michael orlitzky

CSC ServiceWorks laundry machine coin bypass

posted 2023-06-02; updated 2024-09-23

AKA
how to give yourself a refund
AKA
because we tried it your way
Update 2024-08-03
I'm talking about this at DEF CON 32, and 404 Media reported on it.
Update 2024-08-30
The materials from my DEF CON 32 talk (sans the recording of the talk itself) are now online:
Slides
PDF (mirror)
Demo video, pt. 1
MP4 (mirror)
Demo video, pt. 2
MP4 (mirror)
Update 2024-09-23
In no particular order, I object to (a) these allegations, and (b) your bottom margins.

tl;dr

Get inside the service panel somehow; violence is acceptable. Try unscrewing screws, picking locks, or buying keys online. Once inside, look for a trio of red, white, and black wires running into the panel from the coin vault. Short-circuit the red and black wires to make it think you inserted a quarter. Ding! Ding! Ding! Ding! Ding! Ding! Ding! Your refund has been processed.

why

CSC ServiceWorks steals small amounts of money from large amounts of people. They provide laundry machines to apartment buildings and condominiums (where the residents have already paid for the rent, water, and electricity) and then charge exorbitant fees to use them. Payment is through a prepaid card, online apps (CSCPay or CSC GO), or quarters. In exchange, CSC is supposed to maintain the machines.

'Cause fuck em, that's why.

Ralph Henderson

Where this goes wrong is, everywhere. All aspects of the process are dark patterns carefully crafted to bilk the residents. My personal list of grievances:

That's just my list. CSC “allegedly” stole the CSCPay and CSC GO apps. They were sued under the RICO act. For online reviews they have 1.05 stars at the Better Business Bureau, 1 star at Yelp, and 1.2 stars at Google. The comments are the place to be if you want to see five hundred people wishing that there was a zero-star rating.

How do they get away with this? Predatory contracts with landlords and condominium associations, for one. But individually, I think what it comes down to is that they know you won't sue them over $2. So let's flip the script. If you think you deserve a refund, you should give yourself a refund. What are they going to do, sue you over $2?

the machines

This story features three models of CSC-branded Speed Queen machines supplied by Alliance Laundry Systems. The instructions might work on other models, but I can only make promises about the three that I have. The dryers are Alliance models SDGX09WF and the washers are either Alliance model SFNBCASP113TW01 or Alliance model SFNNCASP113TW01. They take payment through either the CSC GO app or quarters, and the model number can be found on a sticker inside the door:

SDGX09WF dryer, front view SDGX09WF dryer, front view
SFNBCASP113TW01 washer, front view SFNBCASP113TW01 washer, front view
SFNNCASP113TW01 washer, front view SFNNCASP113TW01 washer, front view

There are programming manuals available for the base models, but they don't necessarily apply to the CSC-branded versions. You don't have to read them, but I mention them a few times, so here they are:

getting inside

Before we can do anything useful, we have to get into the service panel where the circuitry lives. On the dryers, this is easy. Here's what the front of the service panel looks like:

SDGX09WF dryer service panel, front view SDGX09WF service panel, front view

It's held on with two stupid screws:

SDGX09WF dryer service panel, top view SDGX09WF service panel, top view

Screws are literally meant to be unscrewed. Go ahead. Now you're in:

SDGX09WF dryer service panel, inside view SDGX09WF service panel, inside view

The washers are a bit more difficult to penetrate. The button layout on the two washer models is different, but all that matters for now is that tubular lock:

SFNNCASP washer service panel, front view SFNNCASP service panel, front view

Option 1: hardcore mode

Tubular locks are actually fairly easy to pick. Covert Instruments sells a tubular lockpick and there's a YouTube video that shows you what to do with it. So, uh, that's option 1. The Covert Instruments lockpick remembers the shape of the key, so you only have to pick it once.

Warning: lockpicks are not illegal to possess, but that's not the full story. The Open Organization Of Lockpickers (TOOOL) has a summary of the relevant laws by state.

Option 2: inexpensive mode

Aw, you're still hardcore to me bro.

Remember how these machines all have Alliance Laundry Systems stickers on them? Well head on over to the Alliance parts store, and put “alliance washer dryer key” in the search box. The first result that comes up is Alliance #54612 Washer/Dryer KEY GR 800. It's six dollars and worth every penny. Or, now that you know which key it is, you can find a cheap substitute on Amazon.

SFNNCASP washer service panel being opened with GR800 key SFNNCASP washer service panel being opened with GR800 key
SFNNCASP washer service panel, inside view SFNNCASP washer service panel, inside view

Warning: according to the manual, these washers keep a record of the last few times the service door was opened. And they're connected to the internet, because that's how the app works. As a result, CSC probably knows that you've opened the service door. My personal stance on that is suck my diiiiiiiick, but feel free to perform your own risk assessment.

what doesn't work

Now that we're in, here's a bunch of stuff that does not work on these machines:

what does work

The reasoning goes: regardless of what happens inside the coin-drop mechanism, once a quarter is detected, it ultimately has to send a signal to the service panel letting the machine know that a quarter was inserted. In Electronics 101, we do that with two wires and a switch: one wire attached to a power source, and the other attached to a detector. The two wires meet at a switch that allows current to pass from the power source to the detector when something important happens. Like, say, when a quarter is inserted. To trick it, all you have to do is connect the two wires yourself, circumventing the switch. That process is called short-circuiting, or shorting, for short.

But, unless you know which two wires you want, you can't just go around splicing random wires in front of a security camera, can you? That could break the machine.

Just say it wasn't you.

Shaggy

If that's the situation you're in, then one day you might get the idea to search for a replacement Alliance coin-drop mechanism on the web, and, what do you know:

Alliance Laundry OEM coin-drop mechanism Alliance Laundry OEM coin-drop mechanism

That's exactly what we see running from the coin vault out into the service panel inside the washing machines:

SFNBCASP & SFNNCASP washer coin-drop connection SFNBCASP & SFNNCASP washer coin-drop connection

So, that narrows it down: shorting two of those three wires should make the machine think that a quarter was inserted. Hint: it's the red and black wires. In the washers this is comparatively easy. Since the red, white, and black wires all run into a bullet connector, all you have to do is stick something metal down into the corresponding (red and black) holes of the connector, where the wires are exposed.

Infinite money glitch Infinite money glitch
Shorting the red/black coin-drop wires in  SFNBCASP & SFNNCASP washers Shorting the red/black coin-drop wires in SFNBCASP & SFNNCASP washers

Ding! Ding! Ding! Ding! Ding! Ding! Ding! Your refund has been processed.

The dryers are trickier because there is no convenient bullet connector; the wires run right into a circuit board. But we do still see the same three red, white, and black wires routed in from the coin vault:

Coin-drop wires routed into the SDGX09WF dryer Coin-drop wires routed into the SDGX09WF dryer

Use a voltage tester to convince yourself that you won't get electrocuted, and then… expose the wires yourself, very carefully, with a pocket knife:

Stripped coin-drop wires inside a SDGX09WF dryer Stripped coin-drop wires inside a SDGX09WF dryer

Now all you have to do is short-circuit the two exposed wires to register $0.25 (technically, you can just smoosh them together with your fingers):

Shorting the red/black coin-drop wires inside a SDGX09WF dryer Shorting the red/black coin-drop wires inside a SDGX09WF dryer

Ding! Ding! Ding! Ding! Ding! Ding! Ding! Your refund has been processed.

Before you close the service panel, put two little pieces of electrical tape over the exposed wires to prevent unintentional shorts.