Two students discovered a security flaw in over a million internet-connected laundry machines that could allow laundry for free.
CSC ServiceWorks is a company that provides laundry services and air vending solutions for multifamily housing, academic institutions, hospitality, and other commercial sectors. They manage and operate many internet-connected laundry machines and systems, offering services such as coin and card-operated laundry machines, mobile payment solutions, and maintenance support.
Two students, Alexander Sherbrooke and Iakov Taranenko, from UC Santa Cruz discovered a vulnerability impacting over a million internet-connected laundry machines used in residences and college campuses worldwide. A remote attacker can exploit this vulnerability to remotely send commands to the laundry machines, allowing laundry for free. The duo reported the flaw to the vendor earlier this year, but they claim the company has yet to fix it.
“UC Santa Cruz students Alexander Sherbrooke and Iakov Taranenko told TechCrunch that the vulnerability they discovered allows anyone to remotely send commands to laundry machines run by CSC and operate laundry cycles for free.” reported TechCrunch.
Sherbrooke explained that he was sitting in his basement laundry room in January when he ran a script from his laptop that instructed the laundry machine to start a cycle despite having no funds in his account. The machine immediately responded with a loud beep and displayed “PUSH START,” indicating it was ready to wash a free load of laundry.
Sherbrooke and Taranenko were also able to add several million dollars to their laundry account which can be managed through the CSC Go mobile app.
The duo sent the company several messages through its online contact form, but the vendor never contacted them.
Then the two students reported the issue to the CERT Coordination Center at Carnegie Mellon University.
The CERT notified affected vendors that addressed the issue. However, after the researchers reported their findings, CSC quietly reset their account balance of several million dollars.
The vulnerability resides in the API used by CSC’s mobile app, CSC Go. The two students discovered that the app lacks security checks and mutual authentication between the app and the CSC’s servers. The experts also discovered that it is possible to send commands to CSC’s servers that are unavailable through the app itself.
The access to the API allowed the researchers to enumerate the list of commands supported by CSC’s servers. Another aspect to consider is that it is quite simple for remote attackers to locate laundry machines and send commands to them.
Taranenko was disappointed that CSC did not acknowledge the vulnerability.
“CSC quietly wiped out the researchers’ account balance of several million dollars after they reported their findings, but the researchers said the bug remains unfixed and it’s still possible for users to “freely” give themselves any amount of money.” concludes TechCrunch.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, laundry machines)
