Apple's 'Hide My Email' Leak: A Year-Long Privacy Oversight

Just caught the 404 Media report about Apple finally patching the "Hide My Email" flaw on July 3. It’s concerning that Tyler Murphy disclosed this over a year ago, yet we’re only seeing the fix now.

For those who missed it, the issue wasn't just network traffic; the real email address was being written into the local Mail app logs in plaintext. For anyone relying on this for OPSEC or anonymity, this is a critical failure. If an attacker gains access to the filesystem—or if these logs are backed up to cloud forensics tools—the correlation between the @icloud.com relay address and the user's real identity is trivial.

Since Apple didn't assign a CVE for this privacy logic issue (typical), we need to rely on versioning. But if you handle macOS forensics or IR, you might want to check historical logs for potential exposure before the patch was deployed.

Here’s a quick Python snippet to scan Mail logs for potential real-to-relay mappings if you're auditing a device:

import re
import os

def scan_mail_logs(log_dir):
    # Heuristic: Look for standard email patterns adjacent to iCloud relay strings
    pattern = re.compile(r'([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,})')
    
    for root, dirs, files in os.walk(log_dir):
        for file in files:
            if file.endswith('.log') or file.endswith('.binary'):
                try:
                    with open(os.path.join(root, file), 'r', errors='ignore') as f:
                        content = f.read()
                        if '@icloud.com' in content:
                            matches = pattern.findall(content)
                            # Filter out known relay addresses to find the 'real' one
                            real_emails = [m for m in matches if '@icloud.com' not in m and '@me.com' not in m]
                            if real_emails:
                                print(f"[!] Potential leak found in {file}: {real_emails}")
                except Exception:
                    pass

# Usage
# scan_mail_logs('/Library/Logs/Mail/')

Has anyone else started auditing their fleet logs for this? With the delay in disclosure, I'm worried about how long this data has been sitting in our backups.