11 ms·

Windows Snipping Tool is vulnerable to Acropalypse too

315 points by tambourine_man 4y ago

world2vec 4y ago
This is beyond scary. I have no idea how my screenshots I took and cropped with Snipping Tool and send to someone: at work, at home, across multiple machines and accounts.
- easrng 4y ago
  Keep in mind this only applies if you took the screenshot, saved, cropped it, and then saved again to the same file.
  - world2vec 4y ago
    I am aware after reading the whole thread but still, I think I've done it countless times over the years.
  - dendrite9 4y ago
    Isn't that the default on Android phones if you screenshot then crop. As opposed to screenshot, then open it and crop. I tend to use the rectangular option in the snipping tool as a way to be certain that I won't forget to crop important info. Both of these make me think I need to check my process and see if it is relevant.
  - ChuckNorris89 4y ago
    >Keep in mind this only applies if you took the screenshot, saved, cropped it, and then saved again to the same file Wait, don't we all do this? :looks around horrified:
  - sp332 4y ago
    Well yeah, why would I keep an uncropped version around? It seemed safer to save over the one I didn't want. Edit: I guess I don't usially save before cropping a screenshot. But it's not something I really thought about before either.
    - andreareina 4y ago
      sometimes I want to keep the original for my own records
  - nickthegreek 4y ago
    My normal workflow is use snipping tool, it opens in editor, crop, save. This is for sure safe?
    - SketchySeaBeast 4y ago
      It seems like the problem is that if you use the snipping tool to save to a file that already exists it only modifies as much of the file as is required so that the new image you saved is visible - the rest of the file's data is preserved. The problem is saving to a file with more information than the cropped information requires - the original images information "overflow" isn't removed. So if you're saving to a new file it's fine, there's no extra information.
  - mizaru 4y ago
    It applies if you choose to "overwrite" any file that is larger than the generated PNG data.
- basch 4y ago
  My stubbornness to relearn and move away from “printscreen+winkey+r+mspaint+enter+select+Ctenophora+c” pays off. I don’t know what it is about snipping tools (and I use sharex too” but I always find myself going back to paint, as the tools feel like they get in the way.
  - hermitdev 4y ago
    Try alt+printscreen. It'll only capture the active window instead of your full desktop.
    - deleted 4y ago
      [deleted]
    - basch 4y ago
      I do if I want the window. Crops are something else.
    - smackeyacky 4y ago
      Our security people disabled the PrtScn key, so our only way of doing a screen shot is the snipping tool. It is very frustrating.
  - froggit 4y ago
    I've always used "prtscn+paint" as well. I've tried various on other ways and I'll usually be like "that's kinda cool, maybe I'll try that." Next time I need a screenshot it'll already be pasted in paint far before it occurs to me "i think i forgot something, guess it wasn't important."
- gsich 4y ago
  Snip & Sketch, not the oldstyle Snipping Tool.
Retr0id 4y ago
If you don't want to just take my word for it, there's some 3rd party confirmation and further analysis in this thread https://twitter.com/wdormann/status/1638235267919233024 https://twitter.com/wdormann/status/1638235267919233024 I'll have a windows-compatible PoC up at some point, might wait a little bit just to mitigate the 0day-ness heh
- nashashmi 4y ago
  Not able to reproduce this. I’m not sure if anything remains after the iend. But the file size does become smaller. I have windows 10. Edit: tried this with snip and sketch. Also tried it with snipping tool. Fwiw, the latter results in a smaller file size.
  - Retr0id 4y ago
    win10 snipping tool is not vulnerable, but "snip and sketch" is. > Fwiw, the latter results in a smaller file size. Implying the former does not result in smaller file size? If so, you've reproduced the vuln.
    - jay_kyburz 4y ago
      Snip and Sketch sucks compared to the snipping too. It makes me very sad that they are going to take it away. The animations are terrible and I hate that I have to click on a notification to actually open the window.
    - RajT88 4y ago
      This is why I have on Win11 kept my whole System32 folder, so I can use older versions of some tools before they were bloated crap. Win10 snipping tool: From my cold, dead hands.
    - leokennis 4y ago
      Weird. If I take a screenshot with Snip & Sketch on Win10 and save it (full.png) - then in S&S crop a small portion of it and save it (crop.png) there is a significant file size difference between full.png and crop.png.
gjsman-1000 4y ago
Like he says on Twitter - was this deliberate? Doesn't seem like it yet, and there's no proof of it, but it's pretty scary. There's excellent plausible deniability, and the law enforcement benefits could be substantial.
- Syonyk 4y ago
  I was just about to ask, "Is this still coincidence, or have we jumped straight to enemy action?" That two different tools fail in the same, "surface level invisible" but mighty convenient, and "Whoopsie, file operations are hard!" way... raises some interesting questions. Mostly, "What else of this nature is present in all our modern operating systems?" Because this sort of failure sure looks an awful lot like the "Underhanded C" contest from 2008: http://www.underhanded-c.org/_page_id_17.html http://www.underhanded-c.org/_page_id_17.html Redact an image, while leaking a lot of information in the process to someone who "knows the trick." > This is an excellent example of the contest’s philosophy: make the code extremely simple, innocent, obvious, and wrong.
- saagarjha 4y ago
  Probably not.
eviks 4y ago
yet another example of stellar s engineering from yet another s engineering giant
recursive 4y ago
What's this about? I just tried the repro (Snip, save, crop, save). Nothing obvious was amiss. The file looks ok. What's the vulnerability here?
- Retr0id 4y ago
