Announcing 1Password®

Extended Access Management

Kolide Device Trust is now part of 1Password® Extended Access Management. Check out the blog post by former Kolide CEO Jason Meller to learn about the next evolution in user-first security.

Read the Announcement

What Is iCloud Private Relay?

Apple’s iCloud Private Relay is a new privacy feature available on macOS 12+ and iOS 15+. When enabled, iCloud Private Relay allows users to browse websites without the websites’ operators being able to see the device’s IP address or precise geographic location. Additionally, network operators like an ISP will be unable to collect any information about the end-user’s browsing history (typically accomplished by recording DNS requests).

iCloud Private Relay is accessible by end-users in the System Settings App under the “Apple ID” section.

See Apple’s official documentation for more information about how iCloud Relay works.

Is iCloud Private Relay a VPN replacement?

No. Unlike a VPN, iCloud Private Relay only works with specific apps that support it. For example, on macOS, even with iCloud Private Relay enabled, Google Chrome still sends your actual IP address.

iCloud Private Relay doesn’t work with every app. For example, Chrome (pictured left) still sends your actual IP address to websites. In contrast, a VPN operates at the network layer, and when configured correctly, will funnel all traffic through the private network before it is sent to the intended final destination (regardless of the app being used on the device).

Should End-Users Turn Off iCloud Private Relay?

iCloud Private Relay is a privacy win for most users, but it comes with important trade-offs that may disproportionately impact certain users and organizations. Let’s go through a few of those tradeoffs.

Private Relay Disrupts Certain Network Audit Logging Strategies

Certain industries have strict network audit logging requirements. When iCloud Private Relay is used, DNS requests and other traffic originating from Safari will be fully encrypted and inscrutable to traditional network monitoring solutions.

Private Relay Disrupts Socket Filtering with a Default Route

Certain apps (for example AdGuard), work by using macOS’ built-in socket filtering APIs to filter undesired network traffic. If this API is used in conjunction with a “default route” rule, Private Relay simply will not turn on.

Private Relay May Cause Your Connection To Be Untrusted

Despite Apple urging network operators that they should fully trust connections originating from iCloud Private Relay, many users report that once turned on they often have to prove on websites that they are not a bot. This often means additional CAPTCHA-style prompting, being locked out entirely from making purchases, and other hard-to-understand errors.

Since iCloud’s Launch in 2021 users have reported seeing errors like Google’s Unusual Traffic Error. Source: reddit.com

As the service matures, and network operators and IP reputation services become more familiar with it, the hope is that these difficulties become more rare. Until that day, however, you can expect that users may contact the help desk more when iCloud Relay is turned on.

How to Programmatically Determine the iCloud Private Relay State

On macOS, the System Settings app stores the state of the iCloud Private Relay Service in a binary plist for each user at: ~/Library/Preferences/com.apple.networkserviceproxy.plist

The key data in this plist is Base64 encoded, but using a handy script written by Joel Bruner you can pull the status programmatically.

#!/bin/bash
: <<-LICENSE_BLOCK
iCloud Private Relay Status Checker - (https://github.com/brunerd)
...
LICENSE_BLOCK

# function iCloudPrivateRelay() { ... }

How to Block iCloud Private Relay

If you would like to Block iCloud Private Relay in your organization, there are three methods you can use.

Block iCloud Private Relay Via The Network

The fastest and most effective way to block iCloud Private Relay is on your network itself. To do this, simply block DNS resolution on the following domains:

mask.icloud.com
mask-h2.icloud.com

For more information please see Apple’s Documentation: Prepare your network for iCloud Private Relay.

Block iCloud Private Relay Via MDM

If you use an MDM product like Apple Business Essentials, you can disable the iCloud Private Relay using the following profile payload ( source)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>PayloadContent</key>
    <array>
      <dict>
        <key>PayloadDisplayName</key>
        <string>Restrictions</string>
        <key>allowCloudPrivateRelay</key>
        <false />
      </dict>
    </array>
    <key>PayloadDescription</key>
    <string>Disables the iCloud Private Relay feature.</string>
  </dict>
</plist>

Message End-Users Directly With Kolide

Kolide allows you to detect if iCloud Private Relay is enabled and send messages to end-users asking them to disable it. This allows end-users to understand exactly why iCloud Private Relay cannot be used in your organization in clear terms without them drawing their own conclusions. Further, it trains end-users on how to disable this feature with step-by-step instructions.

How Does Kolide’s Detection Work?

Like the script mentioned above, Kolide is able to read the state of iCloud Private Relay by reading the configuration for each user located at ~/Library/Preferences/com.apple.networkserviceproxy.plist. Kolide’s endpoint agent uses a component called osquery to gather facts about Macs, Windows PCs, and Linux Devices.

Additional Reading

Check out these additional resources for more information about iCloud Private Relay: