Slashdot Mirror
Also Hackable: Drive-Through Car Washes
PLAR writes It turns out LaserWash automatic car washes can be easily hacked via the Internet to get a free wash or to manipulate the machines that clean the cars, a security researcher has found. Billy Rios says these car washes have web interfaces with weak/default passwords which, if obtained, could allow an attacker to telnet in and use an HTTP GET request to control the machines. Rios adds that this probably isn't the only car wash brand that's vulnerable.
Embedded system developers suck at all things internet, especially security.
The North Korean hackers will love this. Since they can't wash their own cars, they can wash ours.
Seems like causing damage to cars or injuring people would be a bigger concern than free car washes. It is a room full of large automated machines after all.
Car?
Wash?
I don't read your sig. Why are you reading mine?
Some things just should never be put "on the Internet."
If you must have remote access, either use a dedicated physical connection (with appropriate anti-tampering/tamper-mitigation measures of course) or tunnel them through a rock-solid VPN, but for goodness sake don't put them "on the Internet."
Yes, companies that run industrial equipment, traffic lights, etc., I'm looking at you too.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The article has a picture of a BMW going through a brush wash. It would void the warranty. BMW says only BMW certified brushless car washes are compatible. Using unauthorized car washes will void the warranty.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Makes you wonder if the credit card readers that go with the car wash equipment is also vulnerable. Probably.
Don't blame the devs, they aren't the ones who asked for a freaking car wash to be "in the cloud."
What a pity this wasn't discovered sooner... Skyler White could have asked Saul Goodman to hire his Eastern European hacker again to launder Walt's meth money through that car wash using HTTP GET requests.
A quick Google search for "laswerwash ip address" and the very first link is a PDF of the LaserWash Owner/Operator manual with LOTS of useful information.
Things like default IP address, default port, default passwords, command sequences, etc.
Learning HOW to think is more important than learning WHAT to think.
comes out clean.
Sudo wax on
Who washes their car in the winter? By the time you've driven it home its dirty again.
If you're controlling something, it should at least be a POST.
The older laserwash 4000 had 0 as the terminating digit, and only 4 digits 1-9. Since no zeros, there was not that many combinations. Pretty sure numbers were sequential since the first number would always be the same for weeks at a time. If someone knew the first number, they would probably have a pretty good success rate guessing a working code. I guess thats why people always were typing bad codes and blaming it on their glasses lol.
Who washes their car in the winter? By the time you've driven it home its dirty again.
I wash mine all the time to get that lousy Magnesium Chloride off of it. If it's warm enough and there's going to be enough warm/dry days coming up I will wash it. But only in a BMW certified car wash :-)
Where you live maybe. Here we had a high of 84 and a low of 51.
He hacked the machinery to make it look as though the car wash was handling ten times the number of customers that it actually was. It even printed out fake activity reports for the IRS.
He hacked the machinery to make it look as though the car wash was handling ten times the number of customers that it actually was. It even printed out fake activity reports for the IRS.
Wouldn't you hack it to show that it was handling 1/10th the number of customers though? Why artificially inflate your income for the IRS? The whole point is to reduce it and pocket the rest :-)
Connectivity != Internet.
Take traffic lights for example:
Long before the Internet was more than just a government/university/defense-contractor environment, traffic lights had 2-way communication.
Were they hackable? Yes, to someone with physical access to the communications wires and by the 70s or 80s, maybe to someone who had access to the telephone-company infrastructure. That meant someone in the same metro area as the traffic lights themselves. But they probably were not hackable by someone sitting in his mother's basement or in a terrorist's cave in East Elbonistan.
That's just one example.
My personal pet peeve is companies that allow more than "harmless" remote control of their HVAC over either the Internet or telephone without routing all remote access through a very secure gateway/vpn/whatever. It's not so bad if they allow people to remotely turn on the lights or change the HVAC from "night/energy-saving" mode to "day/occupied" mode, as that just wastes money. But if I can remotely change the temperature to 40F or 100F or remotely shut down the HVAC completely, or remotely turn OFF the lights, that's a bad idea unless strong security is in place. Over the Internet, strong security typically means a VPN or other extremely-hard-to-hack pathway in.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I was using "secret" underground codes, probably either built-in at the factory or intended for employees or testing in the 1990s. These codes was going around on the street (I did not learn it on the Internet).
I had to read this just in case someone considers that "hacking".
Are the cameras (to prove that the damage to the car was there before the wash) also hackable?
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
If the machine has a web interface with a weak or default username and password, why would I bother going to the trouble of using telnet and bashing out a bunch of http headers . . . when I could just use the web interface . . . to control the machine.
Billy Rios sums things up interestingly with this sentence:
The trick with control systems...which is what the computers controlling this car wash are...is that logical actions result in kinetic effects. And you can't reboot physics, or restore solid objects from backup.
For your security, this post has been encrypted with ROT-13, twice.