  Further context: https://www.da.vidbuchanan.co.uk/blog/exploiting-acropalypse.html https://www.da.vidbuchanan.co.uk/blog/exploiting-acropalypse... You should notice that the file size didn't actually get any smaller after you cropped it. The full-size image file is not truncated before the cropped version is written. The left-behind data can be recovered.
  - omoikane 4y ago
    The root cause seem to be an open mode which opens the original file for writing without truncation, but writing to the original file directly in the first place seemed precarious. The software I use tend to write to a temporary file first and then do a rename to replace the original file. The bit about recovering LZ77 stream without the prefix sounds very useful as a data recovery tool.
  - deleted 4y ago
    [deleted]
phendrenad2 4y ago
Not sure if this person is being deliberately vague/obtuse, but it's unclear if this affects you if you save each screenshot as a new file, or only if you do the strange "overwrite existing file" thing the OP did.
- kccqzy 4y ago
  Overwriting existing file is strange now? This is just victim-blaming for the incompetence of software engineers. As a user there's nothing wrong with overwriting an existing file.
  - phendrenad2 4y ago
    Calling something unusual behavior, which is unusual, is "victim blaming"? Stop tilting at windmills.
- olliej 4y ago
  They're not being vague - they're saying a specific issue named "acropalypse" applies. Originally acropalypse was a specific library, but the bug itself is "saving data over an existing file does not replace the existing file". > only if you do the strange "overwrite existing file" thing the OP did Overwriting an existing file is literally the most common case: it's what happens when you say "save" instead of "save as...".
alex7734 4y ago
You need to take a screenshot, save it, crop it and then resave over the same file. I mean it's bad, but... who does that? EDIT: It also happens if you take a completely different screenshot and just save over (overwrite) another (bigger) image. That's worse, but still not that common IMHO.
- Retr0id 4y ago
  It's a relatively uncommon scenario, granted, but when you multiply those odds by the number of screenshots that get shared on a daily basis, it's pretty bad imho.
- 323 4y ago
  > who does that? Programmers do it all day ... with text files. Would you say the same thing if when you deleted some code it would actually still be there at the end of the file, after two pages of spaces? When you delete something and save it in a "final" format (like a PNG), you expect nothing which was deleted to be there.
  - hn92726819 4y ago
    I don't think the comment was about expected behavior. It's about who would be suspetible to this. Saving text files is fine all the time, you're right. They're saying, how often do people perform the steps in that order?
    - deleted 4y ago
      [deleted]
- pavon 4y ago
  It is extremely common for me to realize I don't like the screenshot I took, and to save the replacement over the original file. It is pretty common for me to be more selective about what is in the replacement, and hence for it to be smaller than the original triggering this bug.
- olliej 4y ago
legrande 4y ago
Got sent a few .PSDs (Photoshop format) and there was some artifacts which looked like they weren't intended for the recipient. Of course, this is part of the .PSD format and not a privacy issue per se. Just be careful sending .PSDs in an e-mail with stuff in them you don't want the recipient to see.
- ffhhj 4y ago
  Wait until they find that censored parts of an image can be restored by AI.
  - ribosometronome 4y ago
    Restored or imagined?
    - Dalewyn 4y ago
      Aye.
- SAI_Peregrinus 4y ago
  Photoshop has a checkbox to "delete cropped pixels", if unchecked using the crop tool again will show the entire original image. It also stores an undo history, so even with "delete cropped pixels" you can just undo the crop.
TrianguloY 4y ago
My workflow is to press the PrintScreen -> snip&sketch opens -> draw a rectangle (two corners) -> paste where necessary. Or alternatively press the notification -> draw something -> control+c -> close then paste. I rarely save as file, no need, but I guess I've sometimes do it so I need to be careful.
izzydata 4y ago
The wordage "acropalypse" and this image chosen makes it seem like doing this is going to somehow break your computer. It is a bad vulnerability, but not that bad.
- 323 4y ago
  This is worse than breaking your computer. Plenty of people send images around after cropping out sensitive parts.
- Retr0id 4y ago
  The image chosen is not generic glitch-art, it is the unedited output of my image recovery exploit script. That's just what it looks like.
- deleted 4y ago
  [deleted]
fwlr 4y ago
So, Acropalypse is “people use image snipping and markup tools to redact images, but those tools often allow the unredacted images to be recovered”? Yeah, that’s a pretty big violation of the implicit expectations of users.
- Retr0id 4y ago
  To be more specific "acropalypse" refers to any image editor which does not truncate the original file before overwriting it with the edited version, leading to portions of the original being recoverable by an adversary. It originally referred to a specific vulnerability in the Markup app found on Google Pixel devices (CVE-2023-21036), but apparently now includes other unrelated apps. Source: It was me who came up with the name :)
  - fwlr 4y ago
    Oh, that’s actually way worse than I thought! It’s not that these apps have some kind of undo feature or are aiming for non-destructive editing, and that’s not what users expect - the apps actually are attempting to perform redaction and they’re poorly implemented. Kudos on the name by the way, I love a good tight pun name for a vulnerability.
    - olliej 4y ago
      I can't speak for this windows tool, but for the android image editor the editor _was_ doing the correct thing. Then the underlying IO library changed in breaking way (and diverged from other APIs using the same mode strings) to not truncate when opening existing files.
