Applebee’s has fixed a security flaw that allowed anyone to access the personal information of its registered customers, after a researcher found a password for an internal database inside Applebee’s mobile app, TechCrunch has learned. The popular restaurant chain confirmed on Thursday that it had taken action to address the security issue to prevent any unauthorized access to its customer database. TechCrunch withheld publication of this story until the bug was confirmed to be fixed.
Robert Wiggins, a U.K.-based cybersecurity researcher at What Security, discovered the security lapse earlier this month. Wiggins is no stranger to discovering security issues, including exposed or sensitive information that should not be publicly accessible. For this latest discovery, Wiggins used AI to help find the credential buried inside thousands of lines of source code in Applebee’s Android app, which has more than a million downloads on Google Play.
The credential allowed access to the company’s customer database. Storing a password or private key in software, known as hardcoding credentials, is one of the most severe types of security vulnerabilities because anyone with the app can extract the key and use it to log in to a remote system as if they were an authorized user. Wiggins said that the hardcoded credential could have also allowed a malicious attacker to modify customer data in the database.
TechCrunch verified Wiggins’ findings by downloading and decompiling Applebee’s Android app to examine its source code and confirm that it contained the exposed credential. We also created an Applebee’s account with dummy account data, which allowed Wiggins to retrieve our information from the company’s database. The exposed database contained customer names, email addresses (including whether or not the customer verified their email), dates of birth, phone numbers, and the ZIP codes.
The data also included veteran status, the number of times customers had logged in, when their accounts were created, and the IP addresses of their most recent logins, which can be used to reveal the person’s approximate location. Wiggins was unable to alert Applebee’s or its parent company, Dine Brands, as neither have ways to report security issues. Wiggins asked TechCrunch for help in disclosing the security issue to the company.
A spokesperson for Dine Brands, who did not provide their name, said in an emailed statement on Friday: “We appreciate TechCrunch and the security researcher for bringing this matter to our attention. Our security team promptly launched an investigation and has not currently found any evidence of unauthorized access.” When asked by TechCrunch, the spokesperson would not say if the company has server logs that it can review to determine whether anyone accessed the database, or if it has any logs at all. It’s unclear how many customers were affected by the data exposure.
Extract — continue reading at the source.
