Apple 'Hide My Email' vulnerability reveals peoples' real email addresses

Post by js2 » Fri, Jul 03, 2026, 4:11 AM UTC

winstonwinston wrote: post #100

js2 wrote: post #99

Earlier quoted context omitted.

> Try figuring out the message size that the forwarding edge (icloud.com) accepts, but the receiver (the mailbox server) does not. Is this a theory or did you test this yourself? Anything even 1 byte less than that rejected at the edge passes through. And there's not a chain of SMTP servers either. It goes through a single SMTP server into my iCloud mailbox. If you think this is the flaw, you're welcome to prove it.…

> Is this a theory or did you test this yourself? This is just a pointer for exercise you could do if you are interested. I can’t tell what is the actual HME vulnerability they claim to exist.

Post by [deleted] » Fri, Jul 03, 2026, 4:42 AM UTC

winstonwinston wrote: post #102

js2 wrote: post #101

Earlier quoted context omitted.

Why don't you give it a try and report back.

I did but where is fun in that. When I got involved in infosec community decades ago, veterans told me then, I should always investigate for myself, not just reading someones reports, they were right. That’s why I suggested it, because you seemed interested.

Post by sealedmailuk » Fri, Jul 03, 2026, 7:51 AM UTC

js2 wrote: post #97

winstonwinston wrote: post #96

Earlier quoted context omitted.

Even when it rewrites message envelope and headers, the actual message body of an NDR (nondelivery report) can disclose original address information. Because the NDR is generated by the receiver server, the HideMyEmail does not have influence on what the message body can contain. Think of it as if you had an out-of-office autoreply which includes your email address among other information in the message body.

I've run decently sized SMTP servers in the course of my career. I have some idea how SMTP works. In my testing, Apple's HME SMTP servers do NOT sanitize the headers at all. If you setup HME to forward to a non-iCloud address, you absolutely risk leaking information if you reply to an HME email. For example, in my testing, the replies disclosed the DMARC policy I have on my domain when Apple's SMTP servers themselves…