Crickets from Chirp Systems in Smart Lock Key Leak
Summary: CISA warned on March 7, 2024 that Chirp Systems smart locks, used in an estimated 50,000 dwellings, store credentials in source code, a flaw researcher Matt Brown reported to Chirp in March 2021 and that CISA initially rated 9.1 out of 10. CISA later downgraded the advisory, saying the hard-coded credentials could let an attacker within about 30 meters change Bluetooth beacon settings but do not expose the devices to remote locking or unlocking.
What's compelling: The flaw sat unresolved for roughly three years while Chirp's parent RealPage faced state lawsuits over rent-setting software, and residents of affected buildings had no choice but to use the app or move.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026