6 ms·

Acropalypse: a vulnerability in Google's screenshot editing tool

PenguinRevolver 4y ago
A demo is available here: https://acropalypse.app/ https://acropalypse.app/
- progbits 4y ago
  I tried a bunch of old screenshots and always got error. Is the demo broken or is this not always possible to recover?
  - Retr0id 4y ago
    The latter. (although the former is also plausible)
  - nabakin 4y ago
    I've found that these conditions are needed on my Pixel 5: 1. Using the cropping tool given when taking the screenshot (using the Markup tool in any other way does not work for me) 2. You have to crop at least 2 sides Also, I'm not able to recover the rest of the image once it is put through Discord.
    - abraham 4y ago
      I was not able to replicate with a 7 pro.
      - nabakin 4y ago
        Did you install the update from yesterday? It contains the fix so if you installed it, you won't be able to replicate anymore. Try finding old screenshots which meet the requirements.
tyingq 4y ago
I don't see any sort of background at all on how it's working. There's metadata in the image that helps reconstruct the original? Or something about how Discord does the attachment, or? Ah, one commenter offered this: "It looks like when the edits make the PNG smaller it saves the original number of bytes, overflowing its own buffer and leaving a bunch of unintended IDAT chunks to find :). Did you talk to Google about this before taking to twitter though?" https://twitter.com/Bottersnike237/status/1636892723012665344 https://twitter.com/Bottersnike237/status/163689272301266534...
- Retr0id 4y ago
  The quoted comment is pure speculation, by the way - there is no buffer overrun (at least, not in the traditional sense), they just forgot to truncate the original file on-disk before writing the cropped version.
  - tyingq 4y ago
    Ah, makes sense...I see your other comment leading to more detail also. Thanks!
  - wffurr 4y ago
    It wasn’t so much that they forgot but that Android 10 changed the meaning of the “w” file mode flag for open.
    - Retr0id 4y ago
      IIUC the Markup tool was introduced after that change, but I could be wrong. (Although it was before the change was documented either way...)
tgsovlerkhgsel 4y ago
Little detail on how this works. I initially thought it's based on thumbnails, but the high quality of the recovered image and the damage at the beginning makes me think it's something else.
- Retr0id 4y ago
  tl;dr they open the original image without O_TRUNC, and write the cropped version into the same file. This thread provides a good overview and some sample images https://mastodon.delroth.net/@delroth/110043776803548821 https://mastodon.delroth.net/@delroth/110043776803548821
- kzrdude 4y ago
  Explanation here https://www.da.vidbuchanan.co.uk/blog/exploiting-acropalypse.html https://www.da.vidbuchanan.co.uk/blog/exploiting-acropalypse...
hewtronic 4y ago
For a hint at how the bug works, see this https://issuetracker.google.com/issues/180526528 https://issuetracker.google.com/issues/180526528 (more details coming soon™) From https://twitter.com/David3141593/status/1636979466860744704 https://twitter.com/David3141593/status/1636979466860744704 Also: you [can] do a basic check with tools like exiftool - it will report "Warning: [minor] Trailer data after PNG IEND chunk" on vulnerable images. From: https://twitter.com/David3141593/status/1636981307891671041 https://twitter.com/David3141593/status/1636981307891671041
- wffurr 4y ago
  I still can’t believe they changed the meaning of the “w” flag. I had never heard of the “wt” file mode. Does that exist on other POSIX systems?
  - progval 4y ago
    Python already uses the "t" character with a very different meaning: opening in text mode.
  - acdha 4y ago
    That part is amazing: it calls into question the entire Android code review process that nobody thought breaking compatibility wasn’t a problem, much less doing so in a way which looks like one of the most familiar interfaces in the world. It seems unlikely that this isn’t just the first, most visible bug.
    - ryanjshaw 4y ago