      - HALtheWise 4y ago
        The API was (accidentally?) changed long before the Android tool was written, if I understand correctly. Depending on your point of view, that means it's either a poorly designed and documented API, an incorrect API that doesn't match the documentation, or a testing failure during development of the app.
Hansenq 4y ago
Is Mac's Preview app susceptible to this bug too? Right now it seems only confirmed for Pixel phones and Windows Snipping Tool, but I use Preview and I haven't seen anyone confirm or deny it for that one.
- Retr0id 4y ago
  I've heard multiple people say Preview (and the macos screenshot tools) are safe.
pdntspa 4y ago
Unbelievable, I can't understand how people haven't noticed that. "Wow I crop an image and it doesnt get smaller WTF???" Man if I ran Windows 11 to think I might be the one who stumbled on this 0-day first....
- escapecharacter 4y ago
  Compression ratios vary between different tools, I wouldn’t expect an image file size to scale at all smoothly with its resolution
  - pdntspa 4y ago
    Yes, but that is not going to explain how a large crop eliminating 90% of the image area is not going to shrink the filesize more than a little bit
    - Dylan16807 4y ago
      That only matters if you check the size before and after.
- malka 4y ago
  Most of the time theses images don't end up in the file system. They are going to the clipboard and then copied to a chat or imgur
  - e4e5 4y ago
    But in this case it's luckily not vulnerable
    - TonyTrapp 4y ago
      Apparently Discord and probably other platforms don't remove the excess data at the end of the file. Maybe they will start doing that now. But for all the existing cropped screenshots out there, it definitely means that there is a vulnerability.
windows2020 4y ago
This does not apply to the original Snipping Tool (the one that's 'moving...'). New iterations of classic Snipping Tool require more clicks and the implementation is worse too.
- marak830 4y ago
  That summerises almost every update on windows 11 doesn't it? Their image tool that we were using for video snippet is a lot worse. Hell right click context menu requires more work. Don't get me started on minimum window sizes for some default apps.
jeffbee 4y ago
Saving a cropped image as an original with an edit list strikes me as a completely obvious and normal thing to do. It's an affordance that allows the user to go back and un-crop things. If you undertook a field survey you would find users who were glad for this feature and I imagine zero users who had been harmed by it. I don't understand all the brouhaha.
- pavon 4y ago
  That isn't what is happening in either the original bug for the Google Pixel Markup tool or this bug in the Windows Snipping Tool. What is happening is that the software is overwriting the original image with the new one, but not truncating the file, so if the new compressed image data is smaller than the old, the remainder of the old image still exists at the end of the file. This data is not made available to the user to uncrop the data at a later time, so it provides no benefit to the user, just risk of privacy violations.
- creatonez 4y ago
  This is not an undo feature. And if it were, it wouldn't be what an end user expects out of a .png file, but rather a .psd or .xcf file.
- devnullbrain 4y ago
  >and I imagine zero users who had been harmed by it. Because it's a zero day! You can't imagine someone cropping out banking information, identifying information in anonymous contexts, confidential information?
- olliej 4y ago
  > I don't understand all the brouhaha. Which you should take as a "maybe I have misunderstood the issue". This is not an edit list, or the ability to undo operations. The problem is you have an existing file ("foo.png" or whatever): oooooooooo then you make a new file with this data in memory: nnnnn This could be something like you opened the original foo.png file and made a change that results in the file shrinking, or it could be some completely unrelated data. Now you save this as foo.png and the editing program assumes opening a file for writing will erase the old data and writes out the new data. The end result is you have this file: nnnnnooooo e.g. the tail of the old file is still present in the file data. It turns out it's possible to recover the pixel data from those tail bytes, in spite of losing the compression state. Now the assumption that writing over an existing file will truncate/erase the original file is reasonable. That's the default behavior of most file IO APIs. I don't know what the windows app is doing, but the original android bug was an API that takes a mode string copied from posix's fopen, in which "w" means "open for writing, and erase any existing file", but then later on made an undocumented change that made opening a file with "w" no longer erase existing files.
whoopdedo 4y ago
This reminds me of the early binary DOC file format that was essentially a dump of Word's working memory. You could find all sorts of leaked data in the slack space between text chunks. Sometimes from other processes since `malloc` doesn't zero memory. I think there were a few instances of people being caught doing bad things because of identifying information in a Word DOC. But why is this even happening? The standard procedure to overwrite a file is to save to a temporary file first so an error that occurs during the write won't damage the existing file. Are they really doing an in-place write and how does that affect the shadow copy if you wanted to restore the previous version of the file?
- thrashh 4y ago
  It sounds like someone wrote fopen(name, “r+”) instead of fopen(name, “w”) I don’t think writing to a separate file is standard procedure at all. Way more apps don’t do that than do from my anecdotal memories.
  - alkonaut 4y ago
