Screenshots edited in Pixels' markup tool could be un-edited with aCropalypse exploit

android, screenshots edited in pixels' markup tool could be un-edited with acropalypse exploit

Screenshots edited in Pixels’ markup tool could be un-edited with aCropalypse exploit

Pixel owners have suffered editing their screenshots using the default markup tool. The paint inputs aren’t great at redacting anything, even if you scrub a spot real hard, and the crop tool is hilariously lacking any preset aspect ratios. But there’s another reason why you shouldn’t use markup and it’s the reason why you might want to take a look at where or who you’ve sent your images to.

Researchers Simon Aarons and David Buchanan have gone public with an exploit they are dubbing “aCropalypse” which, in essence, allows anyone to take a PNG screenshot cropped in Android’s default markup tool and undo at least some of the edits to produce portions of the image that were not intended for viewing. While the exploit was reported to Google and is patched in the March security update for Pixels (see CVE-2023-21036), redacted images sent on certain platforms — including, but not limited to Discord prior to mid-January — through the last several years could be at risk of being exposed.

You can see the exploit in action with your own images by using this demonstration tool provided by the aCropalypse researchers. We’ve also been given further information about the discovery and patching of this exploit by the researchers in advance of its publication to this webpage.

What’s wrong, the human friendly version

The technical aspects of the exploit seem to stem from a change to an API in Android 10 (see this IssueTracker thread from 2021 and a general explanation from Redditor OatmealDome). Prior to the change, an app tasked with writing new data to an existing file would truncate said file by default if the amount of that new data was less than what the original file held. With the change, that truncation behavior was no longer default.

So, if the amount of new data was less than what the existing file held, because data-writing occurs sequentially, the back end of the existing file would stay on, intact, as part of the new file. This change presented some negative outcomes: if the old data was unnecessary to the new file, it’d at least be taking up precious storage space; if the data was of a sensitive nature, those with the right tools could read and extract it on its own for malicious uses.

While the issue was eventually deemed to be “fixed” — as far as we can tell, guidance has changed on the write mode apps should use — the markup tool still used this untruncated write mode.

Aarons consulted Buchanan on this vulnerability with regards to PNG screenshots (not JPEGs) on January 2 and Buchanan was able to quickly develop a proof of concept for the current exploit. The two informed Google of the bug that same day. The company acknowledged the bug on January 3. A fix was internally finalized on January 24, but it did not begin going out to Pixel devices until March 13 with the month’s security patch.

The engineer has posted to his personal blog about the actual goings-on, but from a high-level perspective, here’s what’s happening: PNG as a file format compresses data through certain processes over a series of blocks. Any given block of compressed data may contain references to the previous block of data, theoretically paving the way for previous blocks of data to be decompressed one by one. Thus, Buchanan was able to develop a decompression method that combines that look-back aspect with some cryptographic detective work focused on the intact, carried-over file data to gain context on what should be revealed.


As you know by now, the result is that an image edited in the markup tool can have portions of the original, unedited image after the fact with some know-how. In addition to Pixels, certain non-Pixel Android devices and custom ROMs also use markup.

While most online platforms will perform their own processing (such as further compression or stripping metadata) on user-uploaded images, Discord had not been processing image uploads adequately to prevent this exploit from working. aCropalypse researchers say the instant chat app began stripping trailing data from files on January 17. But this means markup-edited images dating as far back as late 2019 could be uncompressed to reveal information not intended for public viewing.

While Discord does have rich search tools to help users find image files they may have shared, you may have a lot of non-screenshot content to sift through and not every screenshot you’ve sent may be exploitable — we tested a screenshot on a Pixel 6a against the demo tool and couldn’t get a result, but we’ve noted other users who have reported workable findings online.

Buchanan said in his blog post that he wrote a script to scrape his Discord uploads for any vulnerable images and found “lots of them.” While most were generally harmless, he did have a screenshot of an eBay order and was able to extract his full postal address from it.