      In case anybody is interested, it looks like they refactored the mode translation code to reuse another function, and the behaviour of that function was different from the original. There were no unit tests written for the original implementation, but they did update the tests for the refactored function [1], and the tests clearly show different behaviour from the original implementation [2]. My best guess would be that the code wasn't reviewed. [1] https://cs.android.com/android/_/android/platform/frameworks/base/+/63280e06fc64672ab36d14f852b13df2274cc328:core/tests/coretests/src/android/os/FileUtilsTest.java;dlc=7bd671e11fcfe956b78087c9ac27f25c1dee6e3e https://cs.android.com/android/_/android/platform/frameworks... [2] https://cs.android.com/android/_/android/platform/frameworks/base/+/63280e06fc64672ab36d14f852b13df2274cc328:core/java/android/os/ParcelFileDescriptor.java;dlc=7bd671e11fcfe956b78087c9ac27f25c1dee6e3e https://cs.android.com/android/_/android/platform/frameworks...
ZiiS 4y ago
The fact this wasnt triaged as a security bug is unforgivable https://issuetracker.google.com/issues/180526528 https://issuetracker.google.com/issues/180526528
- ajross 4y ago
  > The fact this wasnt triaged as a security bug is unforgivable Hyperbole like this is unhelpful. The reporter didn't think of it as a security bug, and the discussion in the bug itself is about API compatibility and documentation concerns. Pretending in hindsight that we're all too smart to have ever missed this isn't helping software quality for anyone, and good postmortem analysis doesn't throw around words like "unforgivable".
  - omni 4y ago
    It casts serious doubt on the Android team as a steward of the platform if this was reviewed by multiple "product and engineering teams" and not a single person thought that fundamentally changing a filesystem API might have security (or at least data integrity!) repercussions. It doesn't seem like any follow-up analysis was done at all here, other than a "thanks for the fix." Hyperbole or not, that's a terrible response.
    - ajross 4y ago
      And I repeat: that is exactly the "pretending in hindsight that we're all too smart to have missed this" trap I warned about. It's exactly the opposite of good postmortem analysis, because it inevitably leads to a "be smarter" proscription, which is unactionable. Also, in practice, you and I and everyone here are absolutely dumb enough to do this. Hubris is another terrible postmortem technique.
      - Retr0id 4y ago
        I'm quite confident that I'd have spotted the security relevance at the time, and I have a track record of finding "implementation bugs" given only APIs and specifications. But, I'm a security researcher, not a software engineer. My takeaway would be that they should have security-brained people screening "non-security" bugs, to check for potential security relevance.
e4e5 4y ago
Nice write-up here: https://www.da.vidbuchanan.co.uk/blog/exploiting-acropalypse.html https://www.da.vidbuchanan.co.uk/blog/exploiting-acropalypse...
zoklet-enjoyer 4y ago
I can crop screenshots with a Google screenshot app??? I always use Snapseed
jsjohnst 4y ago
These types of issues are exactly why whenever it’s sensitive, I screenshot, crop/edit, then screenshot the crop’d/edited screenshot. There’s other possible issues than this bug (like iOS’s non-destructive edits by default), so it’s better to be safe than sorry.
- TacticalCoder 4y ago
  > These types of issues are exactly why whenever it’s sensitive, I screenshot, crop/edit, then screenshot the crop’d/edited screenshot. Yeah I always do the same and I'm happy to see I'm not the only one. And a CVE like these shows that we're the ones "not seeing things".
- xign 4y ago
  Redacting PDFs is similarly tricky. These days I use macOS Preview (they have a new-ish feature that explicitly allows for redacting) which works but I sometimes still open it in an editor to make sure the data isn't there lol.
dividuum 4y ago
Wait. Wouldn’t that mean that cropped images have the same file size as the uncropped version? Nobody noticed that in all those years?
- Retr0id 4y ago
  Correct! Or rather, nobody investigated deep enough. Frustratingly, I noticed at one point, and incorrectly concluded that fractional image scaling must've been worsening the compression ratio. I was only using my phone in the first place because I wasn't at a PC, so a deeper investigation wasn't really an option at the time.

