Applebee's has closed a security hole that let anyone reach the personal information of its registered customers, after a researcher discovered a password for an internal database hidden inside the restaurant chain's mobile app.
The company confirmed it acted to block unauthorized access to its customer database. The flaw was found earlier this month by Robert Wiggins, a U.K.-based cybersecurity researcher at What Security, who used AI to locate the credential buried in thousands of lines of source code in Applebee's Android app. That app has more than a million downloads on Google Play, and the credential gave access to the company's customer database.
Hardcoding a password or private key into software ranks among the most serious kinds of security vulnerability, because anyone with the app can pull out the key and sign in to a remote system as an authorized user. Wiggins said the credential could also have let a malicious attacker alter customer data in the database.
The exposed database held customer names, email addresses, whether customers had verified their email, dates of birth, phone numbers and ZIP codes. It also included veteran status, login counts, account creation dates and the IP addresses of customers' most recent logins, which can point to a person's approximate location.
Wiggins could not alert Applebee's or its parent company, Dine Brands, because neither offers a way to report security issues, so he asked for help in disclosing the problem. A Dine Brands spokesperson, who did not give a name, said in an emailed statement that the company appreciated the researcher and the reporting, that its security team launched an investigation promptly and that it has not currently found evidence of unauthorized access. The spokesperson would not say whether the company keeps server logs that could show whether anyone accessed the database, and said the investigation is ongoing with appropriate steps to follow.
It is unclear how many customers were affected. Wiggins said counting them would have required the AI model to needlessly touch potentially every customer record. Applebee's had at least 8.5 million customers in its rewards program as of last year, but the company would not say how many customers' personal information was exposed. The company also did not answer whether it will notify customers or U.S. regulators, including whether it will file a disclosure with the U.S. Securities and Exchange Commission, and did not respond when asked how long the credential had been in the app.
More software news from TechManNews.
