Two students find security bug that could let millions do laundry for free

Two University of California, Santa Cruz students, Alexander Sherbrooke and Iakov Taranenko, found a vulnerability in internet-connected laundry machines operated by CSC ServiceWorks, according to TechCrunch. They reportedly exploited an API in the machines' app to start machines without payment and to inflate a laundry account to show millions of dollars. CSC ServiceWorks says it has more than a million laundry and vending machines in the US, Canada, and Europe. The students said they reported the flaw by email and phone in January without a response, and that the company later removed the false balances after they contacted it.