Applebee has fixed a security vulnerability. Previously, a researcher discovered the password to an internal database in Applebee's mobile application, allowing anyone to access the personal information of its registered customers.
The chain restaurant confirmed on Thursday that it had taken measures to address this security issue in order to prevent any unauthorized access to its customer database.
TechCrunch will only release this report after confirming that the vulnerability has been fixed.
British cybersecurity researcher, What Security, whose Robert Wiggins team, discovered this security flaw earlier this month. Wiggins is no stranger to identifying security issues, including situations where exposed or sensitive information should not be made publicly accessible.
In this latest discovery, Wiggins utilized artificial intelligence to find buried credentials among the thousands of lines of source code in the Android application of Applebee. This application has been downloaded over 1 million times on Google Play. These credentials can be used to access the company's customer database.
Storing passwords or private keys in software, what is known as hard-coded credentials, is one of the most serious security vulnerabilities, as anyone who possesses that application can extract the keys and log into remote systems just like an authorized user.
Wiggins indicates that this hardcoded credential may also allow malicious attackers to modify customer data in the database.
TechCrunch downloaded and decompiled the Android application of Applebee, checked its source code, and confirmed that it indeed contained exposed credentials, thereby verifying the findings of Wiggins. TechCrunch also used virtual account data to create an account for Applebee, which allowed Wiggins to retrieve relevant information from the company's database.
The exposed database contains customer names, email addresses (including whether the customers have verified their emails), dates of birth, phone numbers, and postal codes. The data also includes veteran status, the number of times customers have logged in, the time accounts were created, as well as the last login location IP. This information can be used to infer the approximate locations of individuals.
Wiggins is unable to directly issue an alert to Applebee or its parent company, Dine Brands, as neither company has a channel for reporting security issues. Wiggins subsequently requested TechCrunch to help disclose this security issue to the company.
An unnamed spokesperson stated in an email statement on Friday: "We are grateful to TechCrunch and this security researcher for bringing this to our attention. Our security team has promptly launched an investigation, and so far, no evidence of unauthorized access has been found."
When TechCrunch followed up with a question, the spokesperson did not clarify whether the company had any server logs available for review to determine if anyone had accessed the database, or whether the company simply did not have any logs at all.
The company added, "Our investigation is still ongoing, and we will take appropriate measures based on the results of the investigation."
It is currently unclear how many customers have been affected by the data exposure. Wiggins indicates that in order to determine the number of customers in the database, it is necessary for the AI model to access almost every customer record unnecessarily.
As of last year, at least 8.5 million customers of Applebee joined their reward program, but the company did not provide a figure for how many customers' personal information was exposed due to this security vulnerability.
TechCrunch asked whether the company would notify customers or US regulatory agencies about this incident, including whether they would submit disclosure documents to the US Securities and Exchange Commission; listed companies are usually required to do so in the event of a major cybersecurity incident. We also asked how long the exposed credentials had been present in Applebee's application, but did not receive a response.
If the company responds, TechCrunch will update this article.