A demo is available here: https://acropalypse.app/ https://acropalypse.app/

progbits 4y ago
I tried a bunch of old screenshots and always got error. Is the demo broken or is this not always possible to recover?
- Retr0id 4y ago
  The latter. (although the former is also plausible)
- nabakin 4y ago
  I've found that these conditions are needed on my Pixel 5: 1. Using the cropping tool given when taking the screenshot (using the Markup tool in any other way does not work for me) 2. You have to crop at least 2 sides Also, I'm not able to recover the rest of the image once it is put through Discord.
  - abraham 4y ago
    I was not able to replicate with a 7 pro.
    - nabakin 4y ago
      Did you install the update from yesterday? It contains the fix so if you installed it, you won't be able to replicate anymore. Try finding old screenshots which meet the requirements.

I don't see any sort of background at all on how it's working. There's metadata in the image that helps reconstruct the original? Or something about how Discord does the attachment, or? Ah, one commenter offered this: "It looks like when the edits make the PNG smaller it saves the original number of bytes, overflowing its own buffer and leaving a bunch of unintended IDAT chunks to find :). Did you talk to Google about this before taking to twitter though?" https://twitter.com/Bottersnike237/status/1636892723012665344 https://twitter.com/Bottersnike237/status/163689272301266534...

Retr0id 4y ago
The quoted comment is pure speculation, by the way - there is no buffer overrun (at least, not in the traditional sense), they just forgot to truncate the original file on-disk before writing the cropped version.
- tyingq 4y ago
  Ah, makes sense...I see your other comment leading to more detail also. Thanks!
- wffurr 4y ago
  It wasn’t so much that they forgot but that Android 10 changed the meaning of the “w” file mode flag for open.
  - Retr0id 4y ago
    IIUC the Markup tool was introduced after that change, but I could be wrong. (Although it was before the change was documented either way...)

tgsovlerkhgsel 4y ago

Little detail on how this works. I initially thought it's based on thumbnails, but the high quality of the recovered image and the damage at the beginning makes me think it's something else.

Retr0id 4y ago
tl;dr they open the original image without O_TRUNC, and write the cropped version into the same file. This thread provides a good overview and some sample images https://mastodon.delroth.net/@delroth/110043776803548821 https://mastodon.delroth.net/@delroth/110043776803548821
kzrdude 4y ago
Explanation here https://www.da.vidbuchanan.co.uk/blog/exploiting-acropalypse.html https://www.da.vidbuchanan.co.uk/blog/exploiting-acropalypse...

hewtronic 4y ago

For a hint at how the bug works, see this https://issuetracker.google.com/issues/180526528 https://issuetracker.google.com/issues/180526528 (more details coming soon™) From https://twitter.com/David3141593/status/1636979466860744704 https://twitter.com/David3141593/status/1636979466860744704 Also: you [can] do a basic check with tools like exiftool - it will report "Warning: [minor] Trailer data after PNG IEND chunk" on vulnerable images. From: https://twitter.com/David3141593/status/1636981307891671041 https://twitter.com/David3141593/status/1636981307891671041

