Security News > 2024 > May > Hacker defaces spyware app’s site, dumps database and source code
A hacker has defaced the website of the pcTattletale spyware application, found on the booking systems of several Wyndham hotels in the United States, and leaked over a dozen archives containing database and source code data.
Described by its developers as an "Employee and child monitoring software," pcTattletale is a consumer-grade spyware solution that was leaking guest details and customer information captured from the hotels' check-in systems because of an API security vulnerability, according to TechCrunch.
Security researcher Eric Daigle found the spyware in the hotel's systems and published a blog post explaining that the pcTattletale flaw he discovered can be used to access screenshots the malware makes on other devices.
Daigle's attempts to contact the developers to fix the security flaw failed, and the vulnerability still allows access to sensitive information belonging to users stalked using the pcTattletale spyware.
While the security researcher only shared a limited amount of info regarding this severe flaw, someone took it as a challenge, defacing the spyware's website and leaking 20 archives containing source code and data dumped from pcTattletale's databases.
Instead, he claims he used a Python exploit to extract pcTattletale's AWS credentials via its SOAP-based API, which provided access to the spyware's source code and databases.