Applebee’s fixes mobile app flaw that exposed customer data through hardcoded database credentials
Researchers found access to personal information including names, contact details, birthdays, and account metadata
No evidence of abuse was found, but the incident highlights the persistent risk of hardcoded secrets in software
Applebee’s has fixed a serious flaw in its mobile app that exposed sensitive customer information to pretty much anyone. Whether or not anyone malicious actually found this vulnerability and exploited it is not known at this time. The chain has an Android mobile app that allows customers to browse the menu, customize meals, place orders for delivery or pickup, save their favorites, or receive personalized food recommendations. A security researcher from What Security called Robert Wiggins, used AI to analyze the source code of the app and found a gaping hole – hardcoded credentials for a company database. Notifying the business
The database contained plenty of sensitive information: customer names, their email addresses (both verified and unverified ones), dates of birth, phone numbers, ZIP codes, veteran status, the number of logins, dates of account creation, and the IP address of the most recent login session. We don’t know exactly how many people had their sensitive data exposed that way, but the app has more than a million downloads on the Google Play Store. Wiggins soon realized that there was no way to report the issue either to Applebee’s itself or to its parent company, Dine Brands, so he reached out to TechCrunch . The publication verified his claims by finding the exposed credentials itself, and even created a new entry which Wiggins was later able to extract, and also confirmed the credentials allowed users to modify database entries. TechCrunch managed to get ahold of Dine Brands, who plugged the hole and thanked everyone involved: “We appreciate TechCrunch and the security researcher for bringing this matter to our attention,” the company said…