Introducing acropalypse: a serious privacy vulnerability in the Google Pixel's inbuilt screenshot editing tool

https://twitter.com/ItsSimonTime/status/1636857478263750656

tl;dr: For years, Google's screenshot editing tool Markup (ships on all Pixel phones) has had a bug where it overwrites images without truncating the file first. The result is that cropping an image leaves a (large) amount of the original image data in the file, which can be recovered. A simple example would be a screenshot of WhatsApp where a phone number has been cropped out.

If @Aevann was cool he'd search all the images uploaded to rDrama to find who has exposed themselves.

Orange Site discussion

126
Jump in the discussion.

No email address required.

It works on cropping too?

So you'd be able to recover what this says if it was cropped with pixel?

https://i.rdrama.net/images/1679188306095493.webp

SPOILER ALERT

https://i.rdrama.net/images/16791884293376088.webp

Dude marsey lmao

Edit: Does this apply to any photo uploaded anywhere? Doesn't every major social media site strip metadata? Are they not removing this data as well?

Also, why would he post this? Doesn’t google have bounties for this type of thing? Seems dangerous to put this out there. Some whistleblowercels gonna be offed. Not to mention nude pics.

Jump in the discussion.

No email address required.

Does this apply to any photo uploaded anywhere?

It depends on the service. rDrama re-encodes uploaded images to WebP and that process will ignore any extra data that was at the end of the original, but that's a happy accident. Some other services (e.g. Groomercord) do not re-encode or validate/strip uploaded images at all (edit: Groomercord strips EXIF tags but not excess image data). I'm not sure about Facebook etc. because I'm not a boomer.

Also, why would he post this?

They did notify Google and it has been fixed, but there'll still be a few million screenshots floating around affected by this.

Jump in the discussion.

No email address required.

We have the best coders :marseycapylove:

They did notify Google and it has been fixed, but there'll still be a few million screenshots out there affected by this.

Oh okay. Still seems a little fricked up. I can't see any scenario where this will be used for good?

Jump in the discussion.

No email address required.

It could be used to catch pedos :marseywholesome:

Jump in the discussion.

No email address required.

How so? The scenario I was thinking was some whistleblower in Iran or whatever posts something online and the original image has their name, email, social media account, etc, something that identifies them.

And then how many people have shared a pic with a bar over their peepee or took a nude shot with their full face then cropped the face out.

Seems chaotic! Which is good for drama, but maybe too far in terms of real life dangers.

Jump in the discussion.

No email address required.

How so?

Something like this. If a p-do cropped themselves out of a photo they could potentially get busted by this.

Jump in the discussion.

No email address required.

:marseylaugh: What an r-slur.

Jump in the discussion.

No email address required.

He would have gotten away with it too if it wasn't for meddling kids.

Jump in the discussion.

No email address required.

He would have gotten away with it too if it wasn't for diddling kids.

Jump in the discussion.

No email address required.

More comments

I can't see any scenario where this will be used for good?

Voyeuristicly spying on women (male) and women (old recipe)?

Jump in the discussion.

No email address required.

I don't know what this means. :marseyhmm:

Jump in the discussion.

No email address required.

Downloading womens cropped photos, uncropping then and reviving sexual arouse from the act

Jump in the discussion.

No email address required.

Oh... :marseyeyeroll:

Jump in the discussion.

No email address required.

Oh okay. Still seems a little fricked up. I can't see any scenario where this will be used for good?

Making it public means people can start thinking about what images they might like to take down.

Jump in the discussion.

No email address required.

True but I :marseyxdoubt: 90% of them will hear about this random tweet. Unless it's widely covered by mainstream media.

Jump in the discussion.

No email address required.

There's the random tweet https://twitter.com/ItsSimonTime/status/1636857478263750656

And there's the blog post https://www.da.vidbuchanan.co.uk/blog/exploiting-acropalypse.html

And yeah people are just going to skim those and shrug their shoulders

But what is going to get people's attention

is the web site where you can just submit cropped PNGs you think maybe came from a phone, and it automatically shows you the uncropped versions https://acropalypse.app

Jump in the discussion.

No email address required.

I can't find it googling it, but I could swear years ago, Facebook used to not strip the metadata and they started to after some stalker incidents. Maybe it was another company.

Jump in the discussion.

No email address required.

Does this apply to photos taken with the cameras or just screenshots :marseybeanquestion:

Everyone consistently says "screenshot" but the editing should be the same for either right? Or is the file format different?

Jump in the discussion.

No email address required.

I don't own a Pixel, but it seems to be both: you can access Markup (the broken app) via the Photos app, but it's also the default screenshot editing interface.

Jump in the discussion.

No email address required.

Screenshots are saved as PNGs, while real-world photos are jpeg or RAWs (default is jpeg). jpeg compression probably breaks this exploit and a lot of replies specifically refer to PNG. Incidentally, the automatic-cropping feature in the newer Pixels (where it picks out photos within the screen automatically) also saves as jpeg, so it should really only be true full-screen screenshots that are vulnerable. Just tested all this on my Pixel 7.

This is still pretty bad, but if that's the case then this is nowhere near as catastrophic as it sounds.

Jump in the discussion.

No email address required.

I bet JPEG could be vulnerable sometimes. You lose the quantization table and the Huffman code table from the start of the image, but apparently a decent number of JPEGs just use a default example Huffman table from the JPEG spec (this checks out from looking at several random JPEGs) and you should be able to bullshit/guess/reconstruct the quantization table.

Jump in the discussion.

No email address required.

I'm going to guess it's difficult to make a general-purpose algorithm for that. Maybe throwing AI at it could work, but I don't suspect reverse-engineering the compression is an issue for average Joe, probably needing human oversight to get a decent output. The site he provided apparently throws an error if the input isn't a PNG.

