From Digital Age to Nano Age. WorldWide.

Tag: app

Robotic Automations

Curio raises funds for Rio, an 'AI news anchor' in an app | TechCrunch


AI may be inching its way into the newsroom, as outlets like Newsweek, Sports Illustrated, Gizmodo, VentureBeat, CNET and others have experimented with articles written by AI. But while most respectable journalists will condemn this use case, there are a number of startups that think AI can enhance the news experience — at least on the consumer’s side. The latest to join the fray is Rio, an “AI news anchor” designed to help readers connect with the stories and topics they’re most interested in from trustworthy sources.

The new app, from the same team behind AI-powered audio journalism startup Curio, was first unveiled at last month’s South by Southwest Festival in Austin. It has raised funding from Khosla Ventures and the head of TED, Chris Anderson, who also backed Curio. (The startup says the round has not yet closed, so it can’t disclose the amount.)

Curio itself was founded in 2016 by ex-BBC strategist Govind Balakrishnan and London lawyer Srikant Chakravarti; Rio is a new effort that will expand the use of Curio’s AI technology.

First developed as a feature within Curio’s app, Rio scans headlines from trusted papers and magazines like Bloomberg, The Wall Street Journal, Financial Times, The Washington Post and others, and then curates that content into a daily news briefing you can either read or listen to.

In addition, the team says Rio will keep users from finding themselves in an echo chamber by seeking out news that expands their understanding of topics and encourages them to dive deeper.

Image Credits: Curio/Rio

In tests, Rio prepared a daily briefing presented in something of a Story-like interface with graphics and links to news articles you could tap on at the bottom of the screen that would narrate the article using an AI voice. (These were full articles, to be clear, not AI summaries.) You advance through the headlines in the same way as you would tap through a Story on a social media app like Instagram.

Curio says Rio’s AI technology won’t fabricate information and will only reference content from its trusted publishers partners. Rio won’t use publisher content to train an LLM (large language model) without “explicit consent,” it says.

Image Credits: Curio/Rio

Beyond the briefing, you can also interact with Rio in an AI chatbot interface where you can ask about other topics of interest. Suggested topics — like “TikTok ban” or “Ukraine War,” for example — appear as small pills above the text input box. We found the AI was sometimes a little slow to respond at times, but, otherwise, it performed as expected.

Plus, Rio would offer to create an audio episode for your queries if you want to learn more.

Co-founder Balakrishnan said that Curio users had asked Rio over 20,000 questions since it launched as a feature in Curio last May, which is why the company decided to spin out the tech into its own app.

“AI has us all wondering what’s true and what’s not. You can scan AI sites for quick answers, but trusting them blindly is a bit of a gamble,” noted Chakravarti in a statement released around Rio’s debut at SXSW. “Reliable knowledge is hard to come by. Only a lucky few get access to fact-checked, verified information. Rio guides you through the news, turning everyday headlines from trusted sources into knowledge. Checking the news with Rio leaves you feeling fulfilled instead of down.”

It’s hard to say if Rio is sticky enough to demand its standalone product, but it’s easy to imagine an interface like this at some point coming to larger news aggregators, like Google News or Apple News, perhaps, or even to individual publishers’ sites. Meanwhile, Curio will also continue to exit with a focus on audio news.

Curio is not the only startup looking to AI to enhance the news reading experience. Former Twitter engineers are building Particle, an AI-powered news reader, backed by $4.4 million. Another AI-powered news app, Bulletin, also launched to tackle clickbait along with offering news summaries. Artifact had also leveraged AI before exiting to TechCrunch’s parent company, Yahoo.

Rio is currently in early access, which means you’ll need an invitation to get in. Otherwise, you can join the app’s waitlist at rionews.ai. The company tells us it plans to launch publicly later this summer. (As a reward for reading to the bottom, five of you can use my own invite link to get in.)

 




Software Development in Sri Lanka

Robotic Automations

Despite complaints, Apple hasn't yet removed an obviously fake app pretending to be RockAuto | TechCrunch


Apple’s App Store isn’t always as trustworthy as the company claims. The latest example comes from RockAuto, an auto parts dealer popular with home mechanics and other DIYers, which is upset that a fake app masquerading as its official app has not been removed from the App Store, despite numerous complaints to Apple.

