Apple Hide My Email Flaw Exposed Real User Email Addresses

Key Takeaways

• A critical vulnerability in Apple’s “Hide My Email” feature allows real user email addresses to be exposed.
• The flaw affects iCloud+ users who rely on the service for privacy and anonymity.
• Discovered over a year ago by security researcher Tyler Murphy, the vulnerability remains unpatched.
• Exploitation is possible with limited technical skill, undermining user privacy and increasing risks of targeted attacks.

Apple’s “Hide My Email” feature, a cornerstone of its iCloud+ privacy offerings, is currently compromised by an unpatched vulnerability. This flaw permits malicious actors to uncover the genuine email address behind an anonymized alias, a discovery validated by security researcher Tyler Murphy and independently confirmed by 404 Media.

Designed to safeguard user privacy, Apple’s Hide My Email generates unique, relay email addresses. These aliases are intended to shield a user’s primary inbox when signing up for services or registering for applications, preventing direct exposure of their personal email.

According to Murphy, co-founder of EasyOptOuts, a critical defect within this mechanism allows individuals with even modest technical expertise to ascertain the underlying real email address that should remain confidential.

Apple ‘Hide My Email’ Vulnerability

404 Media corroborated the existence of this issue, successfully testing it against one of its own hidden addresses. The publication confirmed the vulnerability remained exploitable as of Monday, more than a year after it was initially reported to Apple.

EasyOptOuts initially identified the vulnerability and provided Apple with comprehensive reproduction instructions over a year ago, adhering to established responsible disclosure protocols. Despite this, Apple has not deployed a patch or communicated any mitigation strategies to affected users, leaving the weakness active within its production services.

Given the continued exploitability of the bug, 404 Media and Murphy have opted for a partial disclosure. This approach aims to alert the public to the danger while withholding precise exploitation steps to prevent widespread, trivial abuse.

Hide My Email is a widely adopted feature, particularly by privacy-conscious individuals who depend on Apple’s ecosystem to segregate identities across various online services, thereby reducing tracking and unsolicited spam.

This vulnerability critically undermines the trust boundary established by the feature. It transforms supposedly opaque aliases into weak pseudonyms that can be traced back to the user’s actual mailbox. This significantly elevates the risk of targeted phishing campaigns, spam correlation, and the deanonymization of accounts linked to sensitive activities.

Since exploiting this flaw does not demand elevated privileges or insider access, the threat landscape extends to common attackers who can systematically enumerate or probe Hide My Email addresses.

“We reported the issue and replication instructions to Apple over a year ago. We don’t know why it hasn’t been fixed, but we don’t feel comfortable waiting any longer,” Murphy informed 404 Media. He emphasized that Hide My Email users “deserve to know that it may be possible for attackers to discover their hidden email addresses.”

This situation underscores a growing conflict between vendor silence and the necessity for transparent, actionable information regarding consumer privacy tools. Until Apple rectifies this flaw, journalists, activists, and other high-risk users should consider Hide My Email aliases as potentially linkable to their genuine email identities and adjust their operational security practices accordingly.

What You Should Do

• Assume any “Hide My Email” aliases you use could be linked to your real email address.
• Exercise extreme caution with emails received via Hide My Email aliases, especially if they contain suspicious links or attachments.
• Consider using alternative, more robust email anonymization services if your threat model requires absolute privacy.
• Stay informed about official communications from Apple regarding a patch or mitigation for this vulnerability.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.