Jump in the discussion.

No email address required.

MS paint wins as usual :marseyboomer:

Jump in the discussion.

No email address required.

Hail to the king.

Jump in the discussion.

No email address required.

I'm not sure why but have never trusted phone apps to do this properly or strip metadata.

I use print screening then editing in paint.net if I am sharing something casual like a photo that needs parts edited (and would simply wait if I was not at the pc)

Jump in the discussion.

No email address required.

This is the case with the iPhone’s native picture editor too. Changes are designed to be non-destructive, ie you can always roll them back to the original picture.

You can edit the photo and then take a screenshot. That one won’t contain the original image data but I think it will still contain some other metadata unless you scrub it.

Yes, I found this out by bussyposting. No, you may not see it.

Jump in the discussion.

No email address required.

This is different I think. Here the change is supposed to be destructive by overwriting the original file, but if you crop a 1 MB image and the output is 100 KB, it will just overwrite 100 KB and leave 924 KB of original image

Jump in the discussion.

No email address required.

Yes, this is very different.

From the HN comments it seems like the cropped image file is appended to the file at (filename), but no data is deleted from the original file with that name.

Somehow this still works and can be opened normally? I guess the new image is placed at the front of the file and there’s a ‘stop’ code at the end of it. But if you read past that first stop code you get whatever the original file of that name was, and that’s usually the uncropped image.

I still didn’t read the original article. That HNerd I’m ripping off and/or I could be being r-slurred (again)

Edit: yes I’m being r-slurred

Jump in the discussion.

No email address required.

From the HN comments it seems like the cropped image file is appended to the file at (filename), but no data is deleted from the original file with that name.

No, it overwrites the old image data

So the more you crop, the more of the original gets retained, because you overwrite fewer bytes

Hence "acropalypse": you can only recover from cropped files

The problem isn't even in the photo editing app, really. Google deployed a file manipulation library, and made it so if you open a file with the "w" parameter, it nukes the original and you can then write a new version of it. So the photo editor used that as intended, no problems.

But then Google changed the library so "w" did not nuke the original data, meaning the photo editor was now just overwriting the first part of the image files it had previously been totally replacing.

The cool part is that tons of other apps might be affected in the same way

Jump in the discussion.

No email address required.

It's not appended, it will overwrite the start of the file, so some of the original image will be lost (how much depends on how big the cropped image is relative to the original).

Retarded example:

Before: oldoldoldoldold

After: NEWNEWoldoldold

The old data that got overwritten has been lost, the tool makes sense of the rest.

Jump in the discussion.

No email address required.

This is the case with the iPhone’s native picture editor too

:#marseycope:

Jump in the discussion.

No email address required.

An impossible amount of zoomlings in my life are about to on suicide watch. It's over for cheekily edited nudecels.

Jump in the discussion.

No email address required.

>imagine the cooch of some woman who can't affort an iPhone

NO thank you :marseyindignant:

Jump in the discussion.

No email address required.

>If @Aevann was fetch he'd search all the images uploaded to rDrama to find who has exposed themselves.

This site strips all metadata and converts to webp when you upload an image.

Jump in the discussion.

No email address required.

I know but that's not dramatic. Also, was this the case in the early days? Worth checking imo.

Jump in the discussion.

No email address required.

He said that if I buy some marseymerch on redbubble, he won't get my personal info. But i'm not sure if I believe him.

:#marseyveryworriedfed:

Jump in the discussion.

No email address required.

It's going well

https://i.rdrama.net/images/16791897671175601.webp

Jump in the discussion.

No email address required.

I wonder who this could be :marseythonk:

Jump in the discussion.

No email address required.

Saw this response and I thought "holy shit look at this fricking nerd (bad kind)" and I was pleased to see the Twitter users making nerd face emojis at him

Jump in the discussion.

No email address required.

>If Aevann was fetch he'd search all the images uploaded to rDrama to find who has exposed themselves.

That would be a great way to ensure no one uploads here again.

Jump in the discussion.

No email address required.

@Aevann @robocopathianflorist @QuadNarca pin this - this is a massive fricking happening

Jump in the discussion.

No email address required.

applechads just cannt stop winning

Jump in the discussion.

No email address required.

Jump in the discussion.

No email address required.

he doesn't use GrapheneOS

lmao

Jump in the discussion.

No email address required.

Well thats… fricking r-slurred

Jump in the discussion.

No email address required.

apocalypse? I'M BOUT TA SMACK YA LIPS. :punch:

Jump in the discussion.

No email address required.

I'm not stupid for thinking this is absolutely huge right?

:marseygigaretard:

And asking for a friend have they checked if Samsung's cropping tool has the same bug?

:marseyglancing:

Jump in the discussion.

No email address required.

lol that's pretty fricking bad

Jump in the discussion.

No email address required.

lmao, look at the guy that fricked up the code he looks like an absolute geek. don't know if I am allowed to link, but I saw the thread on HN and it is apparently public info who fricked up the code from the history

edit: HAHAHAHA HE WON 275 k $ FOR MAKING ANDROID STUFF BY GOOGLE HAhahahah

Jump in the discussion.

No email address required.

nothingburger https://i.rdrama.net/images/16792094299840097.webp https://i.rdrama.net/images/1679209430147711.webp

Jump in the discussion.

No email address required.

groomercord started stripping it recently but they aren't retroactively fixing old groomercord uploaded photos

Jump in the discussion.

No email address required.

Imagine thinking your phone wouldn't screw you over.

Jump in the discussion.

No email address required.

Jump in the discussion.

No email address required.

Link copied to clipboard
Action successful!
Error, please refresh the page and try again.