Applebee's fixes hardcoded database password in Android app that exposed customer personal data
Applebee's fixed a flaw after researcher Robert Wiggins found a hardcoded database password in the chain's Android app, with help from AI. The credential gave access to an internal customer database. TechCrunch verified the finding by creating a dummy account and having Wiggins retrieve it. Applebee's confirmed the fix on October 29. Parent company Dine Brands says it has found no evidence of unauthorized access, but its investigation is ongoing and the number of affected records is unknown.
Detalhes técnicos
- Root cause: a database password hardcoded in the app's code or configuration (hardcoded credential), which anyone able to extract it could use against the backend.
- Exposed fields: names, email addresses and verification status, dates of birth, phone numbers, ZIP codes, account-creation dates, login counts, and IP addresses from the most recent logins (approximate location).
- Payment card details and account passwords were not among the fields TechCrunch described.
- Wiggins could not find a way to report the issue and asked TechCrunch to contact the company. TechCrunch held its story until the fix was confirmed.
Remediação
- Customers should watch for targeted scams: unexpected Applebee's-themed emails, texts or calls, especially those offering refunds or compensation, threatening account closure, or asking to verify payment details.
- Verify notices by opening the app or website directly, not through links in unexpected messages.
- Developers should not embed database credentials in mobile apps, and companies should publish a clear vulnerability disclosure channel.
Linha do tempo
-
Applebee's fixes hardcoded database password in Android app that exposed customer personal data
ler a análise desta fonte ocultar
Applebee's fixed a flaw after researcher Robert Wiggins found a hardcoded database password in the chain's Android app, with help from AI. The credential gave access to an internal customer database. TechCrunch verified the finding by creating a dummy account and having Wiggins retrieve it. Applebee's confirmed the fix on October 29. Parent company Dine Brands says it has found no evidence of unauthorized access, but its investigation is ongoing and the number of affected records is unknown.
Technical Details
- Root cause: a database password hardcoded in the app's code or configuration (hardcoded credential), which anyone able to extract it could use against the backend.
- Exposed fields: names, email addresses and verification status, dates of birth, phone numbers, ZIP codes, account-creation dates, login counts, and IP addresses from the most recent logins (approximate location).
- Payment card details and account passwords were not among the fields TechCrunch described.
- Wiggins could not find a way to report the issue and asked TechCrunch to contact the company. TechCrunch held its story until the fix was confirmed.
Remediation
- Customers should watch for targeted scams: unexpected Applebee's-themed emails, texts or calls, especially those offering refunds or compensation, threatening account closure, or asking to verify payment details.
- Verify notices by opening the app or website directly, not through links in unexpected messages.
- Developers should not embed database credentials in mobile apps, and companies should publish a clear vulnerability disclosure channel.