Fake Hide My Email Header Can Expose Apple Account Address
A security flaw in Mac Mail can leak users' real email addresses.
1Vulnerability Discovery
Apple Mail developer Jeff Johnson discovered a security flaw in Mac Mail. This vulnerability allows a specially crafted email message to expose users' real Apple account addresses. The flaw can affect even those who don't use the Hide My Email service.
2How It Works
An email containing a fake Hide My Email header displays a misleading sender identity to the user. However, when the user replies to this email, the response is sent from their real Apple account address. This behavior occurs regardless of whether the user employs Hide My Email or not.
3Expanded Impact Scope
The vulnerability affects not just Hide My Email users but potentially all Apple Mail users. Malicious emails can arrive through personal or business accounts, leaking the Apple account address during replies. This shows the security risk could impact a broader audience than initially expected.
4Relation to Previous Flaw
Johnson doesn't know if this vulnerability is technically related to an earlier flaw that exposed Hide My Email addresses. The newly discovered issue uses a different technique, and there's no evidence proving both problems share the same root cause.
5User Risk Assessment
This security flaw could lead to users' sensitive information falling into the wrong hands. The risk is particularly high for business emails or accounts containing personal information. Users should exercise caution when replying to emails from unknown sources.
6Awaiting Resolution
It's currently unknown whether Apple will release a patch for this vulnerability. Users should monitor security updates and remain cautious with suspicious emails. Such vulnerabilities highlight how fragile digital security can be.