Two students at UC Santa Cruz, Alexander Sherbrooke and Iakov Taranenko, discovered a security vulnerability in the API used by CSC ServiceWorks’ mobile app that allows anyone to remotely operate the company’s laundry machines for free.