Photo booth flaw exposes people’s private pictures online

Malwarebytes reports that a flaw in a photo booth operator’s system potentially exposed hundreds of customers’ private pictures online. A security researcher known as Zeacer found that a website run by photo kiosk company Hama Film allowed anyone to download photos and videos without logging in. According to TechCrunch, the site suffered from a well-known and extremely basic vulnerability that made files easy to locate if locations were guessable and not password protected.

The researcher noted that attackers could script automated visits to these locations to scrape images, creating a serious privacy risk, particularly where facial recognition and event details are involved. Hama Film reportedly shortened its file retention period from roughly two to three weeks down to about 24 hours, a move that might narrow the attack surface but does not prevent ongoing scraping.

The article urges organisations hiring photo booth providers to require stronger protections, including password protection, rate limiting, and audit processes, and to acknowledge researchers and fix vulnerabilities quickly.