Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pixnapping Attack

pixnapping.com

Post reply on HN
Print view View original

11–20 of 75 posts

Re: Pixnapping Attack

#13

Post by charcircuit »

ZiiS wrote: post #10
charcircuit wrote: post #7

Earlier quoted context omitted.

App developers can already dynamically mark their windows as secure which should prevent any other app from reading the pixels it rendered. The compositor composites all windows, including secure windows and applies any effects like blur. No apps are supposed to be able to see this final composited image, but this attack uses a side channel they found that allows apps on the system to learn information about the pixe…

The attack needs you to be able to alter the blur of pixels in a secure window; this could be forbidden. A secure window should draw 100% as requested or not at all.

The blur happens in the compositor. It doesn't happen in the secure windows.

>A secure window should draw 100% as requested or not at all.

Take for example "night mode" which adds an orange tint to everything. If secure windows don't get such an orange tint they will look out of place. Being able to do post processing effects on secure windows is desirable, so as I said there is a trade off here in figuring out what should be allowed.

Re: Pixnapping Attack

#14

Post by TheCapeGreek »

Things like this make me wonder if the social media giants use attacks like these to gain certain info about you and advertise to you that way.

Either that or Meta's ability to track/influence emotional state by behaviour is that good that they can advertise to me things I've only thought of and not uttered or even searched anywhere.

Re: Pixnapping Attack

#16

Post by hamandcheese »

charcircuit wrote: post #13
ZiiS wrote: post #10

Earlier quoted context omitted.

The attack needs you to be able to alter the blur of pixels in a secure window; this could be forbidden. A secure window should draw 100% as requested or not at all.

The blur happens in the compositor. It doesn't happen in the secure windows. >A secure window should draw 100% as requested or not at all. Take for example "night mode" which adds an orange tint to everything. If secure windows don't get such an orange tint they will look out of place. Being able to do post processing effects on secure windows is desirable, so as I said there is a trade off here in figuring out what…

> Take for example "night mode" which adds an orange tint to everything. If secure windows don't get such an orange tint they will look out of place. Being able to do post processing effects on secure windows is desirable, so as I said there is a trade off here in figuring out what should be allowed.

That seems well worth the trade to me.

Re: Pixnapping Attack

#17

Post by yorwba »

bilekas wrote: post #8

It's not exactly a new technique but it's effective for most super targeted attacks, honestly it seems if you were this inclined to be able to get a specific app on the users phone, you might as well just work off the Android app you've already gotten delivered to the users phone. Like Facebook. Throw a privacy notice to the users "This app will take periodic screenshots of your phone" You'd be amazed how many people…

A patch for the original vulnerability is already public: https://android.googlesource.com/platform/frameworks/native/... and explicitly states in the commit message that it tries to defeat "pixel stealing by measuring how long it takes to perform a blur across windows."

The researchers aren't releasing their code because they found a workaround to the patch.

Then there's a bunch of "no GPU vendor has committed to patching GPU.zip" and "Google has not committed to patching our app list bypass vulnerability. They resolved our report as “Won’t fix (Infeasible)”."

And their original disclosure was on February 24, 2025, so I don't think you can accuse them of being too impatient.

As for "This app will take periodic screenshots of your phone", you still need an exploit to screenshot things that are explicitly excluded from screenshots (even if the user really wants to screenshot them.)

Re: Pixnapping Attack

#19

Post by cc81 »

dotancohen wrote: post #15
w4yai wrote: post #12

Earlier quoted context omitted.

It's quite standard for "big" CVEs nowadays

I'd say that it started with heartbleed.

Maybe Linus has a point

>"It looks like the IT security world has hit a new low," Torvalds begins. "If you work in security, and think you have some morals, I think you might want to add the tag-line: "No, really, I'm not a whore. Pinky promise" to your business card. Because I thought the whole industry was corrupt before, but it's getting ridiculous," he continues. "At what point will security people admit they have an attention-whoring problem?"

https://www.techpowerup.com/242340/linus-torvalds-slams-secu...

Post reply on HN