By Titik Puspa 
A critical security vulnerability within the Applebee’s mobile application, which potentially exposed the personal information of millions of registered customers, has been rectified following its discovery by a U.K.-based cybersecurity researcher. The flaw, which allowed unauthorized access to a customer database, was brought to light when the researcher found a hardcoded password embedded within the app’s source code. This discovery raises significant concerns about the restaurant chain’s data security practices and the potential ramifications for its vast customer base.
The popular casual-dining chain confirmed on Thursday that it had implemented measures to address the security issue, aiming to prevent any further unauthorized access to its sensitive customer data. This confirmation came after TechCrunch, a prominent technology news publication, had withheld its reporting on the matter until the bug was verifiably fixed. This journalistic practice underscores the importance of responsible disclosure in cybersecurity, ensuring that vulnerabilities are remediated before widespread public awareness can be exploited by malicious actors.
The individual credited with uncovering this significant security lapse is Robert Wiggins, a cybersecurity researcher operating under the banner of What Security. Wiggins, who is based in the United Kingdom, has a documented history of identifying and reporting security vulnerabilities, including instances of exposed or improperly secured sensitive information. His previous work has highlighted a consistent pattern of discovering data that should remain private but is instead accessible to the public, indicating a proactive and diligent approach to digital security auditing.
In this latest investigation, Wiggins employed artificial intelligence (AI) tools to meticulously sift through thousands of lines of source code within Applebee’s Android application. This app boasts a substantial user base, with over a million downloads on the Google Play Store. The AI’s analytical capabilities were instrumental in locating the embedded credential, a password that granted direct access to the company’s customer database. This method of discovery, leveraging AI to parse complex code, represents a modern and increasingly common approach to identifying digital vulnerabilities.
The root of the security breach lies in a practice known as "hardcoding credentials." This involves embedding sensitive information, such as passwords or encryption keys, directly into the software’s source code. Cybersecurity experts universally consider this one of the most severe types of security vulnerabilities. The inherent danger stems from the fact that anyone with access to the application’s code, or who can decompile the application itself, can extract these credentials. Once extracted, these credentials can be used to impersonate an authorized user and gain illicit access to remote systems, databases, or other secured resources. In this specific instance, the hardcoded password essentially served as a master key to Applebee’s customer data.
Wiggins elaborated on the potential consequences of this vulnerability, stating that the exposed credential could have facilitated not only unauthorized access but also the malicious modification or deletion of customer data within the database. This highlights the dual threat: data exfiltration and data integrity compromise. A malicious actor could have potentially altered customer profiles, added fraudulent information, or even deleted records, leading to widespread confusion and damage for both customers and the business.
To rigorously verify Wiggins’ findings, TechCrunch undertook its own investigative steps. The publication downloaded and decompiled the Applebee’s Android app, meticulously examining its source code to confirm the presence of the exposed credential. Furthermore, to provide tangible proof of the vulnerability, TechCrunch created a dummy Applebee’s account using fabricated data. This allowed Wiggins to demonstrate the exploit by successfully retrieving the information associated with this test account directly from the company’s database. This hands-on verification process lends significant credibility to the report and the severity of the discovered flaw.
The exposed database, as accessed by Wiggins and verified by TechCrunch, contained a wealth of sensitive customer information. This included full names, email addresses (along with a flag indicating whether the email address had been verified by the customer), dates of birth, and phone numbers. Beyond these common data points, the database also contained ZIP codes, veteran status, the frequency of customer logins, account creation dates, and crucially, the IP addresses associated with the most recent logins. This IP address data is particularly concerning, as it can be used to approximate a user’s geographical location, further enhancing the potential for targeted attacks or privacy violations.
A significant hurdle in the disclosure process was Wiggins’ inability to directly contact Applebee’s or its parent company, Dine Brands, through established security reporting channels. Neither entity appeared to provide a clear mechanism for researchers to report vulnerabilities. Consequently, Wiggins reached out to TechCrunch for assistance in facilitating the disclosure to the company, emphasizing the need for a responsible and timely communication strategy.
Responding to TechCrunch’s inquiries, a spokesperson for Dine Brands, who opted to remain anonymous, issued a statement on Friday. The spokesperson expressed gratitude to TechCrunch and the security researcher for bringing the matter to their attention. They stated that the company’s security team had "promptly launched an investigation" and, at that point, had "not currently found any evidence of unauthorized access." This statement, while acknowledging the report, provided a degree of reassurance by claiming no immediate evidence of compromise.
However, when pressed by TechCrunch regarding the availability of server logs to determine whether unauthorized access had occurred, the spokesperson declined to provide specific details about the company’s logging capabilities. They reiterated that the investigation was ongoing and that the company would "take appropriate steps based on our findings." This evasiveness on the specifics of their investigative tools and potential data retention policies left room for doubt regarding the thoroughness of their internal review.
The exact number of customers affected by this data exposure remains unclear. Wiggins indicated that determining the precise number of records within the database would have necessitated an AI model accessing potentially every customer record, a process he deemed unnecessary and potentially intrusive given the sensitive nature of the data. This suggests that the database could contain a very large volume of customer information.
While Applebee’s boasts a substantial customer base, with at least 8.5 million individuals enrolled in its rewards program as of the previous year, the company has not disclosed how many of these customers had their personal information compromised by this security flaw. This lack of transparency regarding the scope of the breach is a common concern in data security incidents.
TechCrunch further questioned the company on its plans for customer notification and regulatory reporting. Specifically, the publication inquired whether Applebee’s intended to alert affected customers or U.S. regulators, including whether a disclosure would be filed with the U.S. Securities and Exchange Commission (SEC). Publicly traded companies are generally obligated to report material cybersecurity incidents to the SEC. Additionally, TechCrunch sought information on how long the exposed credential had been present within the Applebee’s app, a detail that could shed light on the duration of the potential vulnerability. As of the publication of the initial report, the company had not responded to these specific inquiries.
The incident serves as a stark reminder of the persistent cybersecurity challenges faced by even large, established companies. The hardcoding of credentials, a fundamental security misstep, highlights the critical need for robust secure coding practices, regular security audits, and comprehensive vulnerability management programs. The reliance on AI by researchers like Wiggins also points to the evolving landscape of threat detection, where sophisticated tools are increasingly being used to uncover hidden vulnerabilities. The full implications of this breach, including the potential for identity theft, phishing attacks, and other forms of fraud targeting Applebee’s customers, will likely unfold in the coming weeks and months. The company’s ongoing investigation and future disclosures will be closely monitored by consumers, regulators, and the cybersecurity community alike.