    I guess it depends on how long users are expected to work on the documents/flies, and whether there is some other safety mechanism. Basically: a power outage, full disk etc. corrupting the file at save costs X hours of lost work and for some X you better make sure the app can revert to a known state via a transactional save and/or an autosave feature. Personally I'd probably always save to a new file even if the amount of work potentially lost is negligible (as in a snipping tool). The cost of doing so is extremely small in development so that if you ever save one customer's file, you probably saved more time than it cost you to implement transactional file writing. It's a few extra lines, if you opt out of the more complex scenarios (E.g. you can't make atomic renames to move if the target is a network share).
- Retr0id 4y ago
  It feels like a lot of "things everyone knows" are slowly getting lost over time, as developers work at higher and higher levels of abstraction without deep knowledge of the layers beneath them (which is of course the whole point of abstractions, but they're never perfect) Being a true "full stack" engineer is a superpower when it comes to performance optimisation, or vulnerability research.
dang 4y ago
Recent and related: Exploiting aCropalypse: Recovering truncated PNGs - https://news.ycombinator.com/item?id=35208721 https://news.ycombinator.com/item?id=35208721 - March 2023 (71 comments) Acropalypse: a vulnerability in Google's screenshot editing tool - https://news.ycombinator.com/item?id=35207787 https://news.ycombinator.com/item?id=35207787 - March 2023 (44 comments)
lazerl0rd 4y ago
Snipping Tool used to have this "feature" whereby any drawing performed on a screenshot would be animated as an overlay (this was only visible in the UWP Photos app at the time). Funnily enough, that's the first thing that came to mind when I heard of Acropalypse.
HALtheWise 4y ago
This would have been avoided if the PNG format (or at least one commonly used editor) required that the data filled the whole file, or rendered extra junk when there was extra data at the end.
- ProgramMax 4y ago
  The PNG spec actually has wording to disallow data past the end. https://w3c.github.io/PNG-spec/#15FileConformance https://w3c.github.io/PNG-spec/#15FileConformance "3. No chunks or other content follow the IEND chunk." (I'm the PNG spec chair and also the person who discovered Snipping Tool is vulnerable.)
  - Retr0id 4y ago
    However, it also says: > The PNG decoder has to determine whether a syntax error is fatal (unrecoverable) or not, depending on its requirements and the situation. For example, most decoders can ignore an invalid IEND It doesn't explicitly mention what decoders should do on encountering data after IEND, but The general philosophy for decoders seems to be that errors should be handled gracefully where possible, even if the file is technically malformed (which is maybe something that could be clarified or expanded upon?)
    - ProgramMax 4y ago
      True, true. I respect it. :) For others, Retr0id has been helping with the PNG spec. A third edition is in the works.
    - 13of40 4y ago
      Back in the olden days, when people were using protocols like Kermit and XModem to download their questionable images from BBS's, You would often get a file whose size was rounded up to the nearest block size. In that situation, failing for extra data at the end would have been a fatal move for someone implementing an image decoder, and I think PNG might be just barely old enough that the designers remembered that.
alpb 4y ago
Note that this is not the "Snipping tool" but the "Snip & Sketch" (win+shift+s?) Though, I'm not able to reproduce it myself.
- ProgramMax 4y ago
  Apparently the Windows 10 version of Snipping Tool is not vulnerable. That's the one that tells you to get Snip & Sketch. On Windows 11, Snipping Tool is vulnerable. (And it doesn't suggest you get Snip & Sketch.)
  - layer8 4y ago
    The Windows 11 Snipping Tool is the evolution of the Windows 10 Snip & Sketch, confusingly.
- layer8 4y ago
  The two were merged in Windows 11, reverting the newer tool to the “Snipping Tool” name of the older tool. I can reproduce it with Snip & Sketch on Windows 10 using Save As (Ctrl+S).
kuroguro 4y ago
For android it was a backwards incompatible, undocumented API change [0]. For windows it just looks like the UWP API is complicated enough that you can footgun yourself. For ex OpenAsync+DataWriter would do it as the default behavior [1]. [0] https://issuetracker.google.com/issues/180526528 https://issuetracker.google.com/issues/180526528 [1] https://stackoverflow.com/questions/35842374/how-can-i-overwrite-a-file-in-uwp https://stackoverflow.com/questions/35842374/how-can-i-overw...
- xign 4y ago
  I would believe it… UWP APIs can be really complicated and over-designed sometimes.
pabs3 4y ago
Anyone looked at any Linux cropping tools?
- chenxiaolong 4y ago
  I just took a look at spectacle (KDE's screenshot tool, version 22.12.3) and it's not affected. It properly truncates the file when overwriting a file that already exists (after cropping or any other edit I tested). The inode number stays the same, so it's not doing the create-temp-file + rename method.
- kzrdude 4y ago
  Android was playing games with the file open mode (open(file, "w") didn't overwrite and truncate), and that kind of change would be unforgivable on linux. Also on linux you'd quickly notice something was wrong with the file sizes.
kdrag0n 4y ago
Aside from looking at the file size, you can check any PNG image with pngcheck [1]: pngcheck good.png OK: good.png (467x389, 32-bit RGB+alpha, non-interlaced, 88.2%). Compared to a vulnerable image: pngcheck bad.png bad.png additional data after IEND chunk ERROR: bad.png macOS Preview, Quick Look, and CleanShot X are safe. [1] https://www.libpng.org/pub/png/apps/pngcheck.html https://www.libpng.org/pub/png/apps/pngcheck.html, available in Homebrew
ornornor 4y ago
https://nitter.net/David3141593/status/1638222624084951040 https://nitter.net/David3141593/status/1638222624084951040
deleted 4y ago
[deleted]
rldjbpin 4y ago
another plus for sticking with windows 10. although not as intuitive, the old snipping tool, the screenshot only captures that area you selected. i will let someone test the same technique on those cases but empirically i've had screenshots as little as a couple KB this way.

