Technology

Bro don't fucken tell the company wtf.

His hat is only white because he got to test this a bunch before exposing the vulnerability.

In this case this is fucked up. Let people wash dammit

Fun.

From the article, the linked Swagger docs : https://web.archive.org/web/20240120071238/https://mycscgo.com/api/v1/docs/static/index.html#/

And a little more detailed account : https://timesofindia.indiatimes.com/technology/tech-news/how-this-security-bug-in-washing-machines-can-help-college-students-in-the-us-do-free-laundry/articleshow/110277923.cms

It looks like these laundry machines are controlled by a mobile app, and requests are routed through The Internet(tm). The flaw appears to be the web service presumes a user is only able to gain access to their API endpoints via the mobile app, which only exposes certain functions to a user.

Once authorized, though, there's no further checks like oauth scopes or even user roles, to prevent someone from doing a little bit of lateral movement to admin-style endpoints.

Lazy. The machine makers should be ashamed.

I (white boy) visited India in the early '90s and brought back a bunch of rolls of half-Rupee coins as souvenirs. Turns out they were the exact same weight and diameter as US quarters (even down to the number of ridges, which makes me suspect India bought a bunch of used US minting machines to make them), so I started using them at laundromats. The exchange rate at the time was 35 Rs to the dollar, so a load in the US that normally cost $1 was costing me less than 6 cents. I do feel bad for the harassment that actual Indian customers probably ended up receiving, although possibly the owners never noticed or cared.

Here’s a reminder that most washing machines use a universal key, which you can buy online for like $5. You can just pop it open and hit the little “coin inserted” switch to make it think you paid.

I used to go to a laundromat that used something like a smartcard to keep your balance. You'd refill it at the kiosk and swipe it at the washer/dryer.

I had a reader/writer around somewhere from a few years prior, when I was messing around with old Echostar boxes.

Wish I could have found it. Those machines didn't look to be connected to anything. I didn't see any wireless networks in the area and the equipment didn't have any data lines.

I'm almost willing to bet the balance was stored as an value on the card and gets read/rewritten with every swipe, and essentially just security-through-obscurity. Meaning I could either back up and rewrite a $20 card forever, or rewrite the balance to having FF credits or whatever.

God forbid

The west has fallen, millions must do laundry for free.

I had free laundry for most of my freshman year of college. We had coin operated machines, and somebody quickly figured out that you can strip 2 wires and just touch them together, or touch a coin to both of them, and every time you did that the machine would think a coin had been inserted. Eventually the college caught on and one day I went down there and all the machines were taken apart with maintenance guys working on them, and after that there was a heavy duty housing for the coin acceptor with no exposed wires. It was nice while it lasted!

This is the best summary I could come up with:

That’s because of a vulnerability that two University of California, Santa Cruz students found in internet-connected washing machines in commercial use in several countries, according to TechCrunch.

The two students, Alexander Sherbrooke and Iakov Taranenko, apparently exploited an API for the machines’ app to do things like remotely command them to work without payment and update a laundry account to show it had millions of dollars in it.

CSC never responded when Sherbrooke and Taranenko reported the vulnerability via emails and a phone call in January, TechCrunch writes.

That includes that the company has a published list of commands, which the two told TechCrunch enables connecting to all of CSC’s network-connected laundry machines.

CSC’s vulnerability is a good reminder that the security situation with the internet of things still isn’t sorted out.

For the exploit the students found, maybe CSC shoulders the risk, but in other cases, lax cybersecurity practices have made it possible for hackers or company contractors to view strangers’ security camera footage or gain access to smart plugs.

The original article contains 294 words, the summary contains 171 words. Saved 42%. I'm a bot and I'm open source!

There used to be this music festival in my college town and they liked to charge absurd money for "tokens" to use at the vendors. I didn't use all of them but I found they worked in the parking meters (I think they detected as slugs, because they immediately gave me an hour and flashed the meter) but nobody in the city bothered to ticket me for it. I dunno, I felt kinda bad but at the same time, I don't like to parallel park.

For what its worth, I paid more for the tokens than I ever did parking.

I've never heard of CSC, only Coinamatic in every commercially run residential coin laundry I have seen (in Canada). They run on coins or chip cards.

I see no problem here