Photo booth flaw exposes people’s private pictures online

A security researcher known as Zeacer spent weeks warning a photo booth operator about a vulnerability that allegedly exposed hundreds of customers’ private photos to anyone who knew where to look, in a flaw tied to a website run by photo kiosk company Hama Film. According to TechCrunch, which has reviewed the researcher’s analysis, the site suffered from a basic vulnerability that allowed access to files stored in easily guessable locations, without requiring login or password protection.

Because those locations are predictable, attackers can write scripts to automatically visit them and download the files, putting photos and videos at serious privacy risk. Hama Film reportedly shortened its file retention period from roughly two to three weeks to about 24 hours, a move that might narrow the attack surface but does not stop scraping of images.

The article argues that organisations employing photo booth providers should require stronger protections, including password protection, rate limiting, and ensuring locations cannot be guessed, while acknowledging researchers and promptly fixing vulnerabilities.