Hacking Commercial Maytag Washers and Dryers

by KingFlathead

Some background on this: If you, like myself, live in an urban highrise, you may not have your own washer and dryer.  That's cool with me.  I mean, all that ductwork must be a nightmare to maintain, but I'm already paying $$$ to live here, and ever since my building started advertising to students, the prices on the washers and dryers have been slowly climbing up from $.50 to $1.50.

Adding insult to injury, we used to have a machine to recharge the laundry cards accessible 24/7, but they moved the damn thing into the office.  I don't want to have to show up at work in my cleanest dirty pants just because it's after 5 and I'm short a buck on my silly smartcard.

Fortunately for me, the fine folks at Mac-Gray don't really care about anything other than emptying the cash machine - it's not like they have time to actually check the programming on 180 machines in three buildings.  They won't even come out to service a broken machine that was flooding out the hallways without at least a week's notice.  That means that I, a random hacker, have ample private time with the machines on my floor late at night.

Now, of course, Atmel CryptoCash is usually implemented in an insecure and exploitable manner, and exploits have been demonstrated for this, but that requires a microcontroller between the card and machine, which means a bit of embedded prototyping and a wedge card.  But, since I am lazy, there is a better way: reprogram the machine in service mode to run for free.

Most Maytag commercial washers and dryers out there use a common controller platform.  It dates back to the 1980s and is still produced.  So far as I can tell, every Maytag with a digital control panel is exploitable in this way.  The identifying features are a green vacuum fluorescent display with a four-digit green numerical display and six rectangular black buttons.  Washers and dryers are essentially the same, card operated and coin-op are identical in their hardware and programming.

Washers first: You will need, usually, a T-25 security bit, easily obtainable in a set for a few bucks at most hardware stores.  I have also seen spanner heads and weird three-groove conical head screws, which can usually be removed with a #6 spanner.  At the top of the machine, you'll see four screws holding the control panel on.  Unscrew them, and remove the trim and display cover.  Once those are off, usually pushing up will loosen the entire control panel assembly.  Unplug the machine.  On the back of the control panel, there's a connector labeled "AA1".  It's a three-pin locking connector with two very short loopbacks.  Remove it.  This places the machine into service mode.  Plug the machine back in.

You should see a new display on the machine now.  The way that this works is that the code on the left is what you are programming, and the number on the right is the value for that parameter.  "WOOLENS" or "QUICK CYCLE" advances to the next parameter, "DELICATEs AND KNITS" toggles things, and "PERM. PRESS" increments things.

Here's a list of codes:

6 - Regular Cycle Price (in quarters) - This is probably what you want to fool with. 7 - Wash Length 8 - Additional Rinse 9 - Cycle Counter - Once toggled, stays on forever. 1. - Money Counter - Also cannot be turned off once enabled. 2. - Special Pricing - Enables options 3 through 9. 3. - Special Cycle Price (in quarters) - This is also interesting. 5. - Time-of-Day Clock (minutes) 6. - Time-of-Day Clock (hours) 7. - Special Price Start Hour 8. - Special Price Stop Hour 9. - Special Price Days - 10 = Sun., 20 = Mon., 30= Tue., 40 = Wed., 50 = Thu., 60 = Fri., 70 = Sat. A. - Vault Viewing - Used for auditing. B. - Value of Coin 1 (in nickels) - Only if it's a coin-op or combo. C. - Value of Coin 2 (in nickels) - Usually used for dual American/Canadian coin-op machines. D. - Coin Slide Value (in nickels) - You know, those slidey things that take four coins at once. E. - Add Coins Option - Toggles display between number of coins and dollar value. F. - Enhanced Pricing Option - CP allows pricing per cycle, SP allows a "super cycle" for additional money. H. - Super Cycle Upgrade Price (in quarters) h. - Super Cycle Type - 01 = extra wash, 02 = extra rinse, 03 = both J. - Coin/Debit Option - Leave this alone, you may not be able to change it anyways. L. - Price Suppression Option - Turns off the amount to add, just shows "ADD". Why? n. - Clear Escrow - If on, clears credits after 30 minutes of no activity. Cheap bastards. r. - Spin Cycle RPM - Default is 800, it's probably wise to leave this alone... U. - Penny Offset - Used to bump the price up by pennies on a smartcard machine. A1. - Pre-Wash Length - 2-7 minutes, 0 disables A2. - Final Spin Length - 3-8 minutes

It's fairly evident what to do here.

Set 6 to 00 for free washes, and maybe set F. to enable, H. to 00, and h. to 03 to make every wash a super wash.

If you're paranoid, or if you're in a higher traffic area, maybe you don't want the machine to be on free all the time - maybe an hour or two a week when you usually do laundry is sufficient.  This is where special pricing comes in.

Set 2. to enable, and make sure that you set the real-time clock in 5. and 6. correctly.  Only wash between 8 pm and 10 pm on Saturday?  3.00, 7.20, 8.22, 9.7S.  You get the idea.

Every change you make is committed instantly, so try not to ruin the programming and cause a maintenance call.  To put the machine back into service, just unplug it, plug the AA1 loopback in, screw everything back together, and plug it back in.  You may need to open and close the door and insert a smartcard a few times for it to come fully alive, and usually if there's a smartcard reader attached you'll still need a card, but it won't debit you when the cycle is selected.

Dryers are a little different, some of the codes are the same, but entry into maintenance mode is different.  The ones I have seen have a circular key that actuates a microswitch.  You can either use the Bic pen trick, or, usually easier is to unscrew one corner of the front panel, reach behind there, and hold it down.  Unlike the washers, you don't need for the machine to be off for this.  Here's the dryer code list:

6 - Regular Cycle Price (in quarters) 7 - Minutes of Drying per Coin - Free cycles count as one coin. 8 - Type of Dry Time - 00 means that you can add time to a running dryer. 9 - Cycle Counter - Cannot be turned off once on. 1. - Money Counter - Same deal. 2. - Special Pricing Option - Same as the washer. 3. - Special Cycle Price (in quarters) 4. - Special Drying Minutes (per quarter) 5. - RTC Minutes 6. - RTC Hours 7. - Special Price Start Hour 8. - Special Price Start Minute 9. - Special Price Days A. - Vault View B. - Coin 1 Value (in nickels) C. - Coin 2 Value (in nickels) D. - Coin Slide Option - Enables coin slide, one actuation is always one cycle credit.

So, pretty similar, but less stuff.

In my case, I had to go from 6 06 7 10 to 6 00 7 60 to keep the cycle time 60 minutes long.  If you set the thing to cheap/free and the cycle time is really short, check option 7.

A word of caution, some models may have additional options to modify the cycle temperatures.  Don't be an asshole, leave them alone.  Setting the laundry room on fire is generally frowned upon.

Happy hacking, spread the free laundry love, and try not to get caught.