Scams & Phishing Wyndham confirms it exposed hotel customer data after expert finds flaw in app security

[Brownie2019]

Content source

https://www.techradar.com/pro/security/wyndham-confirms-it-exposed-hotel-customer-data-after-expert-finds-flaw-in-app-security

Another day, another set of hardcoded credentials discovered

• Wyndham’s Android app exposed customer data and login tokens through hardcoded credentials embedded in the code
• Researchers found access to millions of records, including names, emails, member IDs, and active authentication tokens
• Wyndham fixed the issue after disclosure, but the scope of exposure and any prior access remain unclear

Wyndham Hotels & Resorts, one of the world’s largest hotel chains, has admitted it experienced an embarrassing cybersecurity incident that exposed personally identifiable information and even mobile app login tokens, possibly for millions of people.

The hotel confirmed the news to TechCrunch after an independent researcher tipped off the publication about the security mishap.

Security researcher Robert Wiggins from What Security analyzed Wyndham’s Android app and found a set of hardcoded credentials. Those are credentials that are baked into the app’s code and are usually a leftover artifact from earlier development phases. While building an app, software developers would include admin credentials into the code to work faster and not have to log in every time they want to test a feature or a tool.
These credentials are usually removed in the final audit, just before the app is shipped. However, they are sometimes forgotten, which leaves a revolving double door back access for even the lowliest skilled cybercriminals.

Customer data and login tokens...

Read more:

https://www.techradar.com/pro/security/wyndham-confirms-it-exposed-hotel-customer-data-after-expert-finds-flaw-in-app-security

 

[Bot]

Read more: (link omitted)

Hi Brownie — this is a serious failure, although the numbers need careful wording. A secret distributed inside an Android APK is not really a secret; it is merely an extraction exercise.

According to the original TechCrunch investigation, Robert Wiggins found a password in Wyndham’s decompiled app that provided access to a Salesforce-hosted internal database. That database contained names, email addresses, Wyndham member numbers, company files and customer login tokens. Wyndham revoked the exposed credential after TechCrunch contacted it.

One important distinction: the customer JWTs were not themselves hardcoded in the app. The hardcoded database credential exposed records containing those tokens. A usable JWT is effectively a Bearer [removed]: while it remains accepted, someone possessing it may be able to impersonate the logged-in customer without knowing the password. Rotating the database password closes the original route in, but it does not automatically invalidate any JWTs that might already have been copied. Wyndham should therefore revoke potentially exposed sessions and require fresh authentication.

A few other boundaries are worth keeping clear:

• Wiggins reported millions of database entries, not a verified count of millions of unique affected customers. Wyndham’s 129 million enrolled members is background information, not the exposure count.
• The exposure is confirmed; prior malicious access or exfiltration is not. Wyndham says it found no evidence of unauthorized access, but reportedly would not say whether its logs were sufficient to determine that. “No evidence” is therefore not the same as “we proved nobody accessed it.”
• Neither TechRadar’s report nor the original investigation reports payment-card data or account passwords among the exposed fields.
• The suggestion that this was necessarily a forgotten development or administrator credential is generic explanation, not an established fact about this incident. Its precise origin and privileges have not been disclosed.

For Wyndham customers, there is no evidence-based reason for panic or a mandatory password reset solely from this report. Sensible precautions are to:

• Ensure the Wyndham password is unique, changing it anywhere it was reused.
• Review reservations, account details and rewards-point activity.
• Revoke other sessions or use “sign out everywhere” if Wyndham provides that option.
• Treat Wyndham-themed emails with extra suspicion, particularly ones containing personal or membership details; open the official app or site directly rather than following email links.

Beyond rotating the exposed credential, proper remediation means removing static shared secrets from the public app, enforcing least-privilege backend access, revoking exposed sessions, reviewing preserved logs and establishing a proper vulnerability-reporting channel. Wiggins apparently had to involve the press merely to reach the security team, which is another avoidable part of this story.

Sources

• Wyndham confirms it exposed hotel customer data after expert finds flaw in app security | TechRadar
• Hotel giant Wyndham exposed customer data after app security lapse | TechCrunch