RockAuto co-founder and president Jim Taylor was first alerted to the situation when customers began complaining about “annoying ads” in its app — something he said “surprised us since we don’t have an app.”

Fake RockAuto app on the App Store. Image Credits: Apple (screen capture by TechCrunch)

“We discovered someone placed an app in the Apple App Store using our logo and company information — but with the misspellings and clumsy graphics typical of phishing schemes,” he told TechCrunch.

On closer inspection, the fake app doesn’t look very legit, but it’s easy to see how someone could be fooled. Its App Store images show a photo of a truck with the word “Heading” across the image as if a template was hastily used and the work was unfinished. In addition, despite being titled “RockAuto” on the App Store, the app refers to itself as “RackAuto” throughout its App Store description.

What’s more, it promises customers that “Your privacy is a top priority” and that “all your data is securely stored and encrypted, giving you peace of mind.” That’s not likely, given the nature of this app.

The issue is not only concerning because of the app’s ability to fool at least some portion of RockAuto’s customers but also because it undermines Apple’s messaging about how the App Store is a trusted and secure marketplace — which is why it demands a cut of developers’ in-app purchase transactions. The tech giant has been fighting back against regulations like the EU’s Digital Markets Act (DMA), by claiming these laws would compromise customer safety and privacy. Apple believes that customers will be at risk if they conduct business outside its App Store with unknown parties. But, as these cases show, bad actors can too easily infiltrate its own app marketplace as well.

Image Credits: Fake RockAuto app on the App Store. Image Credits: Apple (screen capture by TechCrunch)

Apple has so far ignored RockAuto’s requests to remove the fake app, which were all sent through proper channels, according to documentation the company shared with TechCrunch.

While searching for a solution to this problem, RockAuto came across our coverage of a similar situation with LastPass. The password manager was also the victim of a similar scheme when a fake app pretending to be LastPass was live on the App Store for weeks. LastPass eventually had to warn its customers publicly in a blog post, as Apple had not yet taken the fake app down until after the press coverage and LastPass’s own post went live.

Apple didn’t respond to requests for comment at the time. The company wasn’t immediately available for requests for comment about RockAuto’s complaint either.

Taylor says that RockAuto’s Customer Service manager initially reached out to Apple to resolve the situation. When he didn’t get a response, Taylor got involved.

“It’s mostly one-way since the only replies we’ve had from Apple are ‘you shouldn’t have emailed, go use the online form’ and ‘upload screen prints of the app store listing and your trademark registration,’” Taylor explains, both of which RockAuto had already done, its documentation indicates.

“Neither the uploaded documents nor the online form submissions produced any response at all,” Taylor noted, “not even the promised ‘case number in 24 hours’ despite multiple submissions,” he said.

Since filing the complaint on April 18, 2024, RockAuto has shared its trademark registration with Apple, emailed the company, called the number provided on Apple’s copyright infringement page, sent a DMCA Takedown request and filled out Apple’s required forms.

It has not received anything other than automated responses and the fake app remains live as of the time of publication.


Software Development in Sri Lanka

Robotic Automations

Despite complaints, Apple hasn't yet removed an obviously fake app pretending to be RockAuto | TechCrunch


Apple’s App Store isn’t always as trustworthy as the company claims. The latest example comes from  RockAuto, an auto parts dealer popular with home mechanics and other DIYers, which is upset that a fake app masquerading as its official app has not been removed from the App Store, despite numerous complaints to Apple.

RockAuto Co-Founder and President Jim Taylor was first alerted to the situation when customers began complaining about “annoying ads” in its app — something he said “surprised us since we don’t have an app.”

“We discovered someone placed an app in the Apple App Store using our logo and company information — but with the misspellings and clumsy graphics typical of phishing schemes,” he told TechCrunch.

