Home > News

Security Bug Found in Commercial Connected Laundry Machines

By Laura Tucker
Laundry Machines Security Bug Featured

It can’t be said enough: if an object can be connected, it carries a security risk. Even commercial connected laundry machines have been found to be carrying a major security bug that allowed anyone to send commands remotely to the machines.

Tip: want to keep your PC protected? Try these Windows settings for free PC protection.

Two Students Find Security Bug in Laundry Machines

This issue was first found by two Califiornia college students, Alexander Sherbrooke and Iakov Taranenko. The former was sitting in the basement laundry room in January while on his laptop, trying to build an app to track the status of the laundry machines. He started to think about it, then ran some code instructions to one of the laundry machines to start a cycle, even though he had no balance in his laundry account. The machine started up and showed the message “Push Start.”

Laundry Machines Security Bug Man Waiting
Image source: Unsplash

He and his friend tried adding a fake balance of 13 million dollars into a laundry account. It was detected in the machine’s mobile app as though he’d really deposited it. These vulnerabilities could lead to many things, but they could certainly allow students, or anyone, for that matter – to do their laundry for free.

FYI: learn what the Windows Security button is and how to use it.

Laundry Machines Security Bug Reported

Students Sherbrooke and Taranenko reported their findings to CSC ServiceWorks, a laundry service company that operates the machines. The company manages a network of more than a million of these machines that are found in hotels, universities, and residences in the United States, Canada, and Europe.

They couldn’t find a dedicated security page to report such things, so they sent several messages to an online contact form but never heard back from the company. It was also reported to the CERT Coordination Center at Carnegie Mellon University. CERT helps disclose security flaws.

Laundry Machines Security Bug Commercial Connected Machines
Image source: Unsplash

It was noticed that commands could be sent to the machines’ servers, as security checks are on the user’s device in the app. CSC’s servers trust them with no questions asked. Once they looked at the network traffic, the two students found that they could get around the security checks and send the commands to the service. Email addresses used to create an account with the app also aren’t verified.

After the customary three months of waiting for the CSC to do something before going public with it, Sherbrooke and Taranenko are revealing more. They believe the vulnerability is in the API for the mobile app. CSC hasn’t done anything to fix the app, but they did wipe out the larger fake bank balance. However, smaller amounts of $50 to $100 remain in the account.

It needs to be noted that this security issue is on the entire network of devices – not just the ones at that particular college campus. That’s where it’s worrisome. If laundry machines have that security bug, think of how many other connected objects, that would otherwise be innocuous, have a security vulnerability. Read on to learn how to protect your privacy and security on Android.

Image credit: Unsplash

Subscribe to our newsletter!

Our latest tutorials delivered straight to your inbox

Laura Tucker Avatar
Laura Tucker
Laura has spent more than 20 years writing news, reviews, and op-eds, with the majority of those years as an editor as well. She has exclusively used Apple products for the past 35 years. In addition to writing and editing at MTE, she also runs the site’s sponsored review program.

Read next

When you tilt a smartphone, gravity shifts microscopic silicon fingers inside its accelerometer by only a few nanometres, changing the capacitance between them and producing the electrical imbalance the phone reads as a new direction for down
The GPS satellites orbiting 20,200 kilometres overhead run their clocks about 38 microseconds faster per day than clocks on the ground — without Einstein's relativity correcting for it, GPS would drift by roughly 10 kilometres every 24 hours
The GPS satellites orbiting 20,200 kilometres overhead run their clocks about 38 microseconds faster per day than clocks on the ground — without Einstein’s relativity correcting for it, GPS would drift by roughly 10 kilometres every 24 hours
Octopuses possess roughly 500 million neurons distributed across their body, with two-thirds located in their arms rather than their central brain, meaning each arm can taste, problem-solve, and react to stimuli independently of whatever the octopus is otherwise paying attention to.
Explore the historic Roman bridge in lush Salamanca, Spain captured beautifully in daylight.
The Roman aqueduct at Segovia, built around the first century AD without mortar, still carried water into the 1970s, its 167 granite arches held together by nothing but the precise weight distribution of stones cut to fit each other within fractions of a millimeter.
When the SS Great Eastern laid the first working transatlantic telegraph cable in 1866, a message that had taken ten days by steamship suddenly crossed the ocean in minutes, and the financial markets of London and New York were forced, within a single trading week, to invent the modern concept of synchronised global price.
From below of blue starry sky over radio telescope and trees with leaves
The Big Ear telescope was scanning at 1420.4056 megahertz on the night of 15 August 1977, the exact frequency at which hydrogen atoms vibrate across the universe, because Giuseppe Cocconi and Philip Morrison had argued years earlier that any species trying to be found would broadcast on that channel — and then, for 72 seconds, something did.
In 2016, archaeologists dated two rings of snapped stalagmites in France’s Bruniquel Cave to 176,500 years ago, evidence that Neanderthals had walked 336 metres into darkness with fire and built architecture deep underground long before modern humans reached Europe
Otto von Bismarck was 74 when Germany adopted the world’s first national old-age social insurance program in 1889, setting the pension age at 70 after years of fighting socialists with bans, laws, and a promise few workers would live long enough to use