\n<\/p>\n
A pair of university students say they found and reported earlier this year a security flaw allowing anyone to avoid paying for laundry provided by over a million internet-connected laundry machines in residences and college campuses around the world.<\/p>\n
Months later, the vulnerability remains open after the vendor, CSC ServiceWorks, repeatedly ignored requests to fix the flaw.<\/p>\n
UC Santa Cruz students Alexander Sherbrooke and Iakov Taranenko told TechCrunch that the vulnerability they discovered allows anyone to remotely send commands to laundry machines run by CSC and operate laundry cycles for free.<\/p>\n
Sherbrooke said he was sitting on the floor of his basement laundry room in the early hours one January morning with his laptop in hand, and \u201csuddenly having an \u2018oh s\u2014\u2019 moment.\u201d From his laptop, Sherbrooke ran a script of code with instructions telling the machine in front of him to start a cycle despite having $0 in his laundry account. The machine immediately woke up with a loud beep and flashed \u201cPUSH START\u201d on its display, indicating the machine was ready to wash a free load of laundry.\u00a0<\/p>\n
In another case, the students added an ostensible balance of several million dollars into one of their laundry accounts, which reflected in their CSC Go mobile app<\/a> as though it were an entirely normal amount of money for a student to spend on laundry.<\/p>\n CSC ServiceWorks is a large laundry service company, touting a network<\/a> of over a million laundry machines installed in hotels, university campuses, and residences across the United States, Canada and Europe.<\/p>\n Since CSC ServiceWorks does not have a dedicated security page for reporting security vulnerabilities, Sherbrooke and Taranenko sent the company several messages through its online contact form during January, but heard nothing back from the company. A phone call to the company landed them nowhere either, they said.\u00a0<\/p>\n The students also sent their findings to the CERT Coordination Center at Carnegie Mellon University, which helps security researchers disclose flaws to affected vendors and provide fixes and guidance to the public.<\/p>\n The students are now revealing more about their findings after waiting longer than the customary three months that security researchers typically grant vendors to fix flaws before going public. The pair first disclosed their research in a presentation at their university cybersecurity club<\/a> earlier in May.<\/p>\n It\u2019s unclear who, if anyone, is responsible for cybersecurity at CSC, and representatives for CSC did not respond to TechCrunch\u2019s requests for comment.<\/p>\n The student researchers said the vulnerability is in the API used by CSC\u2019s mobile app, CSC Go<\/a>. An API allows apps and devices to communicate with each other over the internet. In this case, the customer opens the CSC Go app to top up their account with funds, pay, and begin a laundry load on a nearby machine.<\/p>\n Sherbrooke and Taranenko discovered that CSC\u2019s servers can be tricked into accepting commands that modify their account balances because any security checks are done by the app on the user\u2019s device and automatically trusted by CSC\u2019s servers. This allows them to pay for laundry without actually putting real funds in their accounts.\u00a0<\/p>\n By analyzing the network traffic while logged in and using the CSC Go app, Sherbrooke and Taranenko found they could circumvent the app\u2019s security checks and send commands directly to CSC\u2019s servers, which are not available through the app itself.\u00a0<\/p>\n Technology vendors like CSC are ultimately responsible for making sure their servers are performing the proper security checks, otherwise it\u2019s akin to having a bank vault protected by a guard who doesn\u2019t bother to check who is allowed in.<\/p>\n The researchers said potentially anyone can create a CSC Go user account and send commands using the API because the servers are also not checking if new users owned their email addresses. The researchers tested this by creating a new CSC account with a made-up email address.<\/p>\n