Cropped or edited images can be recovered

Most of us have a camera on us at all times, and so photo taking and image sharing has become almost ubiquitous. But when sharing an image, you want to have control over what you share. And that might lead you to crop images, or redact parts of them.

Maybe you cropped out a person that didn’t want their photo online, maybe you put a black mark across your address, or credit card number, or other personal information. You edited it out for a reason, but now it seems as though the original image might still be available for others to view.

Researchers have published a proof-of-concept (PoC) for a vulnerability in Google Pixel’s in-built editing tool Markup. The vulnerability allows anyone with access to the edited image to recover parts of the original, unedited, file.

Testing has shown that Microsoft’s image-snipping tools in both Windows 10 and 11 have a very similar vulnerability.

Markup is a built-in tool which was released with Android 9 Pie in 2018. It can be found on Pixel phones and its main purpose is to edit (crop, add text, draw, and highlight) screenshots.

Due to the vulnerability, known as aCropalypse (CVE-2023-21036), it is possible to, partially, retrieve the original image data of a cropped and/or edited image.

Not every image at direct risk of exposing sensitive information, but many of them will be. The problem is that the Markup tool passes the wrong argument to the parseMode() function. The consequence is that the “old” image does not get truncated and lives on in the redacted image. Simply put, if the altered image has a smaller file size than the original, the information about the original can be retrieved from the last part of the data which did not get overwritten.

So, cropped images are very likely to reveal information about the original file, because the main reason to crop them is often to decrease the image size. But also images where you redacted a part of the image with a marker may be recoverable. In the example below you will see an uploaded image of a credit card with the number masked, next is the image after downloading, and last is the image after going through the recovery tool. The 16 digit number is now visible again.

You can try the exploit for Markup yourself by uploading your own images to this online demonstration provided by the aCropalypse researchers. The demonstration tool only works for images edited with Markup, since the exploit script that works for images edited with Microsoft’s snipping tools is slightly different, according to one of the researchers.

What to do

Unfortunately, there is no way to change the way in which previously redacted images will behave. So if you know of some images that you have posted that could reveal anything you’d rather keep a secret, then you’ll have to find them and delete them. This is a daunting task, since there may be more backups of that image than you would care to imagine. For example, internet archives, backups, all types of caches, and downloads.

Before you go on a wild goose chase, it may be handy to know that you don’t have to worry about some images:

• Most social media platforms recompress uploaded files, so anyone downloading your screenshots from Twitter will not get the exact same file you uploaded. So those can be left alone. But Discord, as shown in the example, and other messaging apps will give back the exact same file that was uploaded.
• If the redacted information is in the upper section of the image (roughly the top fifth of the image) the original part has probably been overwritten and can’t be recovered.
• The vulnerability the researchers found only affected the screenshot editor Markup. But as it turns out, other tools may have similar flaws.
• The exploit only works for PNG files, but a similar vulnerability may exist in JPG files. Basically, if you crop an image and the file size of the saved result is the same as the original, your tool of choice might not be deleting the old image data.

For future images, you can install the March 2023 Google Pixel Update. We encourage you to check your Android version to make sure you are on the latest software. The vulnerability in Microsoft’s tools has not been fully worked out yet, and so for the moment all we know is that somehow the original data can be retrieved. A patch will be forthcoming in the probably not so distant future.

Malwarebytes removes all remnants of ransomware and prevents you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.

TRY NOW