This is beyond scary. I have no idea how my screenshots I took and cropped with Snipping Tool and send to someone: at work, at home, across multiple machines and accounts.

easrng 4y ago
Keep in mind this only applies if you took the screenshot, saved, cropped it, and then saved again to the same file.
- world2vec 4y ago
  I am aware after reading the whole thread but still, I think I've done it countless times over the years.
- dendrite9 4y ago
  Isn't that the default on Android phones if you screenshot then crop. As opposed to screenshot, then open it and crop. I tend to use the rectangular option in the snipping tool as a way to be certain that I won't forget to crop important info. Both of these make me think I need to check my process and see if it is relevant.
- ChuckNorris89 4y ago
  >Keep in mind this only applies if you took the screenshot, saved, cropped it, and then saved again to the same file Wait, don't we all do this? :looks around horrified:
- sp332 4y ago
  Well yeah, why would I keep an uncropped version around? It seemed safer to save over the one I didn't want. Edit: I guess I don't usially save before cropping a screenshot. But it's not something I really thought about before either.
  - andreareina 4y ago
    sometimes I want to keep the original for my own records
- nickthegreek 4y ago
  My normal workflow is use snipping tool, it opens in editor, crop, save. This is for sure safe?
  - SketchySeaBeast 4y ago
    It seems like the problem is that if you use the snipping tool to save to a file that already exists it only modifies as much of the file as is required so that the new image you saved is visible - the rest of the file's data is preserved. The problem is saving to a file with more information than the cropped information requires - the original images information "overflow" isn't removed. So if you're saving to a new file it's fine, there's no extra information.
- mizaru 4y ago
  It applies if you choose to "overwrite" any file that is larger than the generated PNG data.
basch 4y ago
My stubbornness to relearn and move away from “printscreen+winkey+r+mspaint+enter+select+Ctenophora+c” pays off. I don’t know what it is about snipping tools (and I use sharex too” but I always find myself going back to paint, as the tools feel like they get in the way.
- hermitdev 4y ago
  Try alt+printscreen. It'll only capture the active window instead of your full desktop.
  - deleted 4y ago
    [deleted]
  - basch 4y ago
    I do if I want the window. Crops are something else.
  - smackeyacky 4y ago
    Our security people disabled the PrtScn key, so our only way of doing a screen shot is the snipping tool. It is very frustrating.
- froggit 4y ago
  I've always used "prtscn+paint" as well. I've tried various on other ways and I'll usually be like "that's kinda cool, maybe I'll try that." Next time I need a screenshot it'll already be pasted in paint far before it occurs to me "i think i forgot something, guess it wasn't important."
gsich 4y ago
Snip & Sketch, not the oldstyle Snipping Tool.

Retr0id 4y ago

If you don't want to just take my word for it, there's some 3rd party confirmation and further analysis in this thread https://twitter.com/wdormann/status/1638235267919233024 https://twitter.com/wdormann/status/1638235267919233024 I'll have a windows-compatible PoC up at some point, might wait a little bit just to mitigate the 0day-ness heh

nashashmi 4y ago
Not able to reproduce this. I’m not sure if anything remains after the iend. But the file size does become smaller. I have windows 10. Edit: tried this with snip and sketch. Also tried it with snipping tool. Fwiw, the latter results in a smaller file size.
- Retr0id 4y ago
  win10 snipping tool is not vulnerable, but "snip and sketch" is. > Fwiw, the latter results in a smaller file size. Implying the former does not result in smaller file size? If so, you've reproduced the vuln.
  - jay_kyburz 4y ago
    Snip and Sketch sucks compared to the snipping too. It makes me very sad that they are going to take it away. The animations are terrible and I hate that I have to click on a notification to actually open the window.
  - RajT88 4y ago
    This is why I have on Win11 kept my whole System32 folder, so I can use older versions of some tools before they were bloated crap. Win10 snipping tool: From my cold, dead hands.
  - leokennis 4y ago
    Weird. If I take a screenshot with Snip & Sketch on Win10 and save it (full.png) - then in S&S crop a small portion of it and save it (crop.png) there is a significant file size difference between full.png and crop.png.

gjsman-1000 4y ago

Like he says on Twitter - was this deliberate? Doesn't seem like it yet, and there's no proof of it, but it's pretty scary. There's excellent plausible deniability, and the law enforcement benefits could be substantial.

Syonyk 4y ago
I was just about to ask, "Is this still coincidence, or have we jumped straight to enemy action?" That two different tools fail in the same, "surface level invisible" but mighty convenient, and "Whoopsie, file operations are hard!" way... raises some interesting questions. Mostly, "What else of this nature is present in all our modern operating systems?" Because this sort of failure sure looks an awful lot like the "Underhanded C" contest from 2008: http://www.underhanded-c.org/_page_id_17.html http://www.underhanded-c.org/_page_id_17.html Redact an image, while leaking a lot of information in the process to someone who "knows the trick." > This is an excellent example of the contest’s philosophy: make the code extremely simple, innocent, obvious, and wrong.
saagarjha 4y ago
Probably not.

eviks 4y ago

yet another example of stellar s engineering from yet another s engineering giant

recursive 4y ago

What's this about? I just tried the repro (Snip, save, crop, save). Nothing obvious was amiss. The file looks ok. What's the vulnerability here?

