Comment apple is in the place where they should be useing (Score 1) 50
apple is in the place where they should be useing own chips but it's to bad they got rid of pro systems.
Submission + - Applebee's exposed customers' personal data after leaving database password in a (techcrunch.com)
Joe_Dragon writes: Applebee’s has fixed a security flaw that allowed anyone to access the personal information of its registered customers, after a researcher found a password for an internal database inside Applebee’s mobile app, TechCrunch has learned.
The popular restaurant chain confirmed on Thursday that it had taken action to address the security issue to prevent any unauthorized access to its customer database.
TechCrunch withheld publication of this story until the bug was confirmed to be fixed.
Robert Wiggins, a U.K.-based cybersecurity researcher at What Security, discovered the security lapse earlier this month. Wiggins is no stranger to discovering security issues, including exposed or sensitive information that should not be publicly accessible.
For this latest discovery, Wiggins used AI to help find the credential buried inside thousands of lines of source code in Applebee’s Android app, which has more than a million downloads on Google Play. The credential allowed access to the company’s customer database.
Storing a password or private key in software, known as hardcoding credentials, is one of the most severe types of security vulnerabilities because anyone with the app can extract the key and use it to log in to a remote system as if they were an authorized user.
Wiggins said that the hardcoded credential could have also allowed a malicious attacker to modify customer data in the database.
TechCrunch verified Wiggins’ findings by downloading and decompiling Applebee’s Android app to examine its source code and confirm that it contained the exposed credential. We also created an Applebee’s account with dummy account data, which allowed Wiggins to retrieve our information from the company’s database.
The exposed database contained customer names, email addresses (including whether or not the customer verified their email), dates of birth, phone numbers, and ZIP codes. The data also included veteran status, the number of times customers had logged in, when their accounts were created, and the IP addresses of their most recent log-ins, which can be used to reveal the person’s approximate location.
Wiggins was unable to alert Applebee’s or its parent company, Dine Brands, as neither have ways to report security issues. Wiggins asked TechCrunch for help in disclosing the security issue to the company.
A spokesperson for Dine Brands, who did not provide their name, said in an emailed statement on Friday: “We appreciate TechCrunch and the security researcher for bringing this matter to our attention. Our security team promptly launched an investigation and has not currently found any evidence of unauthorized access.”
When asked by TechCrunch, the spokesperson would not say if the company has server logs that it can review to determine whether anyone accessed the database, or if it has any logs at all.
“Our investigation is ongoing, and we will take appropriate steps based on our findings,” the company added.
It’s unclear how many customers were affected by the data exposure. Wiggins said that figuring out the number of customers in the database would have required the AI model to unnecessarily access potentially every customer record.
Applebee’s had at least 8.5 million customers enrolled in its rewards program as of last year, though the company would not provide a number of how many customers had their personal information exposed by this security flaw.
TechCrunch asked the company if it would alert customers or U.S. regulators about the incident, including whether it would file a disclosure with the U.S. Securities and Exchange Commission, as publicly traded companies are required to do for material cybersecurity incidents. We also asked the company how long the exposed credential had been in the Applebee’s app, but we did not get a response.
The popular restaurant chain confirmed on Thursday that it had taken action to address the security issue to prevent any unauthorized access to its customer database.
TechCrunch withheld publication of this story until the bug was confirmed to be fixed.
Robert Wiggins, a U.K.-based cybersecurity researcher at What Security, discovered the security lapse earlier this month. Wiggins is no stranger to discovering security issues, including exposed or sensitive information that should not be publicly accessible.
For this latest discovery, Wiggins used AI to help find the credential buried inside thousands of lines of source code in Applebee’s Android app, which has more than a million downloads on Google Play. The credential allowed access to the company’s customer database.
Storing a password or private key in software, known as hardcoding credentials, is one of the most severe types of security vulnerabilities because anyone with the app can extract the key and use it to log in to a remote system as if they were an authorized user.
Wiggins said that the hardcoded credential could have also allowed a malicious attacker to modify customer data in the database.
TechCrunch verified Wiggins’ findings by downloading and decompiling Applebee’s Android app to examine its source code and confirm that it contained the exposed credential. We also created an Applebee’s account with dummy account data, which allowed Wiggins to retrieve our information from the company’s database.
The exposed database contained customer names, email addresses (including whether or not the customer verified their email), dates of birth, phone numbers, and ZIP codes. The data also included veteran status, the number of times customers had logged in, when their accounts were created, and the IP addresses of their most recent log-ins, which can be used to reveal the person’s approximate location.
Wiggins was unable to alert Applebee’s or its parent company, Dine Brands, as neither have ways to report security issues. Wiggins asked TechCrunch for help in disclosing the security issue to the company.
A spokesperson for Dine Brands, who did not provide their name, said in an emailed statement on Friday: “We appreciate TechCrunch and the security researcher for bringing this matter to our attention. Our security team promptly launched an investigation and has not currently found any evidence of unauthorized access.”
When asked by TechCrunch, the spokesperson would not say if the company has server logs that it can review to determine whether anyone accessed the database, or if it has any logs at all.
“Our investigation is ongoing, and we will take appropriate steps based on our findings,” the company added.
It’s unclear how many customers were affected by the data exposure. Wiggins said that figuring out the number of customers in the database would have required the AI model to unnecessarily access potentially every customer record.
Applebee’s had at least 8.5 million customers enrolled in its rewards program as of last year, though the company would not provide a number of how many customers had their personal information exposed by this security flaw.
TechCrunch asked the company if it would alert customers or U.S. regulators about the incident, including whether it would file a disclosure with the U.S. Securities and Exchange Commission, as publicly traded companies are required to do for material cybersecurity incidents. We also asked the company how long the exposed credential had been in the Applebee’s app, but we did not get a response.
Comment just change to offline ones and let the Cleaner fu (Score 1) 78
just change to offline ones and let the Cleaner fuck them up.
https://news.slashdot.org/stor...
Comment a bookie that can't pay (Score 1) 20
Comment that is an jury question with an lot of contract l (Score 1) 37
that is an jury question with an lot of contract law to go over.
Comment contract law issues over this? (Score 1) 84
contract law issues over this? Like the team made an offer and may be forced to pay it out?
Comment list games. (Score 1) 68
list games.
Comment Game Over. Please Deposit 40 Quarters (Score 3, Funny) 55
Game Over. Please Deposit 40 Quarters
Comment AI doc says You've Got Leprocy! (Score 0) 64
AI doc says You've Got Leprocy!
Comment YOU MUST AQUIT! (Score 1) 340
YOU MUST AQUIT!
Comment tech needs an more trades like school system (Score 1) 202
tech needs an more trades like school system
Comment Hard Drivins Airborne ! (Score 1) 223
Hard Drivins Airborne !
Comment and will it be put on the list? (Score 0) 72
and will it be put on the list?
Comment Re:Good luck with that. (Score 1) 72
when you hear the beep think all the fun you can have on super market sweep! The self check out will just add it all up for you and then you can just walk.
Comment and in more locked down env this will lead to some (Score 1) 116
and in more locked down env this will lead to something failing.