wffurr 4y ago
I still can’t believe they changed the meaning of the “w” flag. I had never heard of the “wt” file mode. Does that exist on other POSIX systems?
- progval 4y ago
  Python already uses the "t" character with a very different meaning: opening in text mode.
- acdha 4y ago
  That part is amazing: it calls into question the entire Android code review process that nobody thought breaking compatibility wasn’t a problem, much less doing so in a way which looks like one of the most familiar interfaces in the world. It seems unlikely that this isn’t just the first, most visible bug.
  - ryanjshaw 4y ago
    In case anybody is interested, it looks like they refactored the mode translation code to reuse another function, and the behaviour of that function was different from the original. There were no unit tests written for the original implementation, but they did update the tests for the refactored function [1], and the tests clearly show different behaviour from the original implementation [2]. My best guess would be that the code wasn't reviewed. [1] https://cs.android.com/android/_/android/platform/frameworks/base/+/63280e06fc64672ab36d14f852b13df2274cc328:core/tests/coretests/src/android/os/FileUtilsTest.java;dlc=7bd671e11fcfe956b78087c9ac27f25c1dee6e3e https://cs.android.com/android/_/android/platform/frameworks... [2] https://cs.android.com/android/_/android/platform/frameworks/base/+/63280e06fc64672ab36d14f852b13df2274cc328:core/java/android/os/ParcelFileDescriptor.java;dlc=7bd671e11fcfe956b78087c9ac27f25c1dee6e3e https://cs.android.com/android/_/android/platform/frameworks...

ZiiS 4y ago

The fact this wasnt triaged as a security bug is unforgivable https://issuetracker.google.com/issues/180526528 https://issuetracker.google.com/issues/180526528

ajross 4y ago
> The fact this wasnt triaged as a security bug is unforgivable Hyperbole like this is unhelpful. The reporter didn't think of it as a security bug, and the discussion in the bug itself is about API compatibility and documentation concerns. Pretending in hindsight that we're all too smart to have ever missed this isn't helping software quality for anyone, and good postmortem analysis doesn't throw around words like "unforgivable".
- omni 4y ago
  It casts serious doubt on the Android team as a steward of the platform if this was reviewed by multiple "product and engineering teams" and not a single person thought that fundamentally changing a filesystem API might have security (or at least data integrity!) repercussions. It doesn't seem like any follow-up analysis was done at all here, other than a "thanks for the fix." Hyperbole or not, that's a terrible response.
  - ajross 4y ago
    And I repeat: that is exactly the "pretending in hindsight that we're all too smart to have missed this" trap I warned about. It's exactly the opposite of good postmortem analysis, because it inevitably leads to a "be smarter" proscription, which is unactionable. Also, in practice, you and I and everyone here are absolutely dumb enough to do this. Hubris is another terrible postmortem technique.
    - Retr0id 4y ago
      I'm quite confident that I'd have spotted the security relevance at the time, and I have a track record of finding "implementation bugs" given only APIs and specifications. But, I'm a security researcher, not a software engineer. My takeaway would be that they should have security-brained people screening "non-security" bugs, to check for potential security relevance.

e4e5 4y ago

Nice write-up here: https://www.da.vidbuchanan.co.uk/blog/exploiting-acropalypse.html https://www.da.vidbuchanan.co.uk/blog/exploiting-acropalypse...

zoklet-enjoyer 4y ago

I can crop screenshots with a Google screenshot app??? I always use Snapseed

jsjohnst 4y ago

These types of issues are exactly why whenever it’s sensitive, I screenshot, crop/edit, then screenshot the crop’d/edited screenshot. There’s other possible issues than this bug (like iOS’s non-destructive edits by default), so it’s better to be safe than sorry.

TacticalCoder 4y ago
> These types of issues are exactly why whenever it’s sensitive, I screenshot, crop/edit, then screenshot the crop’d/edited screenshot. Yeah I always do the same and I'm happy to see I'm not the only one. And a CVE like these shows that we're the ones "not seeing things".
xign 4y ago
Redacting PDFs is similarly tricky. These days I use macOS Preview (they have a new-ish feature that explicitly allows for redacting) which works but I sometimes still open it in an editor to make sure the data isn't there lol.

dividuum 4y ago

Wait. Wouldn’t that mean that cropped images have the same file size as the uncropped version? Nobody noticed that in all those years?

Retr0id 4y ago
Correct! Or rather, nobody investigated deep enough. Frustratingly, I noticed at one point, and incorrectly concluded that fractional image scaling must've been worsening the compression ratio. I was only using my phone in the first place because I wasn't at a PC, so a deeper investigation wasn't really an option at the time.