Two students find security bug that could let millions do laundry for free
Two students find security bug that could let millions do laundry for free
The company never responded when they reported it.
You're viewing a single thread.
I used to go to a laundromat that used something like a smartcard to keep your balance. You'd refill it at the kiosk and swipe it at the washer/dryer.
I had a reader/writer around somewhere from a few years prior, when I was messing around with old Echostar boxes.
Wish I could have found it. Those machines didn't look to be connected to anything. I didn't see any wireless networks in the area and the equipment didn't have any data lines.
I'm almost willing to bet the balance was stored as an value on the card and gets read/rewritten with every swipe, and essentially just security-through-obscurity. Meaning I could either back up and rewrite a $20 card forever, or rewrite the balance to having FF credits or whatever.
It could be simply obscure like you say, but the absence of a network doesn't guarantee it's that easy to hack.
They could use a checksum and your trick would invalidate the card until you figured out the correct algorithm, which would require a new visit to the laundromat for every new attempt, so basically impractical.
That or the card is just simply encrypted, which would make it impossible to interpret. It would be easy to implement too because the shared secret is between machines that are all physically controlled by the laundromat.
If there's no central control or ledger, couldn't you just rewrite the card with the original values and the machines wouldn't know any difference?
Oh yeah, that's true, so you wouldn't have destroyed the card, but it's not a useful hack if they've done even the most basic security measures.
That said, I would be fascinated to know what was on that card. I'd give it pretty good odds of having absolutely no security measures whatsoever.
you could add a random number to the encrypted data on the card and require it to always be the same or larger than the last time that card was seen, and then increment it every time the card is used.
The problem with that is that if the machines don't talk to one another then there's no way to make that system work across machines. I guess if each machine enforced it then you would eventually run out of machines that work for your hacked card.
You could store a counter for every machine used on the card, realistically, given few Laundromats would have over 50 or so machines. That'd mean that as you say, restoring the cards initial state would break it for every machine you previously used.
Going way too far now for what would make sense for a Laundromat, but just to entertain the idea...
You could also use an OTP encryption scheme on the card, where the exchange encryption key is based on the laundry machine ID, card ID, and a current timestamp, and thus changes every time the card is used. It would then be quite hard to "restore" the initial state of the card without having the laundry machine's hidden ID. Everything you read off the card would be useless a second later.
A simple encryption key would make the most sense. It wouldn't even need to be that complex. All you would need is a way to verify the card and then another one that represents the number. You probably could just use some primes.
Meaning I could either back up and rewrite a $20 card forever, or rewrite the balance to having FF credits or whatever.
As you can guess, checksum is stored somewhere. And that somewhere happens to be card that was just dumped.
Yeah, but you'd need the algorithm. It could be a hash of some kind, and if you don't know what kind of algorithm they're using you can't replicate it.
EDIT: Oh, I see what you're saying. You mean you could simply rewrite the original card value back over it forever. That's actually quite clever, and it would work even in case the card was completely encrypted.
Actually that means this is trivial to beat I think.
I mean how many people are gonna be walking around with card rw
Well that's the thing, you don't need a lot. You're handing out these cards and people walk out the door with them, so you can't trust they're not going to mess with them. They don't need to be walking around with a writer, you need one person to have access - either own one or have one at work or a university lab - and they can make as many cards as they want to give to their friends. Then they could use your business for years and get thousands of dollars of free service without you ever knowing.
That's the real threat here I think - a poor university student with a technical degree challenging themselves to cheat the system and help out their friends. I mean it's probably not going to happen, but a business owner who's aware of this attack vector could spend the time to get a basic encryption system going that's practically unbreakable.
Might be unbreakable, but all the attacker has to do is put money on it once and then just duplicate the card. You don't need to beat the encryption. You just need to make the machine think the card is legit
Yup, I've realised that's what people are saying. That's not an easy one to guard against I'm afraid.
I just re-read the comment chain and saw it was mentioned before. Oops lol
No worries I've been in this thread a bunch and only just got it.
There also is a point of cost. They aren't going to spend a bunch of money securing a laundromat. If they spend a bunch of money left and right your laundry fees would be pricy. Not to mention a laundryman isn't exactly a high profit business.
I agree with the first part of your comment, but laundromats are absolutely a high profit business.
source: family friend owns a bunch of them, every single one was net profitable inside of a few months and they are now basically pure profit month over month. They make more money than I ever have from a single software development job, even at my peak, and they largely just farm maintenance out and pay some labor.
Yeah, laundromats are hard to beat, because your only real operating costs are bills and maintenance on the machines.
how much would it be get a reader? What skills would I need to keep resetting the amount?