‘aCropalypse’: Android and Windows Bugs Allow Cropped-Out Content From Screenshots to Be Recovered

Simon Aarons:

Introducing acropalypse: a serious privacy vulnerability in the Google Pixel’s inbuilt screenshot editing tool, Markup, enabling partial recovery of the original, unedited image data of a cropped and/or redacted screenshot. Huge thanks to @David3141593 for his help throughout!

David Buchanan:

The bug lies in closed-source Google-proprietary code so it’s a bit hard to inspect, but after some patch-diffing I concluded that the root cause was due to this horrible bit of API “design”: https://issuetracker.google.com/issues/180526528.

Google was passing "w" to a call to parseMode(), when they should’ve been passing "wt" (the t stands for truncation). This is an easy mistake, since similar APIs (like POSIX fopen) will truncate by default when you simply pass "w". Not only that, but previous Android releases had parseMode("w") truncate by default too! This change wasn’t even documented until some time after the aforementioned bug report was made.

The end result is that the image file is opened without the O_TRUNC flag, so that when the cropped image is written, the original image is not truncated. If the new image file is smaller, the end of the original is left behind.

I ran a few cropped screenshots from my Pixel 4 running Android 13 through their proof-of-concept tool, and some of them revealed quite a bit of cropped-out content.

And it’s not just Android: Buchanan today discovered that Windows 11 and 10 have a similar bug.

★ Tuesday, 21 March 2023