\n<\/p>\n
A company that makes photo booths is exposing pictures and videos of its customers online thanks to a simple flaw in its website where the files are stored, according to a security researcher.\u00a0\u00a0<\/p>\n
The researcher, who goes by Zeacer, alerted TechCrunch to the security issue in late November after reporting the vulnerability in October to Hama Film<\/a>, the photo booth maker that has franchise presence in Australia, the United Arab Emirates<\/a>, and the United States<\/a>, but did not hear back.<\/p>\n Zeacer shared with TechCrunch a sample of pictures taken from Hama Film\u2019s servers, which showed groups of clearly young people posing in photo booths. Hama Film\u2019s booths not only print out the photos like a typical photo booth, but booths also upload the customers\u2019 photos to the company\u2019s servers.<\/p>\n Vibecast, which owns Hama Film, has yet to respond to his messages alerting the company of the issues. Vibecast also hasn\u2019t responded to several requests for comment from TechCrunch, nor did Vibecast\u2019s co-founder Joel Park respond to a message we sent via Linkedin.<\/p>\n As of Friday, the researcher said the company has still not fully resolved the security flaw and continues to expose customers\u2019 data. As such, TechCrunch is withholding specific details of the vulnerability from publication.<\/p>\n When Zeacer first found this flaw, he noted that it appeared that photos were deleted from the photo booth maker\u2019s servers every two to three weeks.\u00a0<\/p>\n Now, he said, the pictures stored on the servers appear to get deleted after 24 hours, which limits the number of pictures exposed at any given time. But a hacker could still exploit the vulnerability he discovered each day and download the contents of every photo and video on the server.\u00a0<\/p>\n Techcrunch event<\/p>\n \n\t\t\t\t\t\t\t\t\tSan Francisco<\/span> Before this week, Zeacer said at one point he saw more than 1,000 pictures online for the Hama Film booths in Melbourne.\u00a0<\/p>\n This incident is the latest example of a company that, at least for a time, was not implementing certain basic and widely accepted security practices, such as rate-limiting. Last month, TechCrunch reported that government contractor giant Tyler Technologies<\/a> was not rate-limiting its websites used for allowing courts to manage their jurors\u2019 personal information. This meant anyone could break into any juror\u2019s profile by running a computer script capable of mass-guessing their date of birth and their easy-to-guess numerical identifier.\u00a0<\/p>\n<\/div>\n
\n\t\t\t\t\t\t\t\t\t\t\t\t\t|<\/span>
\n\t\t\t\t\t\t\t\t\t\t\t\t\tOctober 13-15, 2026<\/span>\n\t\t\t\t\t\t\t<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n