Also Hackable: Drive-Through Car Washes

PLAR writes It turns out LaserWash automatic car washes can be easily hacked via the Internet to get a free wash or to manipulate the machines that clean the cars, a security researcher has found. Billy Rios says these car washes have web interfaces with weak/default passwords which, if obtained, could allow an attacker to telnet in and use an HTTP GET request to control the machines. Rios adds that this probably isn't the only car wash brand that's vulnerable.

Comments

What's a car wash?

[mspohr]

Car?
Wash?

Some things do not belong on the Internet

[davidwr]

Some things just should never be put "on the Internet."

If you must have remote access, either use a dedicated physical connection (with appropriate anti-tampering/tamper-mitigation measures of course) or tunnel them through a rock-solid VPN, but for goodness sake don't put them "on the Internet."

Yes, companies that run industrial equipment, traffic lights, etc., I'm looking at you too.

Re:Some things do not belong on the Internet

[nitehawk214]

So, you can't stick a credit card into the thing. And when it breaks down nobody gets alerted.

Traffic lights: No ability to know when they are working or not, no way to synchronize lights across the city.

Think about it. Devices need to be connected. Security isn't hard, companies need to start giving a shit about it.

Breaking Bad car wash

[MillionthMonkey]

What a pity this wasn't discovered sooner... Skyler White could have asked Saul Goodman to hire his Eastern European hacker again to launder Walt's meth money through that car wash using HTTP GET requests.

Online Manual

[chill]

A quick Google search for "laswerwash ip address" and the very first link is a PDF of the LaserWash Owner/Operator manual with LOTS of useful information.

Things like default IP address, default port, default passwords, command sequences, etc.

I hope whoever did this

[Anonymous Coward]

comes out clean.

Sudo wax off

[Anonymous Coward]

Sudo wax on

Re:Marketing dream chasers

[Applehu Akbar]

My very first car wash was cloud-based. Sometimes I miscalculated and it got snowed on instead.

Re:Embedded systems devs

[Zero__Kelvin]

Do the world a favour and stay out of the Computer Security Business. 80% of CompSec is anticipating how people might use things in ways they were never intended to be used.