Password Embedded in App Code Put Applebee’s Customer Data at Risk

Staff Report | PNN

A security vulnerability in the mobile app of popular US restaurant chain Applebee’s exposed registered customers’ personal information to potential unauthorized access. A password embedded in the app’s code could have been used to gain access to the company’s customer database. Applebee’s has fixed the vulnerability following an investigation by a security researcher.

According to a report by technology news outlet TechCrunch, UK-based cybersecurity researcher Robert Wiggins discovered the problem earlier this month. He used artificial intelligence to examine thousands of lines of code in Applebee’s Android app, which has been downloaded more than one million times from Google Play.

Storing a password or private security key directly inside an application’s code is known as “hardcoding.” Such a vulnerability can allow anyone who obtains the app to extract confidential information from its code and potentially use it to access a remote system.

According to Wiggins, the password could have allowed an attacker not only to view customer information but also to modify data stored in the database.

TechCrunch independently verified the vulnerability by downloading the app and examining its code. After creating an account using test information, the publication found that the researcher was able to retrieve the same information from Applebee’s database.

The exposed information included customers’ names, email addresses, dates of birth, phone numbers and postal codes. The database also contained details such as whether an email address had been verified, whether a customer was a former member of the military, when the account was created, the number of login attempts and the IP address used for the most recent login.

An IP address can provide an approximate indication of a user's location.

Wiggins said he could not find a way to report the security vulnerability directly to Applebee’s or its parent company, Dine Brands. He later approached TechCrunch for assistance in bringing the issue to the company’s attention.

A spokesperson for Dine Brands said in an email on Friday that the company appreciated the efforts of the publication and the researcher in reporting the matter. The spokesperson said the company’s security team had launched an investigation promptly and had found no evidence of unauthorized access so far.

However, the company did not respond to questions about whether server logs were available to determine if anyone had accessed the database. It said the investigation was still ongoing.

It remains unclear exactly how many customers were potentially affected by the vulnerability. Wiggins said determining the number of potentially affected customers would require accessing a substantial number of records in the database.

Applebee’s had at least 8.5 million members in its rewards-based customer programme last year. However, the company has not disclosed how many customers’ information may have been exposed.

Applebee’s also did not respond to TechCrunch’s questions about whether affected customers would be notified or whether US regulatory authorities would be informed. The company has not disclosed how long the password had remained embedded in the app’s code.