Celeb Shout-Out App Cameo Exposes Private Videos and User Data

guest · Feb 21, 2020

Celeb Shout-Out App Cameo Exposes Private Videos and User Data
February 20, 2020
https://www.vice.com/en_us/article/akwj5z/cameo-app-exposed-private-videos-user-data-passwords

Cameo, the increasingly popular app for paying celebrities to record short personal videos, exposed a wealth of user data including email addresses, hashed and salted passwords and phone numbers, and messages via a misconfiguration in its app.

The site also has an issue where videos that are supposed to be private are actually available for anyone to find and download. Using the design flaw, Motherboard wrote basic code to build lists of ostensibly private videos filmed for users by celebrities such as Snoop Dogg, Ice T, and Michael Rapaport.

"I got some of the backed up user database," the researcher who flagged multiple security and privacy issues with the app said. Motherboard granted the researcher anonymity to speak more candidly about a sensitive security incident.
Click to expand...

One of the other issues the researcher found was that the Cameo app included credentials that they said allowed anyone to log into Cameo's backend infrastructure. Specifically, the credentials granted access to Amazon S3 buckets used to store data, the researcher said.
The researcher said they used the credentials to access the servers "to verify what was accessible."

Cameo confirmed the data included hashed and salted passwords and phone numbers, as well as email addresses and a number of non-public Cameo videos, perhaps referring to the internal clips the researcher provided to Motherboard.
Cameo said it has resolved the problem, and is in the process of notifying impacted users.
Click to expand...

Log in or Sign up

Celeb Shout-Out App Cameo Exposes Private Videos and User Data

guest Guest

Log in or Sign up

Celeb Shout-Out App Cameo Exposes Private Videos and User Data

guest Guest

Useful Searches