An unsettling discovery has been made regarding consumer-grade spyware infiltrating the check-in systems of three Wyndham hotels across the United States. TechCrunch has uncovered that a covert application known as pcTattletale was surreptitiously running on these systems, discreetly snatching screenshots containing sensitive guest information and booking details. The alarming aspect? These screenshots were not only accessible to the intended users of the spyware but also to anyone with internet access due to a glaring security flaw.
This incident underscores a troubling trend wherein consumer-grade spyware, designed for ostensibly legitimate purposes, inadvertently exposes confidential data owing to vulnerabilities within the spyware itself. pcTattletale, in particular, has now been implicated twice in such breaches. Over recent years, numerous similar spyware applications have suffered from security oversights or misconfigurations, leaving unsuspecting device owners vulnerable to privacy violations, occasionally prompting regulatory intervention.
pcTattletale operates covertly, enabling remote access and monitoring of Android or Windows devices worldwide. Promoted as undetectable, it stealthily operates in the background, allowing its controllers to clandestinely observe target devices. However, a critical flaw in the system’s security protocol has led to the unauthorized availability of captured screenshots on pcTattletale’s servers to anyone savvy enough to exploit the loophole.
Security researcher Eric Daigle stumbled upon this compromised system during an investigation into consumer-grade spyware, colloquially known as “stalkerware” due to its potential for surreptitious tracking of individuals without their consent. Despite Daigle’s efforts to alert pcTattletale to the issue, the company has remained unresponsive, leaving the flaw unaddressed.
The screenshots obtained from the affected Wyndham hotels revealed guests’ names, reservation particulars, and even partial payment card details, all unwittingly exposed via a web portal provided by travel technology giant Sabre. Moreover, one screenshot exhibited access to a third hotel’s check-in system, logged into Booking.com’s administration portal, intensifying concerns regarding data security within the hospitality sector.
The origins of the spyware remain shrouded in mystery, raising questions about how it was deployed—whether through deception of hotel staff or with the hotel’s tacit approval for monitoring employee activities. pcTattletale markets itself for various purposes, including employee monitoring, but its clandestine presence on hotel check-in computers has caught management unawares, highlighting the potential for misuse.
While Wyndham Hotels operates as a franchise, distancing itself from direct involvement, questions linger about its awareness of pcTattletale’s utilization within its branded establishments and whether such usage aligns with company policies. Booking.com, though unaffected directly, acknowledges the broader threat posed to hotel systems by cybercriminals, emphasizing the need for robust cybersecurity measures.
The saga surrounding pcTattletale epitomizes a broader trend of stalkerware masquerading as legitimate tools while enabling unlawful surveillance. Despite marketed as child and employee monitoring software, pcTattletale’s promotion for spying on partners reveals its dubious ethical stance. Offering easy installation options and even a service to discreetly deploy the spyware further underscores the concerning ease with which such invasive tools can be wielded.
As investigations continue, the revelation of pcTattletale’s infiltration serves as a stark reminder of the pervasive threat posed by spyware and the imperative for enhanced cybersecurity vigilance, particularly within sensitive sectors like hospitality.
Leave a Reply