News Related


Adam Sandler Says He Learned Early That 'Critics Didn't Know What the Hell They Were Talking About' (Video)

adam-sandler-mark-twain-prize Adam Sandler hasn’t always been the recipient of glowing reviews for his work, but thanks to his family and friends, those reviews have never made him feel bad. In ... Read more »

We charged a non-Tesla at a Supercharger. Here's how it went

FREDONIA, N.Y. — Tesla opened up a small part of its Supercharger network to non-Tesla vehicles a couple of weeks ago, and as soon as the news hit, we downloaded ... Read more »

Ukraine has 3 options since Putin's not giving up, war experts say. Peace talks aren't among them.

Ukrainian service members near Bakhmut on March 24, 2023. Aris Messinis/Getty Images Putin is not giving up on the war in Ukraine despite the grim circumstances facing Russian forces.  War ... Read more »

Putin Will be Taken Out Before Any War Crimes Trial—Russia Analyst

Russian President Vladimir Putin attends his New Year address to Russians in central Moscow on December 31, 2017. Putin was made a global outlaw on March 17 when he was ... Read more »

Eye drop recall 2023: The full list of brands that have been recalled

null Health officials have issued an urgent eye drop recall after some brands were linked to a dangerous strain of bacteria. Three Americans have died and several more have suffered ... Read more »

United is pulling out of 2 more US cities, bringing pandemic-era total to 38 market exits

MSN has partnered with The Points Guy for our coverage of credit card products. MSN and The Points Guy may receive a commission from card issuers. The news isn’t getting ... Read more »

Gwyneth Paltrow’s most bizarre quotes from ski crash trial testimony

Gwyneth Paltrow took the stand in her ski crash trial on March 24 and immediately made headlines for her bizarre quotes. In her testimony, the Goop founder reflected on her ... Read more »

Kevin McCarthy Says Biden Is Lying About MAGA

Kevin McCarthy “Biden continues to mask his failures with lies,” writes Speaker of the House Kevin McCarthy, flat out calling the President a liar in an incendiary tweet before asserting ... Read more »

People make these 5 everyday mistakes that can cause back problems

(Photo by Sasun Bughdaryan on Unsplash ) By Oliver Lewis via SWNS I’m a chiropractor. These are the five everyday mistakes people are making which can cause back problems. Dr. ... Read more »

Nebraska lawmaker with trans son tells GOP colleagues she's done with them in righteous speech

“No one in the world holds a grudge like me, and no one in the world cares less about being petty than me.” A Nebraska state senator is causing waves ... Read more »

Nothing Phone (2) gets certified but when will it be announced?

Nothing Phone (2) gets certified but when will it be announced? The Nothing Phone (2) is already very much happening and we’ve been treated to a few nuggets of information ... Read more »

‘This is ruining electric cars’: A top YouTube tech reviewer called out one of the biggest drawbacks of EVs in a viral video — here's the major issue and 3 companies looking to solve it

YouTuber calls out the biggest drawbacks of EVs Disclaimer: We adhere to strict standards of editorial integrity to help you make decisions with confidence. All links marked with an asterisk ... Read more »

Mike Trout Teams with Tiger Woods to Build His Own New Jersey Golf Course

The three-time American League MVP is partnering with Woods to build Trout National – The Reserve, a championship golf course in Vineland, N.J., where Trout was born. Mike Trout has ... Read more »

Prince Harry returns to U.K. for surprise court appearance in privacy case

London — Britain’s Prince Harry was back in the U.K. Monday for an unannounced appearance at the country’s High Court as legal proceedings began in a privacy case in which ... Read more »

Biosphere’s first trailer turns the end of the world into a bromance

Biosphere’s first trailer turns the end of the world into a bromance There are plenty of movies about the last people on Earth, but — based on the first teaser ... Read more »

Idaho passes law letting students sue for "emotional harm" if they see a trans kid in the restroom

Idaho is already facing several federal lawsuits over its anti-trans legislation. Idaho Gov. Brad Little (R) signed a bill last week that bans transgender students from using restrooms and locker ... Read more »

