Researchers have discovered a bug in Windows 11’s snipping tool that allows users to reply to cropped pictures, causing confusion and privacy concerns.
Windows, Android, and iOS all offer tools that allow users to crop, edit, or black out parts of a photo or image to fit a presentation, or to hide private or confidential information.But last week researchersDavid Buchanan andDiscovered by Simon AaronsThe Markup Tool in Google Pixel phones has a bug that can partially restore images that have been cropped or blackened by users, and photos as old as 5 years ago can be used. Using this vulnerability, credit card numbers or other private information that users want to hide may be exposed.
The researcher called the bug Acropalypse, and he even launched an online snapshot recovery tool to restore cropped and edited pictures on Pixel phones, and demonstrated the restoration of test photos that were blacked out with Pixel phones and uploaded to the Discord website. picture.
Another researcher, Chris Blume, found a similar problem in Windows 11. Suppose there is a PNG image file and a small image clipped with the Windows 11 clipping tool. The researchers open the clipped image with the Windows 11 clipping tool, and then save it with the original file name to overwrite the original image. The vulnerability lies in that the new PNG image file generated by the Windows 11 snipping tool does not remove the IEND data string of the original image file, which makes the new PNG image look like a small image, but actually contains the information of the original image.
Researcher Buchanan’s tool, designed for Pixel phone photos but still in testing, partially restores old PNG files (not all PNG formats, though).
In addition, the “Bleeping Computer” test found that Windows 11’s snipping tool also has the same problem when editing .JPG files. It’s just that the researcher said that his tool does not currently support JPG files.
Microsoft told the media that it has launched an investigation and will take action to ensure user information if necessary.