\n<\/p>\n
A security lapse could let millions of college students do free laundry, thanks to one company. That\u2019s because of a vulnerability that two University of California, Santa Cruz students found in internet-connected washing machines in commercial use in several countries, according to TechCrunch<\/em><\/a>.<\/p>\n<\/div>\n The two students, Alexander Sherbrooke and Iakov Taranenko, apparently exploited an API for the machines\u2019 app to do things like remotely command them to work without payment and update a laundry account to show it had millions of dollars in it. The company that owns the machines, CSC ServiceWorks, claims to have more than a million laundry and vending machines<\/a> in service at colleges, multi-housing communities, laundromats, and more in the US, Canada, and Europe.<\/p>\n<\/div>\n CSC never responded when Sherbrooke and Taranenko reported the vulnerability via emails and a phone call in January, TechCrunch <\/em>writes. Despite that, the students told the outlet that the company \u201cquietly wiped out\u201d their false millions after they contacted it.<\/p>\n<\/div>\n The lack of response led them to tell others about their findings. That includes that the company has a published list of commands<\/a>, which the two told TechCrunch <\/em>enables connecting to all of CSC\u2019s network-connected laundry machines. CSC ServiceWorks didn\u2019t immediately respond to The Verge\u2019<\/em>s request for comment. <\/p>\n<\/div>\n CSC\u2019s vulnerability is a good reminder that the security situation with the internet of things still isn\u2019t sorted out. For the exploit the students found, maybe CSC shoulders the risk, but in other cases, lax cybersecurity practices have made it possible for hackers or company contractors to view strangers\u2019 security<\/a> camera footage<\/a> or gain access to smart plugs<\/a>. <\/p>\n<\/div>\n