Cropping Bug Exposes Removed Photo Data in Windows 11 and Google Pixels
A serious privacy flaw in Microsoft’s Snipping Tool on Windows 11 and Google Pixel’s Markup tool allows hackers to partially recover the unedited, original version of a photo that has been cropped with the software.
According to BleepingComputer, security researchers David Buchanan and Simon Aarons discovered the photo-cropping bug — which has been named the “acropalypse.”
On March 20, Buchanan and Aarons discovered that the vulnerability in Google Pixel’s Markup tool enables the original image data to be retained even if it was edited or cropped out of a photo. This makes it possible for hackers to partially recover the original photo.
Introducing acropalypse: a serious privacy vulnerability in the Google Pixel's inbuilt screenshot editing tool, Markup, enabling partial recovery of the original, unedited image data of a cropped and/or redacted screenshot. Huge thanks to @David3141593 for his help throughout! pic.twitter.com/BXNQomnHbr
— Simon Aarons (@ItsSimonTime) March 17, 2023
Buchanan and Aarons launched a dedicated page with online acropalypse screenshot recovery utility that allows users to test whether their cropped images created on Google Pixel are recoverable.
A day later, on March 21, software engineer Chris Blume discovered that this photo cropping bug also affects Microsoft’s Snipping Tool on Windows 11.
I've got a fun one for you all to look at.
I opened a 198 byte PNG with Microsoft's Snipping Tool, chose "Save As" to overwrite a different PNG file (no editing), and saves a 4,762 byte file with all that extra after the PNG IEND chunk.
Sounds similar :D
— Chris Blume (@ProgramMax) March 21, 2023
Bleeping Computer reports that after a photo has been opened and edited or cropped in the Windows 11 Snipping Tool, the software does not truncate the unused data. Instead, the bug leaves the unused image data behind, allowing it to be partially recovered by potential hackers.
Sensitive Data
The significant privacy concern with the “acropalypse” bug is that hackers might be able to exploit the flaw to recover sensitive information from the images edited on Microsoft’s Snipping Tool and Google Pixel’s Markup. This could be anything from a credit number or a person’s face in the original photo.
“The worst instance was when I posted a cropped screenshot of an eBay order confirmation email, showing the product I’d just bought,” Buchanan writes in a blog post.
“Through the exploit, I was able to un-crop that screenshot, revealing my full postal address (which was also present in the email). That’s pretty bad!”
Microsoft tells BleepingComputer that it is aware of the reports and is looking into them.
“We are aware of these reports and are investigating. We will take action as needed to help keep customers protected,” a Microsoft spokesperson says.
Image credits: Header photo licensed via Depositphotos.
