Chirp's Faux Pas: Hardcoded Credentials - not a smart move? or a false positive ?

Smart homes, where everything from the locks to the light is controlled with a swipe of your phone. The marvels of modern technology! But guess what? There's been a little hiccup in the paradise lately

As per to CISA’s latest advisory , Chirp Systems , who is known for their smart locks and their cool smart phone app “Chirp Access” hardcoded some credentials into their application. Now, for the uninitiated, that's like leaving the keys to your house under the welcome mat.

Alright, We see you are panicking to see whether you are affected ! as usual We are going leave here with set of toddler questions and answers

Am I Affected ?

We are not your cyber doctor, but easiest way to find out is

• open your phone

• search for apps “Chirp Access”

• You MAY be affected

I have “Chirp Access” app on my phone ! What is next ?

Ok this is where it gets weird , Chirp system has released a press release ,

“Dear customers, We have conducted our own little nice investigation on this and found zero evidence of any issues!

The wonders of modern security theater!

I am confused, Any advice ?

The best approach forward is to observe the developments on this field both from Chirp System side as well as on CISA side. In the mean time, finding alternative ways to secure your door would be beneficial.

Shout outs!

We are going to give a shoutout to “Matt Brown who reported this vulnerability to CISA”. a little kudo’s to Chirp Systems for taking time to respond to the events.