A researcher found a hardcoded credential in Applebee's Android app that opened its customer database; Dine Brands says the flaw is fixed and it has found no evidence of unauthorized access so far.
Applebee's has fixed a security flaw that let anyone access the personal information of its registered customers, TechCrunch reported on 30 October. UK-based researcher Robert Wiggins of What Security found a password for an internal database inside the restaurant chain's Android app earlier this month, with AI helping him locate the credential among thousands of lines of source code. The app has more than a million downloads on Google Play. TechCrunch says it held the story until the bug was confirmed fixed, and that it verified the finding by decompiling the app and retrieving data from a dummy account it created.
According to TechCrunch, the exposed database held customer names, email addresses (including whether they were verified), dates of birth, phone numbers and ZIP codes, along with veteran status, login counts, account-creation dates and the IP addresses of the most recent log-ins, which can reveal approximate location. Wiggins said the same credential could also have allowed an attacker to modify customer data. Hardcoding a credential in an app is among the most severe types of vulnerability, TechCrunch notes, because anyone who has the app can extract the key and log in to a remote system as if they were authorized.
A Dine Brands spokesperson, speaking for Applebee's, said the company's security team launched an investigation and has not currently found any evidence of unauthorized access, adding that the investigation is ongoing. The spokesperson would not say whether server logs exist that could show if anyone accessed the database, how long the credential had been in the app, or whether customers or regulators would be notified. It is unclear how many customers were affected; Applebee's had at least 8.5 million rewards-program members as of last year. Wiggins said he could not report the issue directly because neither Applebee's nor Dine Brands offers a way to report security problems, so he asked TechCrunch to help with disclosure.
