{"id":170,"date":"2008-02-24T23:27:10","date_gmt":"2008-02-25T07:27:10","guid":{"rendered":"http:\/\/cubist.cs.washington.edu\/Security\/2008\/02\/24\/security-review-coin-operated-laundromats\/"},"modified":"2008-02-24T23:27:10","modified_gmt":"2008-02-25T07:27:10","slug":"security-review-coin-operated-laundromats","status":"publish","type":"post","link":"https:\/\/secblog.cs.washington.edu\/Security\/2008\/02\/24\/security-review-coin-operated-laundromats\/","title":{"rendered":"Security Review: Coin-Operated Laundromats"},"content":{"rendered":"<p>They\u2019re out there\u2026Some of us use them everyday\u2026Especially college students living away from home\u2026We can\u2019t avoid them, unless we want to be stinky\u2026<\/p>\n<p>Yes I\u2019m talking about coin-operated laundries\u2026<\/p>\n<p>Coin-operated washing facilities provide an interesting security problem, since the users only maintain a single asset, their clothes.  The owners and operators of the facility are at most risk since they have to protect against people stealing money or gaining free use.<\/p>\n<p><!--more--><\/p>\n<h3>Summary<\/h3>\n<p>For those of you who either live at home, or are spoiled beyond belief that you\u2019ve never had to work with one of these devices, allow me to describe a typical coin-operated washing machine.<\/p>\n<p>The washing machine is of relatively standard fare, albeit with simplified control settings, which may or may not be selected using digital input.  Quarters are inserted into the coin slot, and usually a digital controller is used to drive the machine.  It displays the remaining time and other information on an LED or LCD screen.  After the correct number of coins are inserted. the machine runs until it completes its cycle<\/p>\n<h3>Security Assets and Goals<\/h3>\n<ul>\n<li>Users\u2019 clothes: Often the most valuable asset.  Designer jeans are expensive, it should be difficult for someone to steal.<\/li>\n<li>Coin deposit container: Should be inaccessible to unauthorized personnel.<\/li>\n<li>Paid wash cycle: In order for a cycle to commence, the user must pay for it.<\/li>\n<\/ul>\n<h3>Potential Adversaries<\/h3>\n<ul>\n<li>Freeloaders \u2013 Users who wish to use the machines without paying for the service.<\/li>\n<li>Machine designer\/implementer \u2013 If you could design a backdoor that let you had free laundry service, would you do it?<\/li>\n<li>Thieves \u2013 Motivated to steal money stored in the machine or actual laundry.<\/li>\n<\/ul>\n<h3>Potential Weaknesses<\/h3>\n<ul>\n<li>Laundry is fully accessible \u2013 It\u2019s rather simple to walk over to a running machine and just open it up and remove the clothes, which forces the owner of the clothes to be always vigilant.<\/li>\n<li>Access to digital controller \u2013 The controller needs to be accessible for maintenance and diagnostics.  If an adversary can get access, they might be able to disable it or<\/li>\n<li>Inept coin reader &#8211; The coin reader might be fooled into thinking that it\u2019s received quarters, causing it to begin an unpaid cycle.<\/li>\n<\/ul>\n<h3>Possible Defenses<\/h3>\n<ul>\n<li>Lock for laundry: Some type of lock where the user can choose a code to protect his or her clothes from perverts and thieves.<\/li>\n<li>Surveillance cameras: If people were aware that they were under surveillance it could be used to deter people from attempting to tamper with the machines.<\/li>\n<\/ul>\n<h3>Conclusion<\/h3>\n<p>Most of us don\u2019t think about the security implications of a standard Laundromat, but this is a real issue for Laundromat owners and something that they need to contend with.  But provided machines are physically difficult to compromise things should be ok.  I still don\u2019t like the fact that anyone can steal my clothes\u2026<\/p>\n","protected":false},"excerpt":{"rendered":"<p>They\u2019re out there\u2026Some of us use them everyday\u2026Especially college students living away from home\u2026We can\u2019t avoid them, unless we want to be stinky\u2026 Yes I\u2019m talking about coin-operated laundries\u2026 Coin-operated washing facilities provide an interesting security problem, since the users &hellip; <a href=\"https:\/\/secblog.cs.washington.edu\/Security\/2008\/02\/24\/security-review-coin-operated-laundromats\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":33,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1,13,5],"tags":[],"class_list":["post-170","post","type-post","status-publish","format-standard","hentry","category-miscellaneous","category-physicalsecurity","category-security-reviews"],"_links":{"self":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/170","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/users\/33"}],"replies":[{"embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/comments?post=170"}],"version-history":[{"count":0,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/170\/revisions"}],"wp:attachment":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/media?parent=170"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/categories?post=170"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/tags?post=170"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}