Cyber Security Instructor, Researcher, and Writer for the Institute for Security and Open Methodologies & Hacker Highschool
Security 101: Never hardcode your passwords and/or cert keys into your devices. Lock control maker Chirp might have missed that introduction to security class since they hardcoded their passwords and private keys (no pun, well sort of a pun) into their applications. Chirp made CISA so mad they they were issued their own advisory (see below), as well as earning a "Exploitable remotely/low attack complexity" on CISA's executive summary. "Low attack complexity" means even your grandmother could attack these locks, remotely too. If you are one of the 50,000 households that use Chirp, well, sit by your front door with a loaded shotgun until Chirp fixes this issue. If you aren't a fan of loaded weapons, take a look at the newest Nerf Blasters. If you aren't a fan of Nerf, get yourself a wonderful mastiff dog (or two, very family friendly and protective, just cowards during lightening storms). https://lnkd.in/gQKWQE9t
