this post was submitted on 20 May 2024
379 points (98.0% liked)

Technology

60000 readers
2827 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 2 years ago
MODERATORS
top 50 comments
sorted by: hot top controversial new old
[–] Sanctus 144 points 7 months ago (2 children)

Bro don't fucken tell the company wtf.

[–] [email protected] 20 points 7 months ago (11 children)

That's how it works in security. It is unethical to not give the company time to react before public disclosure.

[–] [email protected] 13 points 7 months ago (2 children)

Dont disclose it. Let people who cant afford wash their clothes

load more comments (2 replies)
load more comments (10 replies)
[–] piecat 13 points 7 months ago

Fucking it up for the rest of us

[–] ATDA 132 points 7 months ago (2 children)

His hat is only white because he got to test this a bunch before exposing the vulnerability.

[–] [email protected] 15 points 7 months ago

HEAR YE HEAR YE! best comment here! Hahaha

[–] Potatos_are_not_friends 12 points 7 months ago (1 children)

When I found a loophole for cheap Wendy's food, I absolutely abused it a dozen times as a poor college student. It involves receipts and going to different Wendy's.

[–] ATDA 5 points 7 months ago

Hey I think every white hat deserves some leniency in their Robin Hooding haha.

[–] Tronn4 70 points 7 months ago (4 children)

In this case this is fucked up. Let people wash dammit

[–] [email protected] 102 points 7 months ago* (last edited 7 months ago) (2 children)

Not the same company, but I live in apartments with washer/dryers like this. Coin op entirely removed.

You have to have a device that is bluetooth capable to use them.

Anyway pretty sure someone in this apartment has figured out something similar because the machines keep magically becoming unpaid machines after they get serviced. After each service, they will be asking for money to be able to be used for like a day or so, but then soon enough, I'll go back to the laundry room and all the machines will be free and not asking for money. Just ready to go, no device required.

Originally, I thought it was the company disabling them due to like a data breach or something and was trying to find out if there was an undisclosed data leak and/or a class action lawsuit brewing. Since neither of those are the case, I'm pretty sure it's a Notorious Do-Gooder.

So, thanks, Notorious Do-Gooder, for all the free washes and drys.

(Especially since this same idea crossed my mind over a year ago but I've just been too lazy to view the bluetooth data traffic myself)

[–] [email protected] 18 points 7 months ago (1 children)

You're welcome, how's the free cable too by the way?

[–] pdxfed 7 points 7 months ago (1 children)

Good, hope you're enjoying the Internet on "Pretty_Fly_For_A_WIFI" open network

load more comments (1 replies)
[–] potpotato 6 points 7 months ago (2 children)

Saw a video that showed using swizzle sticks jammed into the coin slots to release the lock and get free laundry.

I had bike spokes laying around and tried it. It worked, but actually broke the coin slots. Management reconfig’d to other slots, which I then broke.

Laundry was only 25 cents if you knew which slot to put a quart into.

[–] [email protected] 16 points 7 months ago* (last edited 7 months ago)

Around 2007 or so I used to unplug Coinstar machines from the internet (plug was usually right in back) and then put in all my coins and try to redeem an online gift card. It used to be you could only get all of your cash back via online gift cards, because the machine took out a fee to give your money back in cash.

When it couldn't connect to the internet, it would apologize and refund me in cash, with no convenience fee (since I was clearly inconvenienced). Full amount returned.

[–] [email protected] 4 points 7 months ago (2 children)

You were supposed to use plastic coffee straws not a hard piece of metal. Turn a $1 bag of 100 straws into $25-$100 in laundry change depending on how much your reuse the straws.

load more comments (2 replies)
load more comments (3 replies)
[–] [email protected] 69 points 7 months ago (1 children)

Fun.

