London — Researcher Finds Hardcoded Password in Applebee's App

A hardcoded password buried in Applebee's Android app allowed unrestricted access to a database of registered customers' personal information, according to TechCrunch, which reported the issue has since been fixed. The restaurant chain confirmed Thursday it had taken action to prevent unauthorized access, TechCrunch reported.

Who found the credential and how?

Robert Wiggins, a U.K.-based researcher at What Security, discovered the password earlier this month, TechCrunch reported. Wiggins used AI tools to help locate the credential inside thousands of lines of source code in Applebee's Android app, which has more than a million downloads on Google Play, according to the outlet. Hardcoding a password or private key directly into software is considered one of the more severe classes of vulnerability, TechCrunch noted, because anyone who extracts the app's code can retrieve the key and log in to the remote system as an authorized user.

What data was exposed?

The database Wiggins accessed contained customer names, email addresses, and whether each email had been verified, TechCrunch reported. It also included dates of birth, phone numbers, ZIP codes, veteran status, login counts, account-creation dates, and the IP addresses tied to customers' most recent logins — information that can be used to estimate a person's approximate location, according to the outlet. Wiggins told TechCrunch the hardcoded credential could also have let an attacker modify records inside the database, not merely view them.

How was the finding verified?

TechCrunch said it independently verified Wiggins's findings by downloading and decompiling Applebee's Android app to confirm the exposed credential existed in the source code. The outlet also created a test Applebee's account using dummy information, which Wiggins was then able to retrieve from the company's database, according to the report — a step TechCrunch described as confirming the vulnerability granted real access rather than a theoretical one.

What has Applebee's parent company said?

Wiggins said he had no way to report the issue directly to Applebee's or its parent company, Dine Brands, because neither maintains a public vulnerability-disclosure channel, TechCrunch reported. He asked the outlet to help notify the company. An unnamed Dine Brands spokesperson told TechCrunch in an emailed statement: "We appreciate TechCrunch and the security researcher for bringing this matter to our attention. Our security team promptly launched an investigation and has not currently found any evidence of unauthorized access." The spokesperson declined to tell TechCrunch whether the company retains server logs that could be reviewed to determine if the database was accessed before the fix, according to the report.

What remains unconfirmed?

TechCrunch said it withheld publication until Applebee's confirmed the flaw was fixed, but the company's statement leaves open whether any customer data was actually accessed by a third party before that point, since Dine Brands has not said whether logging exists to make that determination. The scope of affected accounts and the window during which the credential was exposed were not specified in the company's statement, per TechCrunch's reporting.

AlterEgo — A keyboard for character voices. Five free persona rewrites a day.