Retr0id 4y ago
Further context: https://www.da.vidbuchanan.co.uk/blog/exploiting-acropalypse.html https://www.da.vidbuchanan.co.uk/blog/exploiting-acropalypse... You should notice that the file size didn't actually get any smaller after you cropped it. The full-size image file is not truncated before the cropped version is written. The left-behind data can be recovered.
- omoikane 4y ago
  The root cause seem to be an open mode which opens the original file for writing without truncation, but writing to the original file directly in the first place seemed precarious. The software I use tend to write to a temporary file first and then do a rename to replace the original file. The bit about recovering LZ77 stream without the prefix sounds very useful as a data recovery tool.
- deleted 4y ago
  [deleted]

phendrenad2 4y ago

Not sure if this person is being deliberately vague/obtuse, but it's unclear if this affects you if you save each screenshot as a new file, or only if you do the strange "overwrite existing file" thing the OP did.

kccqzy 4y ago
Overwriting existing file is strange now? This is just victim-blaming for the incompetence of software engineers. As a user there's nothing wrong with overwriting an existing file.
- phendrenad2 4y ago
  Calling something unusual behavior, which is unusual, is "victim blaming"? Stop tilting at windmills.
olliej 4y ago
They're not being vague - they're saying a specific issue named "acropalypse" applies. Originally acropalypse was a specific library, but the bug itself is "saving data over an existing file does not replace the existing file". > only if you do the strange "overwrite existing file" thing the OP did Overwriting an existing file is literally the most common case: it's what happens when you say "save" instead of "save as...".

alex7734 4y ago

You need to take a screenshot, save it, crop it and then resave over the same file. I mean it's bad, but... who does that? EDIT: It also happens if you take a completely different screenshot and just save over (overwrite) another (bigger) image. That's worse, but still not that common IMHO.

Retr0id 4y ago
It's a relatively uncommon scenario, granted, but when you multiply those odds by the number of screenshots that get shared on a daily basis, it's pretty bad imho.
323 4y ago
> who does that? Programmers do it all day ... with text files. Would you say the same thing if when you deleted some code it would actually still be there at the end of the file, after two pages of spaces? When you delete something and save it in a "final" format (like a PNG), you expect nothing which was deleted to be there.
- hn92726819 4y ago
  I don't think the comment was about expected behavior. It's about who would be suspetible to this. Saving text files is fine all the time, you're right. They're saying, how often do people perform the steps in that order?
  - deleted 4y ago
    [deleted]
pavon 4y ago
It is extremely common for me to realize I don't like the screenshot I took, and to save the replacement over the original file. It is pretty common for me to be more selective about what is in the replacement, and hence for it to be smaller than the original triggering this bug.
olliej 4y ago

legrande 4y ago

Got sent a few .PSDs (Photoshop format) and there was some artifacts which looked like they weren't intended for the recipient. Of course, this is part of the .PSD format and not a privacy issue per se. Just be careful sending .PSDs in an e-mail with stuff in them you don't want the recipient to see.

ffhhj 4y ago
Wait until they find that censored parts of an image can be restored by AI.
- ribosometronome 4y ago
  Restored or imagined?
  - Dalewyn 4y ago
    Aye.
SAI_Peregrinus 4y ago
Photoshop has a checkbox to "delete cropped pixels", if unchecked using the crop tool again will show the entire original image. It also stores an undo history, so even with "delete cropped pixels" you can just undo the crop.

TrianguloY 4y ago

My workflow is to press the PrintScreen -> snip&sketch opens -> draw a rectangle (two corners) -> paste where necessary. Or alternatively press the notification -> draw something -> control+c -> close then paste. I rarely save as file, no need, but I guess I've sometimes do it so I need to be careful.

izzydata 4y ago

The wordage "acropalypse" and this image chosen makes it seem like doing this is going to somehow break your computer. It is a bad vulnerability, but not that bad.

323 4y ago
This is worse than breaking your computer. Plenty of people send images around after cropping out sensitive parts.
Retr0id 4y ago
The image chosen is not generic glitch-art, it is the unedited output of my image recovery exploit script. That's just what it looks like.
deleted 4y ago
[deleted]

fwlr 4y ago

So, Acropalypse is “people use image snipping and markup tools to redact images, but those tools often allow the unredacted images to be recovered”? Yeah, that’s a pretty big violation of the implicit expectations of users.

Retr0id 4y ago
To be more specific "acropalypse" refers to any image editor which does not truncate the original file before overwriting it with the edited version, leading to portions of the original being recoverable by an adversary. It originally referred to a specific vulnerability in the Markup app found on Google Pixel devices (CVE-2023-21036), but apparently now includes other unrelated apps. Source: It was me who came up with the name :)
- fwlr 4y ago
  Oh, that’s actually way worse than I thought! It’s not that these apps have some kind of undo feature or are aiming for non-destructive editing, and that’s not what users expect - the apps actually are attempting to perform redaction and they’re poorly implemented. Kudos on the name by the way, I love a good tight pun name for a vulnerability.
  - olliej 4y ago
    I can't speak for this windows tool, but for the android image editor the editor _was_ doing the correct thing. Then the underlying IO library changed in breaking way (and diverged from other APIs using the same mode strings) to not truncate when opening existing files.
    - HALtheWise 4y ago
      The API was (accidentally?) changed long before the Android tool was written, if I understand correctly. Depending on your point of view, that means it's either a poorly designed and documented API, an incorrect API that doesn't match the documentation, or a testing failure during development of the app.

