A fake Hide My Email header can expose the address behind your Apple Account

A forged Hide My Email header can make Mac Mail expose a user's Apple Account address, extending the privacy risk beyond people who use Apple's alias service.


Developer Jeff Johnson disclosed the Mac Mail privacy flaw on July 19. His testing showed that a specially crafted message could make Mail display a misleading sender identity while a reply went out from the email address tied to his Apple Account.

The behavior didn't require Johnson to use Hide My Email or maintain an iCloud.com mailbox. He also found that the malicious message could arrive through an unrelated personal or business account before Mail exposed the Apple Account address in a reply.

Johnson said he doesn't know whether the finding is technically related to an earlier flaw that could reveal the address behind a Hide My Email alias. His report documents a separate technique and doesn't establish that both issues share the same underlying cause.


Continue Reading on AppleInsider | Discuss on our Forums