---
title: "Automatic Car Washes Can Be Hacked to Trap, Attack Drivers Inside, Researchers Say"
description: "A scary possibility in a connected future."
date: "2017-07-28"
modified: "2019-06-22"
authors:
  - name: "Kyle Cheromcha"
    job_title: "Editor-in-Chief"
    link: "https://www.thedrive.com/authors/kyle-cheromcha"
url: "https://www.thedrive.com/tech/12989/automatic-car-washes-can-be-hacked-to-trap-attack-drivers-inside-researchers-say"
categories:
  - "Car Tech"
  - "News"
tags:
  - "car wash"
  - "Connected World"
  - "Hacking"
  - "Internet of Things"
---

# Automatic Car Washes Can Be Hacked to Trap, Attack Drivers Inside, Researchers Say

![](<https://www.thedrive.com/wp-content/uploads/images-by-url-td/content/2017/07/car-wash.png>)
*\<em\>www.thedrive.com</em>*

There's a lot of concern these days about the possibility of someone [hacking your Internet-connected car,](<https://www.thedrive.com/news/4699/the-jeep-hackers-are-back-and-theyve-come-for-your-steering-wheel>) but somewhat less attention paid to the idea of hackers targeting the ancillary systems drivers rely on. [Gas pumps.](<https://www.wired.com/2015/08/internet-connected-gas-pumps-lure-hackers/>) Traffic lights. And now, the humble [automated car wash.](<https://www.thedrive.com/watch-this/8699/watch-as-stalled-car-in-automatic-carwash-causes-accident>)

[*Motherboard* reports](<https://motherboard.vice.com/en_us/article/bjxe33/car-wash-hack-can-smash-vehicle-trap-passengers-douse-them-with-water>) that a group of security researchers have discovered a way to hack a brushless, laser-guided system known as the [PDQ LaserWash](<https://www.pdqinc.com/>) found at automatic car washes around the country. In a real-world test earlier this year, the group was able to remotely close the bay doors, trap a vehicle inside, and manipulate a robotic arm to continuously strike and spray the car with [high-pressure water](<https://www.tntservices.com/semi-truck-body-shop/>).

The exploit was actually uncovered a couple of years ago, but it remains a theoretical possibility as they never had a chance to test it out. But a facility in Washington State finally agreed, and though they wouldn't allow the test to be filmed, it was successful (and scary) enough that they presented their findings at the annual Black Hat hacking conference in Las Vegas this week.

According to Motherboard, the PDQ systems are all running on Windows CE and are connected to the Internet so remote technicians can monitor their status and send out updates. The researchers were easily able to guess the master default password, which hadn't been changed in many locations, and from there they found a security exploit that allowed them to write an "attack script."

Thankfully, these were friendly hackers, because this is scary stuff—if it were a malicious actor behind the intrusion, all they would reportedly have to do is select the IP address of the car wash they wanted to control and press go. The script automatically activates at the end of the wash, shutting the doors as the driver tries to exit and forcing the robotic system to ignore its safety sensors and warnings. Without an attendant on duty, there's little a hapless driver could do to stop it.

Although they didn't actually hit the truck during the test to avoid damaging it or the robotic arm, the ability was there. Before their presentation this week, they also notified the company and the Department of Homeland Security. A PDQ spokesman [told *Motherboard*](<https://motherboard.vice.com/en_us/article/bjxe33/car-wash-hack-can-smash-vehicle-trap-passengers-douse-them-with-water>) that it's currently investigating the vulnerability and working on a fix.

Here's a video of car going through the same PDQ LaserWash system, sans homicidal robots:

https://youtube.com/embed/nrLHduTTpzY

## Author
Overseeing an expert staff of writers and editors from his lair in Los Angeles, Kyle shapes The Drive’s singular approach to covering the automotive industry and car culture. He’s been with the site as a writer since 2017, taking over as editor in 2019. On a daily basis, Kyle is responsible for directing The Drive's editorial news and car review content strategies, setting special coverage priorities, managing complex reporting projects, and ensuring what you read on the page meets our high internal standards for quality and trustworthiness. He is also the executive producer of The Drive's YouTube channel, which was relaunched in February 2024 to great acclaim and has accumulated over 14M new views in its first year back on the scene. He hosts a biweekly series on the channel where he breaks down fascinating and complicated stories from the automotive world.

### Author social links  
[Bluesky](<https://bsky.app/profile/kylecheromcha.bsky.social>)  
[Instagram](<https://www.instagram.com/kylecheromcha>)  
[LinkedIn](<https://www.linkedin.com/in/kyle-cheromcha-1550248a/>)