Hansenq 4y ago

Is Mac's Preview app susceptible to this bug too? Right now it seems only confirmed for Pixel phones and Windows Snipping Tool, but I use Preview and I haven't seen anyone confirm or deny it for that one.

Retr0id 4y ago
I've heard multiple people say Preview (and the macos screenshot tools) are safe.

pdntspa 4y ago

Unbelievable, I can't understand how people haven't noticed that. "Wow I crop an image and it doesnt get smaller WTF???" Man if I ran Windows 11 to think I might be the one who stumbled on this 0-day first....

escapecharacter 4y ago
Compression ratios vary between different tools, I wouldn’t expect an image file size to scale at all smoothly with its resolution
- pdntspa 4y ago
  Yes, but that is not going to explain how a large crop eliminating 90% of the image area is not going to shrink the filesize more than a little bit
  - Dylan16807 4y ago
    That only matters if you check the size before and after.
malka 4y ago
Most of the time theses images don't end up in the file system. They are going to the clipboard and then copied to a chat or imgur
- e4e5 4y ago
  But in this case it's luckily not vulnerable
  - TonyTrapp 4y ago
    Apparently Discord and probably other platforms don't remove the excess data at the end of the file. Maybe they will start doing that now. But for all the existing cropped screenshots out there, it definitely means that there is a vulnerability.

windows2020 4y ago

This does not apply to the original Snipping Tool (the one that's 'moving...'). New iterations of classic Snipping Tool require more clicks and the implementation is worse too.

marak830 4y ago
That summerises almost every update on windows 11 doesn't it? Their image tool that we were using for video snippet is a lot worse. Hell right click context menu requires more work. Don't get me started on minimum window sizes for some default apps.

jeffbee 4y ago

Saving a cropped image as an original with an edit list strikes me as a completely obvious and normal thing to do. It's an affordance that allows the user to go back and un-crop things. If you undertook a field survey you would find users who were glad for this feature and I imagine zero users who had been harmed by it. I don't understand all the brouhaha.

pavon 4y ago
That isn't what is happening in either the original bug for the Google Pixel Markup tool or this bug in the Windows Snipping Tool. What is happening is that the software is overwriting the original image with the new one, but not truncating the file, so if the new compressed image data is smaller than the old, the remainder of the old image still exists at the end of the file. This data is not made available to the user to uncrop the data at a later time, so it provides no benefit to the user, just risk of privacy violations.
creatonez 4y ago
This is not an undo feature. And if it were, it wouldn't be what an end user expects out of a .png file, but rather a .psd or .xcf file.
devnullbrain 4y ago
>and I imagine zero users who had been harmed by it. Because it's a zero day! You can't imagine someone cropping out banking information, identifying information in anonymous contexts, confidential information?
olliej 4y ago
> I don't understand all the brouhaha. Which you should take as a "maybe I have misunderstood the issue". This is not an edit list, or the ability to undo operations. The problem is you have an existing file ("foo.png" or whatever): oooooooooo then you make a new file with this data in memory: nnnnn This could be something like you opened the original foo.png file and made a change that results in the file shrinking, or it could be some completely unrelated data. Now you save this as foo.png and the editing program assumes opening a file for writing will erase the old data and writes out the new data. The end result is you have this file: nnnnnooooo e.g. the tail of the old file is still present in the file data. It turns out it's possible to recover the pixel data from those tail bytes, in spite of losing the compression state. Now the assumption that writing over an existing file will truncate/erase the original file is reasonable. That's the default behavior of most file IO APIs. I don't know what the windows app is doing, but the original android bug was an API that takes a mode string copied from posix's fopen, in which "w" means "open for writing, and erase any existing file", but then later on made an undocumented change that made opening a file with "w" no longer erase existing files.

whoopdedo 4y ago

This reminds me of the early binary DOC file format that was essentially a dump of Word's working memory. You could find all sorts of leaked data in the slack space between text chunks. Sometimes from other processes since `malloc` doesn't zero memory. I think there were a few instances of people being caught doing bad things because of identifying information in a Word DOC. But why is this even happening? The standard procedure to overwrite a file is to save to a temporary file first so an error that occurs during the write won't damage the existing file. Are they really doing an in-place write and how does that affect the shadow copy if you wanted to restore the previous version of the file?

thrashh 4y ago
It sounds like someone wrote fopen(name, “r+”) instead of fopen(name, “w”) I don’t think writing to a separate file is standard procedure at all. Way more apps don’t do that than do from my anecdotal memories.
- alkonaut 4y ago
  I guess it depends on how long users are expected to work on the documents/flies, and whether there is some other safety mechanism. Basically: a power outage, full disk etc. corrupting the file at save costs X hours of lost work and for some X you better make sure the app can revert to a known state via a transactional save and/or an autosave feature. Personally I'd probably always save to a new file even if the amount of work potentially lost is negligible (as in a snipping tool). The cost of doing so is extremely small in development so that if you ever save one customer's file, you probably saved more time than it cost you to implement transactional file writing. It's a few extra lines, if you opt out of the more complex scenarios (E.g. you can't make atomic renames to move if the target is a network share).
Retr0id 4y ago
It feels like a lot of "things everyone knows" are slowly getting lost over time, as developers work at higher and higher levels of abstraction without deep knowledge of the layers beneath them (which is of course the whole point of abstractions, but they're never perfect) Being a true "full stack" engineer is a superpower when it comes to performance optimisation, or vulnerability research.

