A pair of university students say they found and reported earlier this year a security flaw allowing anyone to avoid paying for laundry provided by over a million internet-connected laundry machines in residences and college campuses around the world.

Months later, the vulnerability remains open after the vendor, CSC ServiceWorks, repeatedly ignored requests to fix the flaw.

UC Santa Cruz students Alexander Sherbrooke and Iakov Taranenko told TechCrunch that the vulnerability they discovered allows anyone to remotely send commands to laundry machines run by CSC and operate laundry cycles for free.

Sherbrooke said he was sitting on the floor of his basement laundry room in the early hours one January morning with his laptop in hand, and “suddenly having an ‘oh s—’ moment.” From his laptop, Sherbrooke ran a script of code with instructions telling the machine in front of him to start a cycle despite having $0 in his laundry account. The machine immediately woke up with a loud beep and flashed “PUSH START” on its display, indicating the machine was ready to wash a free load of laundry. 

In another case, the students added an ostensible balance of several million dollars into one of their laundry accounts, which reflected in their CSC Go mobile app as though it were an entirely normal amount of money for a student to spend on laundry.

CSC ServiceWorks is a large laundry service company, touting a network of over a million laundry machines installed in hotels, university campuses, and residences across the United States, Canada and Europe.

Since CSC ServiceWorks does not have a dedicated security page for reporting security vulnerabilities, Sherbrooke and Taranenko sent the company several messages through its online contact form during January, but heard nothing back from the company. A phone call to the company landed them nowhere either, they said. 

The students also sent their findings to the CERT Coordination Center at Carnegie Mellon University, which helps security researchers disclose flaws to affected vendors and provide fixes and guidance to the public.

The students are now revealing more about their findings after waiting longer than the customary three months that security researchers typically grant vendors to fix flaws before going public. The pair first disclosed their research in a presentation at their university cybersecurity club earlier in May.

It’s unclear who, if anyone, is responsible for cybersecurity at CSC, and representatives for CSC did not respond to TechCrunch’s requests for comment.

The student researchers said the vulnerability is in the API used by CSC’s mobile app, CSC Go. An API allows apps and devices to communicate with each other over the internet. In this case, the customer opens the CSC Go app to top up their account with funds, pay, and begin a laundry load on a nearby machine.

Sherbrooke and Taranenko discovered that CSC’s servers can be tricked into accepting commands that modify their account balances because any security checks are done by the app on the user’s device and automatically trusted by CSC’s servers. This allows them to pay for laundry without actually putting real funds in their accounts. 

By analyzing the network traffic while logged in and using the CSC Go app, Sherbrooke and Taranenko found they could circumvent the app’s security checks and send commands directly to CSC’s servers, which are not available through the app itself. 

Technology vendors like CSC are ultimately responsible for making sure their servers are performing the proper security checks, otherwise it’s akin to having a bank vault protected by a guard who doesn’t bother to check who is allowed in.

The researchers said potentially anyone can create a CSC Go user account and send commands using the API because the servers are also not checking if new users owned their email addresses. The researchers tested this by creating a new CSC account with a made-up email address.

With direct access to the API and referencing CSC’s own published list of commands for communicating with its servers, the researchers said it is possible to remotely locate and interact with “every laundry machine on the CSC ServiceWorks connected network.” 

Practically speaking, free laundry has an obvious upside. But the researchers stressed the potential dangers of having heavy-duty appliances connected to the internet and vulnerable to attacks. Sherbrooke and Taranenko said they were unaware if sending commands through the API can bypass the safety restrictions that modern laundry machines come with to prevent overheating and fires. The researchers said someone would have to physically push the laundry machine’s start button to begin a cycle, until then the settings on the front of the laundry machine cannot be changed unless someone resets the machine.

CSC quietly wiped out the researchers’ account balance of several million dollars after they reported their findings, but the researchers said the bug remains unfixed and it’s still possible for users to “freely” give themselves any amount of money.

Taranenko said he was disappointed that CSC did not acknowledge their vulnerability. 

“I just don’t get how a company that large makes those types of mistakes then has no way of contacting them,” he said. “Worst case scenario, people can easily load up their wallets and the company loses a ton of money, why not spend a bare minimum of having a single monitored security email inbox for this type of situation?”

But the researchers are undeterred by the lack of response from CSC. 

“Since we’re doing this in good faith, I don’t mind spending a few hours waiting on hold to call their help desk if it would help a company with its security issues,” said Taranenko, adding that it was “fun to get to do this type of security research in the real world and not just in simulated competitions.”