerns

Google Play anti-competitive ruling (1-week deadline)

A judge ordered Google to fix anti-competitive behavior in Google Play within one week.

Context: Google allows third-party app stores but adds extra friction via advanced flows, reboots, waiting periods, and confirmations.

Presenter’s view: A partial win, but Google still controls the ecosystem and may discourage usage (e.g., confusing UI such as “View” instead of “Install,” and problematic search behavior).

France blocks under-15 social media ban

France’s top court blocked a proposed ban requiring children to be barred from social media under 15.

Presenter’s arguments:

• ID-based verification shifts risk onto individuals and raises privacy concerns because it requires uploading ID to platforms.
• The court ruled the rules infringe freedom of expression and lacked legal safeguards for privacy.

Framing: A precedent-setting EU direction, but criticized as “pseudo-solutions” that don’t directly regulate platform behavior.

---

4) “Defense Bulletin”: major breaches and threats

Data breaches (examples highlighted)

• CareCloud: 3.7M patients (initially disclosed in March; more details emerging later).
• LiteLLM (supply chain): terabytes of credentials exposed, impacting many organizations.
• Claim of 3.6M Azure account records stolen (posts linked to alias “The Hat Man”).
• RingCentral: 1.6M accounts impacted.
• Sakura (Japan cloud/DC provider): access to a sales management system with contract/membership info.
• Clarity Check (data broker/people-search): scraped millions of face photos; also exposed emails/phone numbers.
• France tax authority breach: 678k individuals.
• SafePal: 39,798 customers’ personal data stolen (not seed phrases/private keys).
• ShipMonk-related breach: nearly 14,000 customers.
• Pokemon Center: third-party breach in the UK/Germany.

Threats

• Mirai-based Linux botnet (EV0001Bot): turns routers/gateway devices into traffic relay nodes by exploiting vulnerabilities.
• Comcast router motion sensing: an opt-in feature that notifies movement; research suggests high identification accuracy (99.5%) and raises privacy concerns (including Comcast’s ability to share data with third parties).

Additional alerts mentioned:

• Google buying/using data from failed companies to feed AI (example: Spirit Airlines; earlier reference: Fitbit/23andMe).
• DDoS against Threema.
• A Microsoft Copilot issue where secret input reportedly enabled hacking.

---

5) Open source / privacy-positive updates

• Tor Browser 15.0.20: security updates and minor fixes.
• Waterfox 6.7 “Supernova”: ESR 153, UI improvements, ad blocker panel rebuild, and extension support.
• Firefox for iOS: experimental native ad blocker (off by default), using EasyList-based filtering.
• Startpage added inside Firefox (as an option).
• Brave 1.93: GPU fingerprinting protections.
• ProtonMail: introduces email categories (defaulted) like primary/social/promotions/newsletters/transactions/updates.
• Proton feature: “AI Paper Trail”: exports data from AI accounts (e.g., OpenAI/Clot) and uploads it to Lumo AI to show what an AI service “knows” about you.
• Post-quantum and security engineering notes:
  • Entei blog: early steps to post-quantum end-to-end encrypted photo storage.
  • Linux kernel 7.2 release highlights.
• Hardware/organizing updates:
  • Fairphone Gen 6 Plus available in the US.
  • SimpleX messenger equity crowdfunding via WeFunder (presented as unusual/rare).
  • Pine64: no near-term plans for more Linux devices due to DRAM/eMMC shortages; may reassess after mid-2027.

---

Presenters / Contributors

Presenter/Host

• Techlore (narrator throughout)

Contributors/Organizations mentioned

• MISC
• Easy Opt Outs
• iVerify
• Access Now
• AdGuard
• Bleeping Computer (implied via imagery reference)
• Addy.io (sponsor)
• Epic (referenced in Play Store/App store context)
• France’s top court / Council
• CareCloud
• LiteLLM
• Clarity Check
• SafePal
• ShipMonk
• Pokemon Center
• EV0001Bot
• Comcast
• Threema
• Tor Browser, Waterfox, Firefox, Brave, ProtonMail
• Lumo AI
• Entei
• Linux kernel team
• Fairphone
• SimpleX
• Pine64