On closer inspection, the fake app doesn’t look very legit, but it’s easy to see how someone could be fooled. Its App Store images show a photo of a truck with the word “Heading” across the image as if a template was hastily used and the work was unfinished. In addition, despite being titled “RockAuto” on the App Store, the app refers to itself as “RackAuto” throughout its App Store description.

What’s more, it promises customers that “Your privacy is a top priority” and that “all your data is securely stored and encrypted, giving you peace of mind.” That’s not likely, given the nature of this app.

The issue is not only concerning because of the app’s ability to fool at least some portion of RockAuto’s customers but also because it undermines Apple’s messaging about how the App Store is a trusted and secure marketplace — which is why it demands a cut of developers’ in-app purchase transactions. The tech giant has been fighting back against regulations like the EU’s Digital Markets Act (DMA), by claiming these laws would compromise customer safety and privacy. Apple believes that customers will be at risk if they conduct business outside its

App Store with unknown parties. But, as these cases show, bad actors can too easily infiltrate its own app marketplace as well.

Image Credits: Fake RockAuto app on the App Store

Apple has so far ignored RockAuto’s requests to remove the fake app, which were all sent through proper channels, according to documentation the company shared with TechCrunch.

While searching for a solution to this problem, RockAuto came across our coverage of a similar situation with LastPass. The password manager was also the victim of a similar scheme when a fake app pretending to be LastPass was live on the App Store for weeks. LastPass eventually had to warn its customers publicly in a blog post, as Apple had not yet taken the fake app down until after the press coverage and LastPass’s own post went live.

Apple didn’t respond to requests for comment at the time. The company wasn’t immediately available for requests for comment about RockAuto’s complaint either.

Taylor says that RockAuto’s Customer Service manager initially reached out to Apple to resolve the situation. When he didn’t get a response, Taylor got involved.

“It’s mostly one-way since the only replies we’ve had from Apple are ‘you shouldn’t have emailed, go use the online form’ and ‘upload screen prints of the app store listing and your trademark registration,’” Taylor explains, both of which RockAuto had already done, its documentation indicates.

“Neither the uploaded documents nor the online form submissions produced any response at all,” Taylor noted, “not even the promised ‘case number in 24 hours’ despite multiple submissions,” he said.

Since filing the complaint on April 18, 2024, RockAuto has shared its trademark registration with Apple, emailed the company, called the number provided on Apple’s copyright infringement page, sent a DMCA Takedown request, and filled out Apple’s required forms.

It has not received anything other than automated responses and the fake app remains live as of the time of publication


Software Development in Sri Lanka

Robotic Automations

TikTok pulls feature from Lite app in EU over addiction concerns | TechCrunch


TikTok suspended a gamification feature in the European Union following an intervention by the bloc. With attention on TikTok’s growing pile of US legal woes, the announcement went mostly unnoticed when it occurred late local time Wednesday.

TikTok’s move came just two days after the EU opened an investigation into a so-called “task and reward” mechanism on the TikTok Lite app, citing concerns over an addictive design that could pose a mental health risk for young people. The feature allows users to earn points for doing things like watching and liking TikTok videos. ByteDance, TikTok’s parent, launched this version of TikTok Lite in France and Spain earlier this month.

Under the EU’s rebooted online governance and content moderation rulebook, the Digital Services Act (DSA), TikTok has a legal obligation to mitigate systemic risks in areas like child safety and mental health. Yet it failed to produce a risk assessment report on the feature when the bloc’s enforcers came knocking.

This is a big deal as the company could face large penalties under the DSA — of up to 6% of its global annual turnover — if it’s found to have broken the EU’s rules.

In a statement posted on X yesterday, TikTok claimed it’s “voluntarily suspending” the rewards feature in the region to address concerns. However, on Monday, the Commission signalled it was preparing to force TikTok’s hand, saying it was minded to use interim measures powers contained in the DSA to close down the app while it conducts an investigation into the feature.

The EU gave TikTok two days to provide arguments against an enforced shutdown. In the event, TikTok opted to preempt enforcement by announcing a “voluntary” suspension.

