Applebee’s exposed customers’ personal data after leaving database password in app

Applebee’s has fixed a security flaw that allowed anyone to access the personal information of its registered customers, after a researcher found a password for an internal database inside Applebee’s mobile app, TechCrunch has learned. The popular restaurant chain confirmed on Thursday that it had taken action to address the security issue to prevent any unauthorized access to its customer database. TechCrunch withheld publication of this story until the bug was confirmed to be fixed.

据 TechCrunch 获悉，Applebee’s 修复了一个安全漏洞，该漏洞曾允许任何人访问其注册客户的个人信息。此前，一名研究人员在 Applebee’s 的移动应用程序中发现了一个内部数据库的密码。这家连锁餐厅周四证实，已采取行动解决该安全问题，以防止任何未经授权的访问。在确认漏洞已修复之前，TechCrunch 暂缓了这篇报道的发布。

Robert Wiggins, a U.K.-based cybersecurity researcher at What Security, discovered the security lapse earlier this month. Wiggins is no stranger to discovering security issues, including exposed or sensitive information that should not be publicly accessible. For this latest discovery, Wiggins used AI to help find the credential buried inside thousands of lines of source code in Applebee’s Android app, which has more than a million downloads on Google Play. The credential allowed access to the company’s customer database.

英国 What Security 公司的网络安全研究员罗伯特·威金斯（Robert Wiggins）在本月初发现了这一安全漏洞。威金斯在发现安全问题方面经验丰富，包括那些本不应公开的敏感信息泄露。在这次最新的发现中，威金斯利用人工智能在 Applebee’s 安卓应用程序的数千行源代码中找到了隐藏的凭据，该应用在 Google Play 上的下载量已超过一百万次。该凭据允许访问公司的客户数据库。

Storing a password or private key in software, known as hardcoding credentials, is one of the most severe types of security vulnerabilities because anyone with the app can extract the key and use it to log in to a remote system as if they were an authorized user. Wiggins said that the hardcoded credential could have also allowed a malicious attacker to modify customer data in the database.

在软件中存储密码或私钥（即硬编码凭据）是最严重的安全漏洞类型之一，因为任何拥有该应用程序的人都可以提取密钥，并像授权用户一样登录远程系统。威金斯表示，硬编码的凭据还可能允许恶意攻击者修改数据库中的客户数据。

TechCrunch verified Wiggins’ findings by downloading and decompiling Applebee’s Android app to examine its source code and confirm that it contained the exposed credential. We also created an Applebee’s account with dummy account data, which allowed Wiggins to retrieve our information from the company’s database. The exposed database contained customer names, email addresses (including whether or not the customer verified their email), dates of birth, phone numbers, and ZIP codes.

TechCrunch 通过下载并反编译 Applebee’s 的安卓应用程序来检查其源代码，确认其中确实包含泄露的凭据，从而验证了威金斯的发现。我们还创建了一个带有虚拟账户数据的 Applebee’s 账户，这使得威金斯能够从公司数据库中检索到我们的信息。泄露的数据库包含客户姓名、电子邮件地址（包括客户是否验证了邮箱）、出生日期、电话号码和邮政编码。

The data also included veteran status, the number of times customers had logged in, when their accounts were created, and the IP addresses of their most recent log-ins, which can be used to reveal the person’s approximate location. Wiggins was unable to alert Applebee’s or its parent company, Dine Brands, as neither have ways to report security issues. Wiggins asked TechCrunch for help in disclosing the security issue to the company.

数据还包括退伍军人身份、客户登录次数、账户创建时间以及最近一次登录的 IP 地址，这些信息可用于揭示个人的大致位置。由于 Applebee’s 及其母公司 Dine Brands 均未提供报告安全问题的渠道，威金斯无法直接通知他们。威金斯请求 TechCrunch 协助向该公司披露这一安全问题。

A spokesperson for Dine Brands, who did not provide their name, said in an emailed statement on Friday: “We appreciate TechCrunch and the security researcher for bringing this matter to our attention. Our security team promptly launched an investigation and has not currently found any evidence of unauthorized access.” When asked by TechCrunch, the spokesperson would not say if the company has server logs that it can review to determine whether anyone accessed the database, or if it has any logs at all.

Dine Brands 的一位未透露姓名的发言人在周五的电子邮件声明中表示：“我们感谢 TechCrunch 和这位安全研究人员向我们通报此事。我们的安全团队已立即展开调查，目前尚未发现任何未经授权访问的证据。”当 TechCrunch 询问时，该发言人拒绝透露公司是否有可供审查的服务器日志以确定是否有人访问过数据库，也未说明公司是否保留了任何日志。

“Our investigation is ongoing, and we will take appropriate steps based on our findings,” the company added. It’s unclear how many customers were affected by the data exposure. Wiggins said that figuring out the number of customers in the database would have required the AI model to unnecessarily access potentially every customer record. Applebee’s had at least 8.5 million customers enrolled in its rewards program as of last year, though the company would not provide a number of how many customers had their personal information exposed by this security flaw.

该公司补充道：“我们的调查仍在进行中，我们将根据调查结果采取适当措施。”目前尚不清楚有多少客户受到此次数据泄露的影响。威金斯表示，要确定数据库中的客户数量，需要人工智能模型不必要地访问可能存在的每一条客户记录。截至去年，Applebee’s 的奖励计划至少有 850 万名注册客户，但该公司拒绝提供此次安全漏洞导致多少客户个人信息泄露的具体数字。

TechCrunch asked the company if it would alert customers or U.S. regulators about the incident, including whether it would file a disclosure with the U.S. Securities and Exchange Commission, as publicly traded companies are required to do for material cybersecurity incidents. We also asked the company how long the exposed credential had been in the Applebee’s app, but we did not get a response. We’ll update this article if the company responds.

TechCrunch 询问该公司是否会就此事件通知客户或美国监管机构，包括是否会向美国证券交易委员会提交披露信息（上市公司在发生重大网络安全事件时必须这样做）。我们还询问了该公司泄露的凭据在 Applebee’s 应用程序中存在了多久，但没有得到回应。如果公司做出回应，我们将更新本文。