dang 4y ago

Recent and related: Exploiting aCropalypse: Recovering truncated PNGs - https://news.ycombinator.com/item?id=35208721 https://news.ycombinator.com/item?id=35208721 - March 2023 (71 comments) Acropalypse: a vulnerability in Google's screenshot editing tool - https://news.ycombinator.com/item?id=35207787 https://news.ycombinator.com/item?id=35207787 - March 2023 (44 comments)

lazerl0rd 4y ago

Snipping Tool used to have this "feature" whereby any drawing performed on a screenshot would be animated as an overlay (this was only visible in the UWP Photos app at the time). Funnily enough, that's the first thing that came to mind when I heard of Acropalypse.

HALtheWise 4y ago

This would have been avoided if the PNG format (or at least one commonly used editor) required that the data filled the whole file, or rendered extra junk when there was extra data at the end.

ProgramMax 4y ago
The PNG spec actually has wording to disallow data past the end. https://w3c.github.io/PNG-spec/#15FileConformance https://w3c.github.io/PNG-spec/#15FileConformance "3. No chunks or other content follow the IEND chunk." (I'm the PNG spec chair and also the person who discovered Snipping Tool is vulnerable.)
- Retr0id 4y ago
  However, it also says: > The PNG decoder has to determine whether a syntax error is fatal (unrecoverable) or not, depending on its requirements and the situation. For example, most decoders can ignore an invalid IEND It doesn't explicitly mention what decoders should do on encountering data after IEND, but The general philosophy for decoders seems to be that errors should be handled gracefully where possible, even if the file is technically malformed (which is maybe something that could be clarified or expanded upon?)
  - ProgramMax 4y ago
    True, true. I respect it. :) For others, Retr0id has been helping with the PNG spec. A third edition is in the works.
  - 13of40 4y ago
    Back in the olden days, when people were using protocols like Kermit and XModem to download their questionable images from BBS's, You would often get a file whose size was rounded up to the nearest block size. In that situation, failing for extra data at the end would have been a fatal move for someone implementing an image decoder, and I think PNG might be just barely old enough that the designers remembered that.

alpb 4y ago

Note that this is not the "Snipping tool" but the "Snip & Sketch" (win+shift+s?) Though, I'm not able to reproduce it myself.

ProgramMax 4y ago
Apparently the Windows 10 version of Snipping Tool is not vulnerable. That's the one that tells you to get Snip & Sketch. On Windows 11, Snipping Tool is vulnerable. (And it doesn't suggest you get Snip & Sketch.)
- layer8 4y ago
  The Windows 11 Snipping Tool is the evolution of the Windows 10 Snip & Sketch, confusingly.
layer8 4y ago
The two were merged in Windows 11, reverting the newer tool to the “Snipping Tool” name of the older tool. I can reproduce it with Snip & Sketch on Windows 10 using Save As (Ctrl+S).

kuroguro 4y ago

For android it was a backwards incompatible, undocumented API change [0]. For windows it just looks like the UWP API is complicated enough that you can footgun yourself. For ex OpenAsync+DataWriter would do it as the default behavior [1]. [0] https://issuetracker.google.com/issues/180526528 https://issuetracker.google.com/issues/180526528 [1] https://stackoverflow.com/questions/35842374/how-can-i-overwrite-a-file-in-uwp https://stackoverflow.com/questions/35842374/how-can-i-overw...

xign 4y ago
I would believe it… UWP APIs can be really complicated and over-designed sometimes.

pabs3 4y ago

Anyone looked at any Linux cropping tools?

chenxiaolong 4y ago
I just took a look at spectacle (KDE's screenshot tool, version 22.12.3) and it's not affected. It properly truncates the file when overwriting a file that already exists (after cropping or any other edit I tested). The inode number stays the same, so it's not doing the create-temp-file + rename method.
kzrdude 4y ago
Android was playing games with the file open mode (open(file, "w") didn't overwrite and truncate), and that kind of change would be unforgivable on linux. Also on linux you'd quickly notice something was wrong with the file sizes.

kdrag0n 4y ago

Aside from looking at the file size, you can check any PNG image with pngcheck [1]: pngcheck good.png OK: good.png (467x389, 32-bit RGB+alpha, non-interlaced, 88.2%). Compared to a vulnerable image: pngcheck bad.png bad.png additional data after IEND chunk ERROR: bad.png macOS Preview, Quick Look, and CleanShot X are safe. [1] https://www.libpng.org/pub/png/apps/pngcheck.html https://www.libpng.org/pub/png/apps/pngcheck.html, available in Homebrew

ornornor 4y ago

https://nitter.net/David3141593/status/1638222624084951040 https://nitter.net/David3141593/status/1638222624084951040

deleted 4y ago

[deleted]

rldjbpin 4y ago

another plus for sticking with windows 10. although not as intuitive, the old snipping tool, the screenshot only captures that area you selected. i will let someone test the same technique on those cases but empirically i've had screenshots as little as a couple KB this way.