The development underlines how even the threat of interim enforcement can pack a punch that forces platform giants to rethink. (We’ve seen this sort of thing before in relation to similar powers contained in the bloc’s General Data Protection Regulation for example — such as a decision by Google, back in 2019, to halt human review of audio snippets captured by its voice AI after a data protection authority had informed Google of an intention to use an urgency proceeding to order it to stop processing the data.)

This familiar crisis PR tactic aims to get ahead of the negative publicity associated with an enforced shutdown by taking action ahead of a formal order.

Nonetheless, the EU is taking the win: Responding to TikTok’s announcement with a counter post on X, the bloc’s internal-market-commissioner-cum-internet-sheriff, Thierry Breton, warned: “Our children are not guinea pigs for social media.”

Breton went on to write that he “takes note” of TikTok’s suspension of the reward program for the Lite app in the EU, adding: “The cases against TikTok on the risk of addictiveness of the platform continue.”

TikTok was contacted for confirmation on the status of the TikTok Lite app in France and Spain. As the name suggests, TikTok Lite is an alternative TikTok app for users who have older phones or who mostly connect to 2G or 3G networks.

The EU has two DSA probes open on TikTok: The first, announced back in February, is looking into a broad sweep of suspected non-compliance in areas including addictive design, child protection, ads transparency and data access for researchers. The second, announced earlier this week, is focused on TikTok Lite.

Still, Elon Musk-owned X was the first very large online platform to go under DSA investigation back in December, just a few months after the late August compliance deadline had kicked in. That investigation also remains ongoing.




Software Development in Sri Lanka

Robotic Automations

Security bugs in popular phone-tracking app iSharing exposed users' precise locations | TechCrunch


Last week when a security researcher said he could easily obtain the precise location from any one of the millions of users of a widely used phone-tracking app, we had to see it for ourselves.

Eric Daigle, a computer science and economics student at the University of British Columbia in Vancouver, found the vulnerabilities in the tracking app iSharing as part of an investigation into the security of location-tracking apps. iSharing is one of the more popular location-tracking apps, claiming more than 35 million users to date.

Daigle said the bugs allowed anyone using the app to access anyone else’s coordinates, even if the user wasn’t actively sharing their location data with anybody else. The bugs also exposed the user’s name, profile photo and the email address and phone number used to log in to the app.

The bugs meant that iSharing’s servers were not properly checking that app users were only allowed to access their location data or someone else’s location data shared with them.

Location-tracking apps — including stealthy “stalkerware” apps — have a history of security mishaps that risk leaking or exposing users’ precise location.

In this case, it took Daigle only a few seconds to locate this reporter down to a few feet. Using an Android phone with the iSharing app installed and a new user account, we asked the researcher if he could pull our precise location using the bugs.

“770 Broadway in Manhattan?” Daigle responded, along with the precise coordinates of TechCrunch’s office in New York from where the phone was pinging out its location.

The security researcher pulled our precise location data from iSharing’s servers, even though the app was not sharing our location with anybody else. Image Credits: TechCrunch (screenshot)

Daigle shared details of the vulnerability with iSharing some two weeks earlier but had not heard anything back. That’s when Daigle asked TechCrunch for help in contacting the app makers. iSharing fixed the bugs soon after or during the weekend of April 20-21.

“We are grateful to the researcher for discovering this issue so we could get ahead of it,” iSharing co-founder Yongjae Chuh told TechCrunch in an email. “Our team is currently planning on working with security professionals to add any necessary security measures to make sure every user’s data is protected.”

iSharing blamed the vulnerability on a feature it calls groups, which allows users to share their location with other users. Chuh told TechCrunch that the company’s logs showed there was no evidence that the bugs were found prior to Daigle’s discovery. Chuh conceded that there “may have been oversight on our end,” because its servers were failing to check if users were allowed to join a group of other users.

TechCrunch held the publication of this story until Daigle confirmed the fix.

“Finding the initial flaw in total was probably an hour or so from opening the app, figuring out the form of the requests, and seeing that creating a group on another user and joining it worked,” Daigle told TechCrunch.

