Microsoft scrambles to fix Windows 11 'aCropalypse' privacy-battering bug
(2023/03/24)
- Reference: 1679692739
- News link: https://www.theregister.co.uk/2023/03/24/microsoft_snipping_tool_fix/
- Source link:
Microsoft is said to be preparing to fix the high-profile "aCropalypse" privacy bug in its Snipping Tool for Windows 11.
Users can remove sensitive information or some other parts of photos, screenshots, and other images by cropping them using the Snipping Tool app. The problem is that for the Windows 11 app – as well as Microsoft's Snip & Sketch cropping tool in Windows 10 – the file of the cropped image still includes the cropped out portions, which can be recovered and viewed.
A [1]similar flaw was found in Google's Markup image-editing app for its Pixel smartphones. According to reverse engineers Simon Aarons and David Buchanan – who named the bug aCropalyse – the problem affects Pixel smartphones since 2018, when the 3 series came out. Google patched its code to avoid leaking cropped areas of images.
[2]
Then this week, Buchanan confirmed that the Windows Snipping Tool and Snip & Sketch software had the same issue. If a user cropped a photo or other image using the software and then saved the edited image over the original file, that file still contains the cropped-out portion. The area isn't visible when viewing the image using normal tools, but the data is still there in the file, and can be restored and viewed using appropriate recovery software.
We're saved .. soon!
A Windows Insider who goes by the handle XenoPanther [3]observed that Microsoft may have fixed the problem already. The Windows giant created version 11.2302.20.0 of the Snipping Tool app – the current stable version is 11.2302.4.0 – and is releasing it in the Windows Insider Canary channel for testing.
The Register has asked Microsoft for a response and will add it to the story if one comes back.
[4]Privacy fail: Pictures cropped, redacted by Google Pixel phones can be recovered
[5]Microsoft freaks out users with Windows 11 warning: 'LSA protection is off'
[6]Microsoft: Patch this severe Outlook bug that Russian miscreants exploited
[7]Microsoft pushed 'inaccurate' Windows 11 upgrade to unsupported devices
It's unclear when Microsoft intends to release the updated Snipping Tool app to all users – or if a fix is coming for the flaw in Windows 10 – though the quick reaction to the initial report indicates that Redmond is eager to get this sorted quickly.
Meanwhile, if you've used Microsoft's code to crop your snaps and then shared them on, be aware someone with a copy of them might be able to recover the lopped-off portions. ®
Get our [8]Tech Resources
[1] https://www.theregister.com/2023/03/20/google_pixel_acropalypse/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZB4rmY-WGHrgo4RtyyayyQAAAJc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://twitter.com/XenoPanther/status/1638658755117162502
[4] https://www.theregister.com/2023/03/20/google_pixel_acropalypse/
[5] https://www.theregister.com/2023/03/22/microsoft_update_lsa_warning/
[6] https://www.theregister.com/2023/03/14/microsoft_patch_tuesday/
[7] https://www.theregister.com/2023/02/27/windows_11_inaccurate_upgrade/
[8] https://whitepapers.theregister.com/
Users can remove sensitive information or some other parts of photos, screenshots, and other images by cropping them using the Snipping Tool app. The problem is that for the Windows 11 app – as well as Microsoft's Snip & Sketch cropping tool in Windows 10 – the file of the cropped image still includes the cropped out portions, which can be recovered and viewed.
A [1]similar flaw was found in Google's Markup image-editing app for its Pixel smartphones. According to reverse engineers Simon Aarons and David Buchanan – who named the bug aCropalyse – the problem affects Pixel smartphones since 2018, when the 3 series came out. Google patched its code to avoid leaking cropped areas of images.
[2]
Then this week, Buchanan confirmed that the Windows Snipping Tool and Snip & Sketch software had the same issue. If a user cropped a photo or other image using the software and then saved the edited image over the original file, that file still contains the cropped-out portion. The area isn't visible when viewing the image using normal tools, but the data is still there in the file, and can be restored and viewed using appropriate recovery software.
We're saved .. soon!
A Windows Insider who goes by the handle XenoPanther [3]observed that Microsoft may have fixed the problem already. The Windows giant created version 11.2302.20.0 of the Snipping Tool app – the current stable version is 11.2302.4.0 – and is releasing it in the Windows Insider Canary channel for testing.
The Register has asked Microsoft for a response and will add it to the story if one comes back.
[4]Privacy fail: Pictures cropped, redacted by Google Pixel phones can be recovered
[5]Microsoft freaks out users with Windows 11 warning: 'LSA protection is off'
[6]Microsoft: Patch this severe Outlook bug that Russian miscreants exploited
[7]Microsoft pushed 'inaccurate' Windows 11 upgrade to unsupported devices
It's unclear when Microsoft intends to release the updated Snipping Tool app to all users – or if a fix is coming for the flaw in Windows 10 – though the quick reaction to the initial report indicates that Redmond is eager to get this sorted quickly.
Meanwhile, if you've used Microsoft's code to crop your snaps and then shared them on, be aware someone with a copy of them might be able to recover the lopped-off portions. ®
Get our [8]Tech Resources
[1] https://www.theregister.com/2023/03/20/google_pixel_acropalypse/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZB4rmY-WGHrgo4RtyyayyQAAAJc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://twitter.com/XenoPanther/status/1638658755117162502
[4] https://www.theregister.com/2023/03/20/google_pixel_acropalypse/
[5] https://www.theregister.com/2023/03/22/microsoft_update_lsa_warning/
[6] https://www.theregister.com/2023/03/14/microsoft_patch_tuesday/
[7] https://www.theregister.com/2023/02/27/windows_11_inaccurate_upgrade/
[8] https://whitepapers.theregister.com/
I don't mean to sound snippy, but...
pluraquanta
I wonder if 'selection' screenshots have the same problem. Do they actually define the captured pixels within the selection boundary or are they just taking a screenshot of the whole screen and then cropping to the selection boundary?
It seems to be a general thing with "cropping" tools. I had the task of turning some Word documents of books into PDFs. The files turned out to be much bigger than expected, largely because the supposedly cropped images weren't. In one case several different faces had been "cropped" out of a larger image. The entire image was embedded several times. I think there must be a misconception amongst devs that "crop" really means "frame" as that's what seems to be happening. Fortunately Gwenview did a proper cropping job for me (other FOSS image editing tools are available).