Major Security Flaw Found in CSC's Connected Laundry Machines

Two University of California, Santa Cruz students, Alexander Sherbrooke and Iakov Taranenko, uncovered a significant security flaw in the API of CSC ServiceWorks’ internet-connected laundry machines.

This vulnerability allows unauthorized users to remotely control laundry cycles and manipulate account balances, essentially enabling free laundry. Despite multiple attempts to report the issue, CSC ServiceWorks has yet to address the problem.

This Threatfeed dissects the technical aspects of the vulnerability, its implications, and the company's response, or lack thereof.

Exploitation of the Vulnerability

Initial Discovery

Alexander Sherbrooke discovered the flaw in January while experimenting with the CSC Go app. He executed a script from his laptop, which successfully initiated a laundry cycle without any funds in his account.

This critical "oh s—" moment revealed a systemic failure in CSC's API security.

Technical Analysis

The vulnerability exists in the API utilized by the CSC Go mobile app, which facilitates communication between users' devices and CSC’s servers. Key weaknesses include:

Client-Side Security Checks: The app conducts security validations locally, trusting any input from the user's device without re-verification on the server side.
Direct Command Injection: By intercepting and analyzing network traffic, the students found they could bypass the app’s security checks and send unauthorized commands directly to CSC’s servers.

Exploit Methodology

Sherbrooke and Taranenko exploited the vulnerability by:

Interception of Network Traffic: Using tools like Wireshark, they monitored the communication between the app and the servers.
Manipulation of API Requests: They crafted API requests to alter their account balances and initiate laundry cycles without real funds.
Testing with Fake Accounts: They created accounts using non-existent email addresses, which the server accepted without verification.

Code Snippet

import requests

# API endpoint for starting a laundry cycle
url = "https://api.cscserviceworks.com/startCycle"

# Payload with the machine ID and user session token
payload = {
    "machine_id": "123456",
    "session_token": "abcdefg123456",
    "command": "start"
}

# Sending the request
response = requests.post(url, json=payload)

# Checking the response
if response.status_code == 200:
    print("Laundry cycle started successfully.")
else:
    print("Failed to start laundry cycle.")

Extended Technical Analysis

API Security Flaws

Lack of Server-Side Validation: The API fails to validate critical actions on the server side, relying solely on the client-side app for security checks.

Insecure Authentication Mechanism: The API does not verify email ownership, allowing the creation of accounts with arbitrary email addresses.

Unrestricted API Access: The API permits direct interaction with all connected laundry machines, exposing the entire network to potential abuse.

Implications of the Vulnerability

Financial Loss: Unauthorized use of laundry services could lead to substantial revenue losses for CSC ServiceWorks.

Potential for Broader Exploitation: The vulnerability could be exploited to interfere with the operation of laundry machines on a large scale, potentially leading to service disruptions.

Safety Risks: Although not confirmed, there is a theoretical risk that malicious actors could bypass safety mechanisms, leading to overheating or other hazards.

Recommendations

Implement Server-Side Validation: All critical operations should be verified on the server side, ensuring that commands come from authenticated and authorized sources.

Secure Authentication Processes: Introduce multi-factor authentication and ensure that account creation includes email verification.

Rate Limiting and Monitoring: Implement rate limiting on API requests and establish monitoring to detect and respond to unusual activities.

Response from CSC ServiceWorks

Reporting Attempts

Sherbrooke and Taranenko attempted to contact CSC ServiceWorks through various channels, including the company's online contact form and phone support. They also reported the issue to the CERT Coordination Center at Carnegie Mellon University.

CSC’s Inaction

Despite these efforts, CSC ServiceWorks has not addressed the vulnerability. The company's failure to respond highlights a critical gap in their security posture and incident response processes.

Recommendations for CSC ServiceWorks

Establish a Security Response Team: Develop a dedicated team to handle security vulnerabilities and coordinate with researchers.

Create a Vulnerability Disclosure Program: Implement a formal program for reporting and addressing security flaws.

Enhance Communication Channels: Ensure that there are clear, monitored channels for receiving and responding to security reports.

The discovery of this vulnerability by Sherbrooke and Taranenko underscores the importance of robust API security practices. CSC ServiceWorks' lack of response to the reported flaw raises significant concerns about their commitment to security.

It is imperative that they take immediate action to secure their systems and establish better mechanisms for handling security disclosures. This incident serves as a stark reminder of the potential risks associated with internet-connected devices and the critical need for vigilant security measures.