New Google Wallpapers come to Android, including a previous Pixel exclusive

New Google Wallpapers come to Android, including a previous Pixel exclusive New wallpapers can help keep the best Android phones looking fresh and vibrant without too much effort. They revitalize ... Read more »

Democrat Schumer warns NYC 'skin-rotting zombie drug' trafficked from Mexico could make fentanyl 'seem tame'

Sen. Chuck Schumer, D-N.Y. held a press conference in Manhattan Sunday to warn about “a deadly, skin-rotting zombie drug” that could make the scourge of fentanyl alone seem “tame.” “Now ... Read more »

The Rock's Daughter Set For In-Ring Debut At WWE NXT Stand & Deliver

Ava Backstage At A WWE NXT Show Ava, the daughter of WWE legend The Rock, will make her in-ring debut at next Saturday’s “WWE NXT” Stand & Deliver premium live ... Read more »

Harry Potter: Things That Made Dolores Umbridge Scarier Than Voldemort

Harry Potter: Things That Made Dolores Umbridge Scarier Than Voldemort Dolores Umbridge was arguably the most evil character in the Harry Potter series, sometimes more so than Lord Voldemort, mainly ... Read more »

Kaspersky releases tool for decrypting ransomware

Source code leaked last month by infighting members of the Conti gang was used to build the antidote to their attacks. Kaspersky has published a new version of a decryption ... Read more »

The 'Gilmore Girls' Costume Designer Has Just Confirmed The Father Of Rory’s Baby

The costume designer took to TikTok to end the speculation and told fans that it’s obviously Logan. If you need a reminder: Logan is Rory’s now married college boyfriend, who ... Read more »

Arkansas Gov. Signs Law Banning Transgender People From Using Bathrooms Matching Their Gender Identity In Public Schools

Topline Arkansas Governor Sarah Huckabee Sanders (R) signed a law on Tuesday that bans transgender people from using bathrooms that match their gender identity in public schools, the latest in ... Read more »

TikTok's Restaurant Butter Hack Makes Spreading So Much Easier

Plate of bread and butter Dining out can be a special experience on its own. After all, you get to don your finest attire, spend quality time with family and ... Read more »

Christian who escaped Chinese persecution warns US descending into 'communist-style of governance'

The leader of a watchdog group that monitors Christian persecution in China said he’s seeing echoes of the Chinese Community Party “playbook” in the U.S., and he’s worried it’ll get ... Read more »

Lollapalooza 2023: How to get tickets to the Chicago music festival

Billie Eilish and Kendrick Lamar Lollapalooza has unveiled its 2023 lineup, teasing some big acts. Headlining this year’s Chicago music festival are Billie Eilish, Kendrick Lamar, Red Hot Chili Peppers, ... Read more »

Fury vs Usyk talks break down, fight will not happen April 29

Talks for Tyson Fury vs Oleksandr Usyk have reportedly broken down Tyson Fury and Oleksandr Usyk will not be fighting, at least not on April 29, as talks have reportedly ... Read more »

Cameron Diaz's Comeback Film Halted As Cops Investigate Costar Jamie Foxx Being Targeted In Alleged Money-Grabbing Scheme

Mega Production on Cameron Diaz’s comeback film has reportedly come to a screeching halt after her costar Jamie Foxx was targeted in an alleged money-grabbing scheme, has learned. Mega ... Read more »

Why Men Fall Out Of Love (Hint: It Has Nothing To Do With Their Partners)

man and woman on date at night By Marisa Donnelly I wish love was perfect. I wish, when we fell for another person, everything just stayed the way it was ... Read more »

Insulin Price Cap Doesn't Apply to All Iowans Who Need It

Some 37.3 million Americans, or about one in 10 people, have diabetes. About one in five don’t know they have it, according to the Centers for Disease Control and Prevention. ... Read more »
Kênh kiến thức kỹ năng, phát triển bản thân, hướng nghiệp, blog nhân sự