Applebee's Fixed Database Exposure After Password Found in Mobile App

Security Flaw Discovered in Applebee's App

Applebee's has addressed a security vulnerability in its Android mobile application. A cybersecurity researcher found that a password for an internal customer database was embedded directly within the app's source code. This allowed anyone who decompiled the app to access sensitive customer information.

Details of the Exposure

Robert Wiggins, a U.K.-based cybersecurity researcher, identified the flaw earlier this month. He utilized AI tools to scan thousands of lines of code in the Applebee's Android app, which has over a million downloads, to locate the credential. Hardcoding credentials directly into software is considered a severe vulnerability, as it grants unauthorized users access to remote systems.

The exposed database contained customer names, email addresses (including verification status), dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates, and recent login IP addresses.

Potential for Data Modification

Wiggins noted that the hardcoded credential could have also enabled malicious actors to modify customer data within the database, not just view it. TechCrunch independently verified these findings by examining the app's source code and confirming the presence of the exposed credential.

Company Response and Disclosure

Wiggins initially faced difficulty reporting the issue as Applebee's and its parent company, Dine Brands, lacked clear channels for security vulnerability disclosures. He then sought assistance from TechCrunch, which facilitated the disclosure to the company. Applebee's confirmed on Thursday that it had taken action to resolve the security issue and prevent unauthorized access to its customer database.