Applebee’s fixes vulnerability after password found in app — TechCrunch

Restaurant chain Applebee’s has fixed a vulnerability in its Android app after a hardcoded password for accessing an internal database was found in its code. As TechCrunch reports, the password could have allowed anyone to access the personal information of registered customers.

Password found in app code

The vulnerability was discovered by British cybersecurity researcher Robert Wiggins of What Security. He used artificial intelligence to find the credentials among thousands of lines of code in Applebee’s Android app, which has more than one million downloads on Google Play.

TechCrunch verified the researcher’s findings: the publication downloaded and decompiled the app and confirmed the presence of the password in its code. Journalists also created an account using test data, after which Wiggins was able to obtain that account’s information from the company’s database.

More current news is available on the UA.News Telegram channel Telegram.

What data was accessible

The database contained customers’ names, email addresses and information about their verification, dates of birth, phone numbers and postal codes. It also included information about veteran status, the number of account logins, the account creation date, and the IP address of the last login, which can be used to approximately determine a person’s location.

According to Wiggins, the password could potentially have allowed an attacker not only to view but also to modify customer data. Dine Brands, Applebee’s parent company, said that after being notified of the issue, it immediately launched an investigation and has so far found no evidence of unauthorized access to the database.

The number of customers whose data may have been accessible through the vulnerability has not been established. As of last year, Applebee’s loyalty program had at least 8.5 million members, but the company did not disclose how many records may have been accessible through this issue.