By John Gruber
Kolide ensures only secure devices can access your cloud apps.
It’s Zero Trust for Okta.
Introducing acropalypse: a serious privacy vulnerability in the Google Pixel’s inbuilt screenshot editing tool, Markup, enabling partial recovery of the original, unedited image data of a cropped and/or redacted screenshot. Huge thanks to @David3141593 for his help throughout!
The bug lies in closed-source Google-proprietary code so it’s a bit hard to inspect, but after some patch-diffing I concluded that the root cause was due to this horrible bit of API “design”: https://issuetracker.google.com/issues/180526528.
Google was passing
"w"to a call to
parseMode(), when they should’ve been passing
"wt"(the t stands for truncation). This is an easy mistake, since similar APIs (like POSIX fopen) will truncate by default when you simply pass
"w". Not only that, but previous Android releases had
parseMode("w")truncate by default too! This change wasn’t even documented until some time after the aforementioned bug report was made.
The end result is that the image file is opened without the
O_TRUNCflag, so that when the cropped image is written, the original image is not truncated. If the new image file is smaller, the end of the original is left behind.
I ran a few cropped screenshots from my Pixel 4 running Android 13 through their proof-of-concept tool, and some of them revealed quite a bit of cropped-out content.
And it’s not just Android: Buchanan today discovered that Windows 11 and 10 have a similar bug.
★ Tuesday, 21 March 2023