Applebee’s exposed customers’ personal data after leaving database password in app

Applebee’s has fixed a information flaw that allowed anyone to entree the idiosyncratic accusation of its registered customers, aft a researcher recovered a password for an interior database wrong Applebee’s mobile app, TechCrunch has learned. 

The fashionable edifice concatenation confirmed connected Thursday that it had taken enactment to code the information contented to forestall immoderate unauthorized entree to its lawsuit database. 

TechCrunch withheld work of this communicative until the bug was confirmed to beryllium fixed.

Robert Wiggins, a U.K.-based cybersecurity researcher astatine What Security, discovered the information lapse earlier this month. Wiggins is no alien to discovering information issues, including exposed oregon delicate accusation that should not beryllium publically accessible. 

For this latest discovery, Wiggins utilized AI to assistance find the credential buried wrong thousands of lines of root codification successful Applebee’s Android app, which has much than a cardinal downloads connected Google Play. The credential allowed entree to the company’s lawsuit database.

Storing a password oregon backstage cardinal successful software, known arsenic hardcoding credentials, is 1 of the astir terrible types of information vulnerabilities due to the fact that anyone with the app tin extract the cardinal and usage it to log successful to a distant strategy arsenic if they were an authorized user.

Wiggins said that the hardcoded credential could person besides allowed a malicious attacker to modify lawsuit information successful the database.

TechCrunch verified Wiggins’ findings by downloading and decompiling Applebee’s Android app to analyse its root codification and corroborate that it contained the exposed credential. We besides created an Applebee’s relationship with dummy relationship data, which allowed Wiggins to retrieve our accusation from the company’s database.

The exposed database contained lawsuit names, email addresses (including whether oregon not the lawsuit verified their email), dates of birth, telephone numbers, and the ZIP codes. The information besides included seasoned status, the fig of times customers had logged in, erstwhile their accounts were created, and the IP addresses of their astir caller logins, which tin beryllium utilized to uncover the person’s approximate location. 

Wiggins was incapable to alert Applebee’s oregon its genitor company, Dine Brands, arsenic neither person ways to study information issues. Wiggins asked TechCrunch for assistance successful disclosing the information contented to the company.

A spokesperson for Dine Brands, who did not supply their name, said successful an emailed connection connected Friday: “We admit TechCrunch and the information researcher for bringing this substance to our attention. Our information squad promptly launched an probe and has not presently recovered immoderate grounds of unauthorized access.” 

When asked by TechCrunch, the spokesperson would not accidental if the institution has server logs that it tin reappraisal to find whether anyone accessed the database, oregon if it has immoderate logs astatine all.  

“Our probe is ongoing, and we volition instrumentality due steps based connected our findings,” the institution added. 

It’s unclear however galore customers were affected by the information exposure. Wiggins said that figuring retired the fig of customers successful the database would person required the AI exemplary to unnecessarily entree perchance each lawsuit record. 

Applebee’s had at slightest 8.5 cardinal customers enrolled successful its rewards program arsenic of past year, though the institution would not supply a fig of however galore customers had their idiosyncratic accusation exposed by this information flaw.

TechCrunch asked the institution if it would alert customers oregon U.S. regulators astir the incident, including whether it would record a disclosure with the U.S. Securities and Exchange Commission, arsenic publically traded companies are required to bash for worldly cybersecurity incidents. We besides asked the institution however agelong the exposed credential had been successful the Applebee’s app, but we did not get a response. 

We’ll update this nonfiction if the institution responds.