Applebee's app shipped with a database password that exposed customer data

Restaurant chain Applebee's has fixed a security flaw that let anyone access the personal data of its registered customers. According to TechCrunch, a researcher found the password to an internal database inside the company's mobile app. On Thursday, Applebee's confirmed it had acted to prevent unauthorized access. The publication held the story until it could confirm the bug was fixed.

How the flaw was found

The lapse was discovered earlier this month by Robert Wiggins, a U.K.-based researcher at What Security who has a track record of finding exposed sensitive data. This time he had help from AI, which he used to locate the credential among thousands of lines of source code in Applebee's Android app, downloaded more than a million times on Google Play.

Storing a password or private key inside software is known as hardcoding credentials. It is one of the most severe types of vulnerability: anyone with the app can extract the key and log in to a remote system as an authorized user. Wiggins said an attacker could have not only read customer data but also modified it.

TechCrunch verified the finding by decompiling the app and confirming the credential was present. Reporters then created an Applebee's account with dummy data, which Wiggins was able to retrieve from the company's database.

What was exposed

The database held customer names, email addresses along with whether they were verified, dates of birth, phone numbers and ZIP codes. It also included veteran status, the number of log-ins, account creation dates and the IP addresses of recent log-ins, which can reveal a person's approximate location.

How many customers were affected remains unclear. Wiggins explained that counting them would have required the AI model to needlessly access potentially every record in the database. Applebee's rewards program had at least 8.5 million members as of last year, but the company would not say how many people were exposed.

The company's response

Wiggins could not report the issue directly: neither Applebee's nor its parent company, Dine Brands, offers a way to report security problems. He asked TechCrunch for help.

An unnamed Dine Brands spokesperson thanked the publication and the researcher, saying the security team promptly launched an investigation and has not currently found evidence of unauthorized access. The spokesperson would not say whether server logs would be reviewed or whether any logs exist at all, adding only that the investigation is ongoing.

The company did not answer whether it would notify customers or regulators, including the U.S. Securities and Exchange Commission, where public companies must disclose material cybersecurity incidents, nor how long the credential had been in the app.

Source: TechCrunch