The thought did occur to me to see what happens when I add money to my account, but I didn’t end up trying. There are no API keys or authentication or anything. The only thing you need is a location code which is trivial to get from a proxy.
I imagine it is a low priority. How often does someone try to hack a laundromat?
The whole herd will stay in the fence until a smart cow opens the gate. Then the whole herd gets out.
Once a security vulnerability is found, someone will inevitably write a script, hacking tool, or modified app to abuse the vulnerability. Then everyone can use that tool to exploit the vulnerability.
Being the co-founder and CEO of SmartThings, Alex clearly has an understanding for the IoT space at large. It would make sense then that when CSC ServiceWorks wanted to “modernize” their fleet of washers and dryers that they would pull Alex in to help guide them - providing him with a seat on their board[2]. CSC ServiceWorks is a company that knows how to run laundromats - not a tech company. To avoid having to hire employees and manage the software for a fleet of IoT washers and dryers, CSC ServiceWorks instead contracts a small startup company called BrightAI to develop this IoT solution for them[3@44:30]. Interestingly, Alex is also the founder and CEO of BrightAI[4].
BrightAI CTO, Robert Parker[4], also has a history of dismissing security concerns in IoT, inferring that traditional security practices could be replaced with AI [5@34:30].
The two students here seemed to do everything “right”, from adhering to a disclosure period and even going as far as reporting the issue to the CERT Coordination Center at Carnegie Mellon University. Carnegie Mellon would not have needed to go far to report this to the appropriate parties, given that Alex holds an advisory role at the university[1].
The original reason I went down this whole rabbit hole was after someone tipped me off to how Alex structures these business relationships - I won’t go into this now as it isn’t relevant for this, but maybe someday I’ll get all the thoughts together in a consumable format.
As a little bit of an unrelated "fun fact", according to LinkedIn, a handful of the engineers from OceanGate now work for Alex at BrightAI
[1]: https://www.crunchbase.com/person/alex-hawkinson
[2]: https://www.cscsw.com/press-release/iot-thought-leader-alex-...
[3]: https://staceyoniot.com/podcast-speed-queens-and-matter-drea...
[4]: https://www.bright.ai/company
[5]: https://appliedai.buzzsprout.com/1101152/10528308-building-i...
If that's the way it can be at a company selling security products, I can only assume it's worse at other companies.
The old "trust the client, no validation on the server" is completely pathetic. It indicates nobody even tried to make the system secure at CSC.