From the article, the linked Swagger docs : https://web.archive.org/web/20240120071238/https://mycscgo.com/api/v1/docs/static/index.html#/

And a little more detailed account : https://timesofindia.indiatimes.com/technology/tech-news/how-this-security-bug-in-washing-machines-can-help-college-students-in-the-us-do-free-laundry/articleshow/110277923.cms

It looks like these laundry machines are controlled by a mobile app, and requests are routed through The Internet(tm). The flaw appears to be the web service presumes a user is only able to gain access to their API endpoints via the mobile app, which only exposes certain functions to a user.

Once authorized, though, there's no further checks like oauth scopes or even user roles, to prevent someone from doing a little bit of lateral movement to admin-style endpoints.

Lazy. The machine makers should be ashamed.

[–] anakin78z 22 points 7 months ago

I once took over an app that worked like this. Access to one thing? Access to everything! And they had a hard coded admin password in the server code. 🤦 The client wasn't happy when I proposed a complete rewrite. Eventually my manager begged me to stop working with them, so we did.

[–] ChickenLadyLovesLife 37 points 7 months ago (4 children)

I (white boy) visited India in the early '90s and brought back a bunch of rolls of half-Rupee coins as souvenirs. Turns out they were the exact same weight and diameter as US quarters (even down to the number of ridges, which makes me suspect India bought a bunch of used US minting machines to make them), so I started using them at laundromats. The exchange rate at the time was 35 Rs to the dollar, so a load in the US that normally cost $1 was costing me less than 6 cents. I do feel bad for the harassment that actual Indian customers probably ended up receiving, although possibly the owners never noticed or cared.

load more comments (4 replies)
[–] [email protected] 31 points 7 months ago (3 children)

I used to go to a laundromat that used something like a smartcard to keep your balance. You'd refill it at the kiosk and swipe it at the washer/dryer.

I had a reader/writer around somewhere from a few years prior, when I was messing around with old Echostar boxes.

Wish I could have found it. Those machines didn't look to be connected to anything. I didn't see any wireless networks in the area and the equipment didn't have any data lines.

I'm almost willing to bet the balance was stored as an value on the card and gets read/rewritten with every swipe, and essentially just security-through-obscurity. Meaning I could either back up and rewrite a $20 card forever, or rewrite the balance to having FF credits or whatever.

[–] [email protected] 12 points 7 months ago* (last edited 7 months ago) (10 children)

It could be simply obscure like you say, but the absence of a network doesn't guarantee it's that easy to hack.

They could use a checksum and your trick would invalidate the card until you figured out the correct algorithm, which would require a new visit to the laundromat for every new attempt, so basically impractical.

That or the card is just simply encrypted, which would make it impossible to interpret. It would be easy to implement too because the shared secret is between machines that are all physically controlled by the laundromat.

[–] [email protected] 10 points 7 months ago (4 children)

If there's no central control or ledger, couldn't you just rewrite the card with the original values and the machines wouldn't know any difference?

[–] [email protected] 5 points 7 months ago

Oh yeah, that's true, so you wouldn't have destroyed the card, but it's not a useful hack if they've done even the most basic security measures.

That said, I would be fascinated to know what was on that card. I'd give it pretty good odds of having absolutely no security measures whatsoever.

load more comments (3 replies)
[–] [email protected] 4 points 7 months ago

A simple encryption key would make the most sense. It wouldn't even need to be that complex. All you would need is a way to verify the card and then another one that represents the number. You probably could just use some primes.

load more comments (8 replies)
[–] [email protected] 10 points 7 months ago (2 children)

There also is a point of cost. They aren't going to spend a bunch of money securing a laundromat. If they spend a bunch of money left and right your laundry fees would be pricy. Not to mention a laundryman isn't exactly a high profit business.

load more comments (2 replies)
load more comments (1 replies)
[–] PM_Your_Nudes_Please 31 points 7 months ago (3 children)

Here’s a reminder that most washing machines use a universal key, which you can buy online for like $5. You can just pop it open and hit the little “coin inserted” switch to make it think you paid.

[–] EncryptKeeper 20 points 7 months ago (1 children)

Just hope they don’t have cameras.