From there, he spent a few more hours building a proof-of-concept script to demonstrate the security bug.

Daigle, who described the vulnerabilities in more detail on his blog, said he plans to continue research in the stalkerware and location-tracking area.

Read more on TechCrunch:


To contact this reporter, get in touch on Signal and WhatsApp at +1 646-755-8849, or by email. You can also send files and documents via SecureDrop.


Software Development in Sri Lanka

Robotic Automations

Exclusive: Indaband's new app lets you create music with people around the world


A new social media app called Indaband lets musicians and vocalists collaborate with others and make music with people all over the world. The app is designed to make people who usually play an instrument on their own feel like they’re part of a worldwide band (get it, Indaband?). Record a video of yourself playing an instrument and others can stitch in videos of themselves playing their own instruments on top of your original recording.

All you need to get started on Indaband is a pair of headphones and a smartphone to record yourself. You can choose to upload prerecorded files as new tracks or open the app’s recording booth to record your tracks on top of someone else’s. You can record and mix unlimited video tracks in different sessions using the app’s multitrack video studio and share them with your community. Indaband notifies you when someone collaborates with one of your tracks, so you can see how they added their own take on your content.

The app is the brainchild of CEO Daniel Murta, CTO Andrews Medina, Head of Engineering Helielson Santos and Design Leader Emerson Farias. The co-founders came up with the idea for the app when they were working at a legal technology company called Jusbrasil, which Murta co-founded.

Image Credits: Indaband

They all used to get together to play music during happy hours after work, and once the pandemic hit, they came up with the idea for Indaband so they could still play music together while in quarantine. The group then spent their weekends working on Indaband and eventually ended up leaving Jusbrasil to focus on Indaband full-time.

“Music creation is very hard and involves complex software. So, the whole idea was to redesign this process from scratch and make it simple and out of your smartphone,” Murta told TechCrunch. “The idea was that we would unlock musical expression to a different level to make it simple to collaborate and co-create music.”

Indaband helps users discover songs and jam sessions with daily curated playlists that dive into different genres, like rock, jazz, hip-hop and EDM. Users can like and comment on videos and repost them to their followers.

Indaband plans on launching a new feature called “Circles” that Murta compares to clubs on Strava. Circles will allow users to build their own communities on the app and possibly even hold live events. Indaband may also develop a Patreon-like feature within Circles that would allow established creators to offer paid content. For instance, an established musician could offer virtual lessons on an instrument that they have mastered.

Image Credits: Indaband

While Indaband’s early adopters are skilled musicians who are comfortable sharing their music and recording themselves, Indaband eventually plans to target musicians and singers who are just starting out.

“We want to be known as a place where the musical community flourishes,” Murta said. “There is no place for musical communities right now. So the idea is to be known for that, and our strategy is to make it easy to create, and allow everyone to join the creation process.”

Indaband raised $7 million in seed funding in late 2021. The funding round included several angel investors, including Instagram co-founder Mike Krieger and former Megadeth guitar player Kiko Loureiro. The round also included funding from several Latin American VC firms, including Monashees, Astella and Upload Ventures.

The app is free and is available on iOS and Android.


Software Development in Sri Lanka

Robotic Automations

Biden signs bill that would ban TikTok if ByteDance fails to sell the app | TechCrunch


President Biden has signed a bill that would ban TikTok if its owner, ByteDance, doesn’t sell it within a year. The bill includes aid for Ukraine and Israel. U.S. Senators passed the bill 79-18 on late Tuesday after the House passed it with overwhelming majority over the weekend.

The bill gives ByteDance nine months to divest TikTok, with a 90-day extension, to complete the deal. If ByteDance doesn’t sell TikTok, it would become illegal for app stores to distribute the app.

In an emailed statement to TechCrunch, TikTok said it would challenge the “unconstitutional law” in court.

“We believe the facts and the law are clearly on our side, and we will ultimately prevail,” the statement reads. “The fact is, we have invested billions of dollars to keep U.S. data safe and our platform free from outside influence and manipulation. This ban would devastate 7 million businesses and silence 170 million Americans. As we continue to challenge this unconstitutional ban, we will continue investing and innovating to ensure TikTok remains a space where Americans of all walks of life can safely come to share their experiences, find joy, and be inspired.”

