• AutoTL;DR@lemmings.worldB
    link
    fedilink
    English
    arrow-up
    8
    ·
    5 months ago

    This is the best summary I could come up with:


    That’s because of a vulnerability that two University of California, Santa Cruz students found in internet-connected washing machines in commercial use in several countries, according to TechCrunch.

    The two students, Alexander Sherbrooke and Iakov Taranenko, apparently exploited an API for the machines’ app to do things like remotely command them to work without payment and update a laundry account to show it had millions of dollars in it.

    CSC never responded when Sherbrooke and Taranenko reported the vulnerability via emails and a phone call in January, TechCrunch writes.

    That includes that the company has a published list of commands, which the two told TechCrunch enables connecting to all of CSC’s network-connected laundry machines.

    CSC’s vulnerability is a good reminder that the security situation with the internet of things still isn’t sorted out.

    For the exploit the students found, maybe CSC shoulders the risk, but in other cases, lax cybersecurity practices have made it possible for hackers or company contractors to view strangers’ security camera footage or gain access to smart plugs.


    The original article contains 294 words, the summary contains 171 words. Saved 42%. I’m a bot and I’m open source!

      • cm0002@lemmy.world
        link
        fedilink
        English
        arrow-up
        10
        ·
        5 months ago

        Forreal, I highly doubt CSC has a big bounty program so why did they even bother? Guaranteed they were the “Teacher you forgot our homework” kids

      • Snot Flickerman@lemmy.blahaj.zone
        link
        fedilink
        English
        arrow-up
        7
        arrow-down
        1
        ·
        5 months ago

        Honestly, in this case, the company in question are even bigger finks because they don’t actually care about fixing a vulnerability that could cost them money.

        If that speaks to their security practices, well… Let’s just say I wouldn’t be surprised if customer data was all in an unsecured, unencrypted, plain-text Microsoft Word document.