Flaws discovered in Safari’s Intelligent Tracking Prevention let users be tracked

Google researchers discovered multiple security flaws in Apple's Safari web browser that let users' browsing habits be tracked despite Apple's Intelligent Tracking Prevention feature. Google plans to publish details on the security flaws in the near future and a preview of Google's discovery was seen by Financial Times, with the publication sharing information on the vulnerabilities this morning. The security flaws were first found by Google in the summer of 2019, and were disclosed to Apple in August. There were five types of potential attacks that could allow third parties to learn "sensitive private information about the user's browsing habits." Apple’s privacy focus branches off in a variety of ways, including reducing the way websites can track individuals. That’s due in part to its Intelligent Tracking Prevention feature baked into its web browser, Safari. However, it’s been discovered by Google researchers that a flaw in ITP made it possible for users’ browsing habits to still be tracked, even with the feature in place. Google researchers say that Safari left personal data exposed because of the Intelligent Tracking Prevention List "implicitly stores information about the websites visited by the user." Malicious entities could use these flaws to create a "persistent fingerprint" that would follow a user around the web or see what individual users were searching for on search engine pages. Intelligent Tracking Prevention, which Apple began implementing in 2017, is a privacy-focused feature meant to make it harder for sites to track users across the web, preventing browsing profiles and histories from being created. A preview of the discovery was seen by Financial Times today, and the researchers say they will be publishing their discovery in the near future. According to the report, Google researchers first discovered the flaws back in the summer of 2019 and officially disclosed to Apple in August. The flaws could allow third-parties access to “sensitive private information about the user’s browsing habits”. There were five potential threats discovered by the researchers. The researchers say these flaws are possible in part, because Safari’s Intelligent Tracking Prevention feature “implicitly stores information about the websites visited by the user”. Attackers could use this information to create a “persistent fingerprint” that basically follows the user around as they browse the internet. It’s worth noting here that these flaws have apparently been patched by Apple already. The company issued a software update in December of 2019 for Safari, so it looks like the issues have already been fixed. Safari’s Intelligent Tracking Prevention started being implemented by Apple in 2017. It’s designed to limit the ability of websites to track a user as they browse the web and use search engines. Lukasz Olejnik, a security researcher who saw Google's paper, said that if exploited, the vulnerabilities "would allow unsanctioned and uncontrollable user tracking." Olejnik said that such privacy vulnerabilities are rare, and "issues in mechanisms designed to improve privacy are unexpected and highly counter-intuitive."

Apple appears to have addressed these Safari security flaws in a December update, based on a release update that thanked Google for its "responsible disclosure practice," though full security credit has not yet been provided by Apple so there's a chance that there's still some behind-the-scenes fixing to be done.