ACropalypse

Discovery and usage

aCropalypse was discovered by Simon Aarons and David Buchanan, two security researchers. It had previously been submitted to Google's issue tracker by Lucy Phipps on August 11, 2022. Aarons reportedly discovered the bug when he noticed that the file size for a screenshot he took of white text on a black background was abnormally large. A website was created where users can submit cropped or altered images to reveal the original.

Behavior

aCropalypse exploits a vulnerability within Markup. Upon saving a cropped screenshot in Markup, the altered image is saved in the same location as the original image. The image is created using the ParcelFileDescriptor.open() function; the function is called using the "w" argument to ParcelFileDescriptor.parseMode() , representing "write", when "wt" should have been passed instead, truncating the original image. Although the image is not created using ParcelFileDescriptor.parseMode() , but rather ParcelFileDescriptor.open() , the former converts an argument into a bitmask for the latter. In similar functions, such as the C function fopen, using the "w" argument will automatically truncate the file to zero length. The use of "w" was implemented in Android 10 as an undocumented change.

Markup uses zlib, a compression library that utilizes deflate compression, itself based on the lossless data compression algorithms LZ77 and LZ78, where each bit of data references the last, and dynamic Huffman coding, where a Huffman tree is defined at the start of the block. The Huffman tree in Markup screenshots are respecified every 16 kilobytes. The initial exploit for aCropalypse precomputed a list of 8 bytestrings and passed them to zlib, in order to start from a specific bit offset. Additionally, the initial exploit prefixed the image stream with 32 KB of the ASCII character "X".

Mitigation

An internal patch for aCropalypse was finalized on January 24, 2023, although a fix only began rolling out in a security patch released on March 13, 2023. Certain social media sites, including Twitter, automatically truncate uploaded images, although others do not. One such site, Discord, mitigated the vulnerability on January 17, 2023. Cloudflare addressed the issue in JPEG files by checking the end-of-image marker in libjpeg-turbo for Rust and in PNG files with lodepng.

Impact

aCropalypse affects Google Pixel phones running Android 10, released in September 2019. Affected photos could include credit card numbers and other private photos. By the time the vulnerability was disclosed, multiple devices, including the Pixel 3 and 3a, Pixel 4, Pixel 5, and Pixel 6 and 6a, had not received the update, thus rendering them vulnerable.

On March 21, software engineer Chris Blume noted that the Snipping Tool in Windows 11 results in a file size equal to a cropped version of the same image. Using this, Buchanan discovered that the Snipping Tool in Windows 11, as well as Windows 10's Snip & Sketch, were susceptible to the same exploit, although not the Win32 Snipping Tool in Windows 10.