Technology & Hacking · VIDEO
Applebee’s Closes Vulnerability That Exposed Data of Millions of Users
Applebee’s has resolved a serious security vulnerability that allowed unauthorized access to the personal data of registered customers. A cybersecurity researcher discovered a hardcoded password in the restaurant's Android app, exposing sensitive information such as emails, phone numbers, and IP addresses. The flaw has been verified and fixed, but questions remain about the extent of the damage and the measures for notifying customers.
KEY TAKEAWAYS
- Vulnerability discovered in Applebee’s Android app with hardcoded exposed credentials
- Sensitive data accessible: emails, phone numbers, IP addresses, and veteran status
- Applebee’s confirms fixing the flaw but does not provide details on unauthorized access
- Uncertainty about the number of affected customers and any notifications to authorities
Transcript
A serious security flaw has been discovered in the Applebee's Android app. A cybersecurity researcher found a password for an internal database hardcoded in the app's source code, potentially exposing millions of customers' personal information, including emails, phone numbers, and IP addresses.
The vulnerability was reported to TechCrunch and has since been fixed by Applebee's, but the company did not confirm whether unauthorized access had occurred.
Researcher Robert Wiggins used an AI model to identify the exposed credential within the app's source code. The hardcoded password could have allowed direct access to and modification of the customer database.
The exposed data included names, email addresses, dates of birth, phone numbers, postal codes, and IP addresses of last logins. With over 8.5 million customers in Applebee's loyalty program, the potential impact on user privacy is significant.
Wiggins faced difficulties reporting the vulnerability due to the lack of a dedicated security channel at Applebee's or its parent company, Dine Brands. Applebee's spokesperson stated that no evidence of unauthorized access was found, but details remain scarce.
This incident highlights the importance of secure coding practices, robust identity management, and clear communication channels for reporting vulnerabilities. Customers are advised to monitor their accounts for suspicious activity and consider additional security measures.
The vulnerability is part of a broader trend in mobile apps, with 40% containing critical security flaws, according to a study by Synopsys. This underscores the need for companies to prioritize cybersecurity to protect customer data and maintain trust.
