// TECHCRUNCH — MOBILE & WEB
Hotel giant Wyndham exposed customer data after app security lapse
Hotel and resort giant Wyndham has acknowledged a cybersecurity incident after a good-faith security researcher discovered a bug that allowed anyone to access customers’ personal information.
Security researcher Robert Wiggins at What Security exclusively told TechCrunch that he found a password inside the source code of Wyndham’s Android app, which granted access to an internal company database, hosted by tech company Salesforce.
Wiggins told TechCrunch that the credential exposed personal information including customer names, email addresses, and Wyndham member number. The database also stores customer login tokens (called JWTs) that keep customers logged-in to their apps without having to repeatedly enter their own passwords. The database also contained Wyndham files and documents.
According to Wiggins, the database had millions of entries, but he was unable to determine an accurate number of exposed customer records. Wyndham touts some 129 million enrolled rewards members.
The researcher said Wyndham has no way to report security flaws, and asked for TechCrunch’s help in alerting the company. Soon after TechCrunch made contact with Wyndham’s cybersecurity staff, the exposed credential was revoked, preventing any further access to the database.
“Our team has taken steps to address the issue,” a Wyndham spokesperson told TechCrunch. “Our security teams have no evidence of any unauthorized access,” the statement added, without providing any further details about the claim.
Wyndham’s spokesperson would not say, when asked, whether the company had the technical means, such as server logs, to determine if anyone had access to the customer database prior to Wiggins’ discovery.
TechCrunch also asked Wyndham whether it planned to notify customers whose information was exposed, or disclose the incident to U.S. regulators, such as filing notice with the U.S. Securities and Exchange Commission, as public companies are required to do for material cybersecurity incidents. Wyndham would not say.
Wyndham’s spokesperson also would not say for how long the password was embedded in its customer app, or how Wyndham plans to ship a long-term fix for the app.
App and software developers generally avoid including passwords or credentials in publicly released software and apps — a process known as “hardcoding” — as anyone with a copy of the software can extract the password and use it to access its associated server or database. Given the simplicity with which credentials can be abused by anyone, many cases of hardcoded credentials are automatically scored with a maximum vulnerability severity rating.