[–] surewhynotlem 8 points 7 months ago

Steal those too

load more comments (2 replies)
[–] [email protected] 29 points 7 months ago (1 children)
[–] [email protected] 5 points 7 months ago (1 children)

But have you thought about the owner?

[–] [email protected] 10 points 7 months ago (1 children)
[–] [email protected] 3 points 7 months ago (3 children)

I'm pretty sure a laundromat is not a high profit business. I'd imagine the money is fairly tight.

load more comments (3 replies)
[–] [email protected] 17 points 7 months ago (1 children)

The west has fallen, millions must do laundry for free.

[–] postmateDumbass 11 points 7 months ago (1 children)

That company is really getting taken to the cleaners.

load more comments (1 replies)
[–] Gumbyyy 17 points 7 months ago (1 children)

I had free laundry for most of my freshman year of college. We had coin operated machines, and somebody quickly figured out that you can strip 2 wires and just touch them together, or touch a coin to both of them, and every time you did that the machine would think a coin had been inserted. Eventually the college caught on and one day I went down there and all the machines were taken apart with maintenance guys working on them, and after that there was a heavy duty housing for the coin acceptor with no exposed wires. It was nice while it lasted!

load more comments (1 replies)
[–] [email protected] 8 points 7 months ago (1 children)

This is the best summary I could come up with:


That’s because of a vulnerability that two University of California, Santa Cruz students found in internet-connected washing machines in commercial use in several countries, according to TechCrunch.

The two students, Alexander Sherbrooke and Iakov Taranenko, apparently exploited an API for the machines’ app to do things like remotely command them to work without payment and update a laundry account to show it had millions of dollars in it.

CSC never responded when Sherbrooke and Taranenko reported the vulnerability via emails and a phone call in January, TechCrunch writes.

That includes that the company has a published list of commands, which the two told TechCrunch enables connecting to all of CSC’s network-connected laundry machines.

CSC’s vulnerability is a good reminder that the security situation with the internet of things still isn’t sorted out.

For the exploit the students found, maybe CSC shoulders the risk, but in other cases, lax cybersecurity practices have made it possible for hackers or company contractors to view strangers’ security camera footage or gain access to smart plugs.


The original article contains 294 words, the summary contains 171 words. Saved 42%. I'm a bot and I'm open source!

[–] [email protected] 7 points 7 months ago (2 children)

Sherbrooke and Taranenko reported the vulnerability

Finks >:(

[–] cm0002 10 points 7 months ago

Forreal, I highly doubt CSC has a big bounty program so why did they even bother? Guaranteed they were the "Teacher you forgot our homework" kids

[–] [email protected] 6 points 7 months ago (1 children)

Honestly, in this case, the company in question are even bigger finks because they don't actually care about fixing a vulnerability that could cost them money.

If that speaks to their security practices, well... Let's just say I wouldn't be surprised if customer data was all in an unsecured, unencrypted, plain-text Microsoft Word document.

[–] [email protected] 5 points 7 months ago (1 children)

Im very amused at it being in word rather than .xlsx or .txt, like them going out if their way to make it worse because word is all they know.

[–] [email protected] 5 points 7 months ago

"But word is a text file."

[–] [email protected] 7 points 7 months ago* (last edited 7 months ago)

There used to be this music festival in my college town and they liked to charge absurd money for "tokens" to use at the vendors. I didn't use all of them but I found they worked in the parking meters (I think they detected as slugs, because they immediately gave me an hour and flashed the meter) but nobody in the city bothered to ticket me for it. I dunno, I felt kinda bad but at the same time, I don't like to parallel park.

For what its worth, I paid more for the tokens than I ever did parking.

[–] [email protected] 6 points 7 months ago* (last edited 7 months ago) (1 children)

I've never heard of CSC, only Coinamatic in every commercially run residential coin laundry I have seen (in Canada). They run on coins or chip cards.

load more comments (1 replies)
load more comments
view more: next ›