Related:
Apple is about to make Hide My Email useless
Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
31–40 of 105 posts
Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
#32Is it based on mail undeliverable errors? Or attempts to login using IMAP or SMTP with it? Or is it exposed during the SMTP protocol?
My guess would be it has nothing to do with email itself. Maybe it's some iCloud API that accepts obfuscated emails but returns the original email in the response, or an ID which can be used to retrieve the iCloud email from another API endpoint. Could be as simple as an "add contact/friend" feature in some Apple product (like a mail client, or a file sharing service) that resolves the obfuscated email to the origina…
I think they are hinting at the ad hoc "use hidemyemail" feature within e.g. the mail client.
I don't know what I am doing, but from a quick test, the mail header is at least disclosing the internal recipient (mail@host.com) "translation address" (as mail_at_host_com_12345abc_12345abc@icloud.com) and an alias creation date. But the latter seems to be a unix timestamp related to the real address alias creation time and is identical between an hidemyemail mail and a normal one, so there may be already a possible information leak for correlation. Side note, it also seems like the sending hidemyemail server contains the unsuspicious name "junk_forwarder". Lol.
Disclosing an address as alias and particularly as throwaway alias (through the translation address and server) already seems kinda counterproductive to begin with, but I would bet you can use this information somehow to get the sender "translation address". Either by some API interaction, or by messing with the mail header scrubbing of the translation service somehow. A server named "junk_forwarder" may be a little more lenient about what to accept or not.
Edit: Can confirm the Reddit comment linked. You simply send an email to the HME address, reply from Apple mail client, and then the real mail address gets disclosed. Mind you not even hidden. It's shown as sending from the HME alias in mail, but I received the mail with the real address as sender......... Jesus fucking christ, Apple. Did you even test this a little?
Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
#33That's disappointing, both that the vulnerability exists in the first place, and that Apple takes over a year to not even fix it.
They're a struggling company and can't hire top talent.
Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
#34That timeline was exactly my experience with Apple here - https://www.grepular.com/Apples_Protect_Mail_Activity_Doesnt... They don't seem to know or care what is going on with their own email systems.
I’m still mildly annoyed every email I send using Mail has my IP embedded in it
Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
#35That timeline was exactly my experience with Apple here - https://www.grepular.com/Apples_Protect_Mail_Activity_Doesnt... They don't seem to know or care what is going on with their own email systems.
Fetching any email content is always worse than blocking it, because the typical threshold for spam is "is this inbox monitored". If that is true, then blast it with spam. And fetching anything ever proves that the inbox is monitored.
My impression as a Mutt user (which never downloads linked content) is that spammers don’t really care about whether an inbox is “monitored” or not.
Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
#36As someone who uses this feature I never send messages from a hide my email address as I only use it for random email signups. Am I still at risk of having my email exposed??? It’s also handy for using for free trials lol.
Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
#37That timeline was exactly my experience with Apple here - https://www.grepular.com/Apples_Protect_Mail_Activity_Doesnt... They don't seem to know or care what is going on with their own email systems.
I’m still mildly annoyed every email I send using Mail has my IP embedded in it
Source? I don't think this is true. Doesn't seem to be the case for me. Maybe your email provider attaches your IP address?
Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
#38Earlier quoted context omitted.
My guess would be it has nothing to do with email itself. Maybe it's some iCloud API that accepts obfuscated emails but returns the original email in the response, or an ID which can be used to retrieve the iCloud email from another API endpoint. Could be as simple as an "add contact/friend" feature in some Apple product (like a mail client, or a file sharing service) that resolves the obfuscated email to the origina…
I think they are hinting at the ad hoc "use hidemyemail" feature within e.g. the mail client. I don't know what I am doing, but from a quick test, the mail header is at least disclosing the internal recipient (mail@host.com) "translation address" (as mail_at_host_com_12345abc_12345abc@icloud.com) and an alias creation date. But the latter seems to be a unix timestamp related to the real address alias creation time an…
> You send an email to the HME address, reply, and then the real mail gets disclosed in the mail source.
Does the initial sender matter? Like if it’s the HME address that sends first and receives the reply? I have around 180 of these addresses.
Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
#39That timeline was exactly my experience with Apple here - https://www.grepular.com/Apples_Protect_Mail_Activity_Doesnt... They don't seem to know or care what is going on with their own email systems.
Fetching any email content is always worse than blocking it, because the typical threshold for spam is "is this inbox monitored". If that is true, then blast it with spam. And fetching anything ever proves that the inbox is monitored.
At least in Gmail, downloading content (e.g. images) is disabled by default for suspicious emails. There is no way for the sender to know if it’s monitored unless this is disabled by explicit user action.
Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
#40It’s hard for me to assess how real this risk is. Without details, we’re just extrapolating from circumstantial vibes. What’s described sounds like it might be spooky. It might also be a magic trick to some degree… Mr. Cox’s PoC—“I gave a fresh Hide-My-Email alias to a guy who knows who I am, and he told me the email on my Apple ID”—is consistent with the claimed behavior but not exactly watertight. It also sounds li…
> > “It seems that ending new sales of Hide My Email until the problem is fixed would be an effective way to limit the number of customers at risk. Is that an option?” Murphy wrote back. > I can only hope that was a sardonic moment of frustration quoted out of context I didn't make my point clearly there, and I think it makes more sense in context, but it was a sincere suggestion that Apple could stop allowing new pe…
Makes sense to me! I'd gone off the 404 Media article originally linked. The way you put it in your blog timeline (now the link of record) makes perfect sense to me:
> We hope that Apple will take steps to limit the attack surface area even before the vulnerability is fixed. Disabling creation of new Hide My Email addresses could be helpful. It also seems responsible to notify all Hide My Email users of the risk.
Thank you for your work, and your persistence against our Sphinx-like overlords!