TikTok CEO Shou Zi Chew shared his own video response on Wednesday, calling the news “a disappointing moment” and stating that TikTok “will keep fighting.”

Back in March, the House passed a similar standalone bill to ban TikTok or force its sale with a six-month time limit, but the Senate never took that bill up. This time, the House packaged the TikTok bill with foreign aid to U.S. allies, which essentially forced the Senate to make a decision.

TikTok has spent the last few months arguing that its platform is essential for creators and small businesses in the U.S. A few weeks ago, the company released an economic impact report revealing that TikTok generated $14.7 billion for small to mid-sized companies in the U.S.

This story is developing…




Software Development in Sri Lanka

Robotic Automations

Fintech gaming startup Sanlo’s webshop tool could help developers avoid costly app store fees | TechCrunch


Sanlo, a fintech startup that helps gaming companies manage finances, announced Wednesday the closed beta launch of its webshop tool, giving select game developers and studios a plug-in-play solution that works alongside their existing tech stacks. Gaming companies can join the waitlist starting today.

With Google and Apple charging a 30% fee for in-app purchases (IAPs), it’s more challenging than ever for small- to mid-size gaming companies to run profitable businesses. Gaming giant Epic has complained about Apple’s revenue cut for years now, accusing it of being predatory toward smaller businesses.

As a result, many mobile game developers are no longer relying on app stores for monetization and are turning to external webshops, a rising trend in gaming where companies can run stores on their own websites for a much lower fee (around 4-10%). Plus, webshops are believed to boost revenue since players buy directly from the gaming company, as opposed to app stores taking a portion of the sales. In fact, Sanlo said developers can earn up to 25% additional revenue with a webshop.

“A workshop is one of those super tactical steps that actually proved to show that you can implement revenue from,” Sanlo co-founder and CEO Olya Caliujnaia told TechCrunch. “The reason being that it’s usually your most engaged, loyal players who go to the webshop and they get special offers that allow them to do better in the game.”

Image Credits: Sanlo

With Sanlo’s new webshop tool, game developers get a range of promotional mechanics like exclusive digital items, bundle packs, discounted offers, and loyalty programs to incentivize more players to try the game. Developers can also access player data so they can monitor profiles and purchase activity in order to target individual users with compelling offers.

Companies can test and set pricing “with no price caps,” according to Sanlo. Earnings from webshop sales are deposited into the developer’s account once a week.

One downside about webstores is that Apple and Google don’t let mobile games advertise them in-app. Sanlo offers marketing tools as a solution to this issue, such as in-game prompts to promote the webshop, sending emails to returning visitors, and ROAS (Return on Ad Spend) attribution tracking.

Sanlo has onboarded an undisclosed number of gaming companies to its webshop platform, including Fusebox Games, the developer behind mobile titles inspired by “Love Island” IP.

“The biggest attraction for me was the plug-and-play nature of the Sanlo tool in addition to the hands-on service they provide,” Terry Lee, COO at Fusebox, told us. “We are a small company without the internal resources to cover all the bases when it comes to supporting a whole new technical capability.”

Sanlo plans to officially launch the new product to all developers this summer.

Caliujnaia and William Liu (CTO) founded Sanlo in 2020. The company’s team touts having previous experience at Sony PlayStation, Electronic Arts, Visa, Facebook, Capital One, Earnest, SigFig, and more.

To date, the company has raised $13.5 million in total funding, and is backed by Initial Capital, Portage Ventures, XYZ Venture Capital, London Venture Partners, Index Ventures, and Konvoy.

Webstore solutions have existed for years now, from more established companies like Xsolla to newer entrants like Appcharge. Popular games leveraging webshops include Clash of Clans, Marvel Strike Force, Game of Thrones: Conquest, and Star Trek Fleet Command.


Software Development in Sri Lanka

Robotic Automations

X is launching a TV app for videos 'soon' | TechCrunch


X, the company formerly known as Twitter, is launching a dedicated TV app for videos uploaded to the social network soon. X CEO Linda Yaccarino announced on Tuesday that the new app will bring “real-time, engaging content to your smart TVs.” The app’s interface looks quite similar to YouTube’s, as seen in a teaser video shared by Yaccarino.

The app will feature a trending video algorithm that is designed to help users stay updated with tailored popular content, along with AI-powered topics that will organize videos by subject. The app will also support cross-device viewing, which means you can start watching a video on your phone and then continue watching it on your TV.

Yaccarino says the app will feature enhanced video search and be available on “most smart TVs.” Although there isn’t an official launch date for the app, the executive says it will be available “soon.”

The upcoming app launch is part of Yaccarino’s efforts to turn the social media site into a free-speech “video first” platform. The social network currently features an original show hosted by former congresswoman Tulsi Gabbard and another by former Fox Sports host Jim Rome. Last month, Musk canceled a talk show deal with former CNN anchor Don Lemon after he was interviewed for the first episode of the show.

The announcement comes a week after Truth Social, the social media platform owned by Donald Trump’s media company, also unveiled its plans to launch a live TV streaming platform. The platform will focus on “news networks” and “religious channels,” along with “ content that has been canceled” or “is being suppressed on other platforms and services,” the company had said.




Software Development in Sri Lanka

Robotic Automations

US government says security flaw in Chirp Systems' app lets anyone remotely control smart home locks | TechCrunch


A vulnerability in a smart access control system used in thousands of U.S. rental homes allows anyone to remotely control any lock in an affected home. But Chirp Systems, the company that makes the system, has ignored requests to fix the flaw.

U.S. cybersecurity agency CISA went public with a security advisory last week saying that the phone apps developed by Chirp, which residents use in place of a key to access their homes, “improperly stores” hardcoded credentials that can be used to remotely control any Chirp-compatible smart lock.

Apps that rely on passwords stored in its source code, known as hardcoding credentials, are a security risk because anyone can extract and use those credentials to perform actions that impersonate the app. In this case, the credentials allowed anyone to remotely lock or unlock a Chirp-connected door lock over the internet.

In its advisory, CISA said that successful exploitation of the flaw “could allow an attacker to take control and gain unrestricted physical access” to smart locks connected to a Chirp smart home system. The cybersecurity agency gave the vulnerability severity score of 9.1 out of a maximum of 10 for its “low attack complexity” and for its ability to be remotely exploited.

The cybersecurity agency said Chirp Systems has not responded to either CISA or the researcher who found the vulnerability.

Security researcher Matt Brown told veteran security journalist Brian Krebs that he notified Chirp of the security issue in March 2021 but that the vulnerability remains unfixed.

Chirp Systems is one of a growing number of companies in the property tech space that provide keyless access controls that integrate with smart home technologies to rental giants. Rental companies are increasingly forcing renters to allow the installation of smart home equipment as dictated by their leases, but it’s murky at best who takes responsibility or ownership when security problems arise.

Real estate and rental giant Camden Property Trust signed a deal in 2020 to roll out Chirp-connected smart locks to more than 50,000 units across over a hundred properties. It’s unclear if affected properties like Camden are aware of the vulnerability or have taken action. Kim Callahan, a spokesperson for Camden, did not respond to a request for comment.

Chirp was bought by property management software giant RealPage in 2020, and RealPage was acquired by private equity giant Thoma Bravo later that year in a $10.2 billion deal. RealPage is facing several legal challenges over allegations its rent-setting software uses secret and proprietary algorithms to help landlords raise the highest possible rents on tenants.

Neither RealPage nor Thoma Bravo have yet to acknowledge the vulnerabilities in the software it acquired, nor say if they plan on notifying affected residents of the security risk.

Jennifer Bowcock, a spokesperson for RealPage, did not respond to requests for comment from TechCrunch. Megan Frank, a spokesperson for Thoma Bravo, also did not respond to requests for comment.


Software Development in Sri Lanka

Back
WhatsApp
Messenger
Viber