Garmin Connect down - Ransomware?

Discuss light weight issues concerning road bikes & parts.
Nickldn
Posts: 374
Joined: Mon Mar 25, 2019 12:35 am

by Nickldn

robertg wrote:
Sat Jul 25, 2020 11:31 pm
This may be a stupid question, but I am not the most tech savvy. Is there any way for these hackers to send something to our Garmins which would then transfer to our computers when we hook them up to download rides? Then they would essentially hack our home computers? Or am I just way off here?
Guess it's possible if they could get their ransomware to run in your Garmin, so it's a good thing Garmin have cut off their internet presence.

As worrying is the Garmin Connect app for iOS and Android devices, I think these apps have been cut off too, for this very reason.
Giant Propel Advanced SL Red Etap 11s Easton EC90 wheels 6.5kg

tinozee
Posts: 747
Joined: Wed Jun 01, 2011 7:53 am

by tinozee

It's possible to put malware into firmware. I don't know the process with garmin updates, or the plans of the hackers but it seems enough to cause a temporary mess and collect the dough if they can.

by Weenie


User avatar
Miller
Posts: 1849
Joined: Thu Sep 21, 2006 8:54 pm
Location: Reading, UK

by Miller

Nickldn wrote:
Sat Jul 25, 2020 11:22 pm
One would think $10m would be mere pocket change for a big multinational like Garmin.
I'm not sure it is. That's a hell of a lot of bike computers... Yes I know they do other stuff.

More to the point, how trustworthy are the attackers. Are they actually able to wave a wand and unlock the data? That's what you'd have to wonder if you were Garmin. By this point rebuilding everything may be the best option.

sychen
Posts: 1103
Joined: Thu Apr 24, 2014 1:06 pm

by sychen

There are some US laws that may not allow garmin to pay ransom even if they wanted to..


And to compare being ransomed by a crypto attack to this software architecture is extremely unfair.

Most common attack vector isn't in software deficiencies but in people. Social engineering attacks are by far the most effective entry into a network.

If you think any company with a computer network is immune from this.. You are dreaming and/or delusional.

How a company restores service will be the defining statement of the competency of their IT. Good ones will have properly segregated backups and offline stores that can't be fully corrupted.. You may lose some recent data but older ones and images for all the servers will be available. The delay will be in forensics.. Identify all the entry points and any backdoors these hackers would of left would be primary work. FBI and police evidence gathering will be a important step too.

This is what I do for a living.. It's forever playing catchup to new attacks (wastedlocker used here not to get in but to encrypt data), exploits and zero days..

We don't know the entry vector at this stage..

Sent from my Pixel 4 XL using Tapatalk


Last edited by sychen on Sun Jul 26, 2020 1:01 am, edited 1 time in total.

tabl10s
Posts: 681
Joined: Wed Aug 23, 2017 5:40 am

by tabl10s

Garmin should get the military/government involved. Fit Bit is not allowed to be worn by the Military as it can be used to outline installations. Since Garmin works the same way, vital info could be exploited.
2015 Pinarello F8: 13.13lbs/5.915kg(w/Roval 64's).
2016 Rca: 11.07lbs/5.048kg.
2018 Rca.
2018 S-Works SL6 Ultralight: 12.03lbs.

sychen
Posts: 1103
Joined: Thu Apr 24, 2014 1:06 pm

by sychen

tabl10s wrote:Garmin should get the military/government involved. Fit Bit is not allowed to be worn by the Military as it can be used to outline installations. Since Garmin works the same way, vital info could be exploited.
They most likely already have FBI on scene..

Sent from my Pixel 4 XL using Tapatalk


tleo
Posts: 42
Joined: Sun Feb 16, 2020 5:08 pm

by tleo

Moderator note - leave the politics out of it.

sychen
Posts: 1103
Joined: Thu Apr 24, 2014 1:06 pm

by sychen

tleo wrote:But since it appears that Russian entities are behind this attack it is highly unlikely, given our current political environment, that anything of substance will happen. Our leaders and Putin have a pretty buddy-buddy relationship and far worse things than this have been alleged by our intelligence services which haven't even been ignored.
Authorities will still be involved regardless of the Cheeto in Chief. Relevant sanctions are a different story if this is a state act. In most cases.. They are independent groups given carte blanche as long as they target "other" people. Even with a anti Kremlin whitehouse.. Near impossible to prove conclusively.

Sent from my Pixel 4 XL using Tapatalk


spdntrxi
Posts: 3896
Joined: Sat Jul 20, 2013 6:11 pm

by spdntrxi

come on guys.. we all know that bullshit does not belong in ww. Dont wreck my safe space :)
2019 BMC TM01 Road UCI config 7.36kg

TobinHatesYou
Posts: 6440
Joined: Mon Jul 24, 2017 12:02 pm

by TobinHatesYou

tleo wrote:
Sun Jul 26, 2020 4:52 am
But since it appears that Russian entities are behind this attack it is highly unlikely, given our current political environment, that anything of substance will happen. Our leaders and Putin have a pretty buddy-buddy relationship and far worse things than this have been alleged by our intelligence services which haven't even been ignored.

The US is continually engaged in cyberattacks of its own. See: Stuxnet, Duqu, Flame, etc.

jlok
Posts: 1382
Joined: Tue Jun 30, 2015 3:30 am

by jlok

https://connect.garmin.com/status/

Garmin Connect features are gradually back online.
Rikulau V9 DB Custom < BMC TM02 < Litespeed T1sl Disc < Giant Propel Advanced SL Disc 1 < Propel Adv < TCR Adv SL Disc < KTM Revelator Sky < CAAD 12 Disc < Domane S Disc < Alize < CAAD 10

Timmy269
Posts: 230
Joined: Tue Nov 25, 2014 2:34 pm

by Timmy269

I have a garmin edge 1000 which always sychronisezed with my smartphone using garmin connect and strava sychronized with strava. Cause the problems with Garmin connect since friday i wanted to upload my ride from yesterday to strava tu connect the garmin edge to the pc. The only thing is uploading the battery, the usb device not recognized. I used several cables and tried, with my desktop, laptop, desktop at work, nothing. I'm almost sure it's a problem with the garmin edge. the stupid thing also is that de activities are saved on the edge's harddisk and not in the sd card.

jlok
Posts: 1382
Joined: Tue Jun 30, 2015 3:30 am

by jlok

Some cables are for charging only and no data connection.

Also, I think you can specify where to save your activities in your Garmin Edge 1000. You may opt to save it in internal memory or the SD card.
Rikulau V9 DB Custom < BMC TM02 < Litespeed T1sl Disc < Giant Propel Advanced SL Disc 1 < Propel Adv < TCR Adv SL Disc < KTM Revelator Sky < CAAD 12 Disc < Domane S Disc < Alize < CAAD 10

User avatar
Miller
Posts: 1849
Joined: Thu Sep 21, 2006 8:54 pm
Location: Reading, UK

by Miller

Timmy269 wrote:
Mon Jul 27, 2020 8:31 am
I'm almost sure it's a problem with the garmin edge.
Don't know if this is relevant for you but have you tried turning your Garmin off while it's connected by the cable to the PC? That's what prompts my Garmins to drop into USB-connected mode.

Maddie
Posts: 174
Joined: Tue Oct 17, 2017 5:44 am

by Maddie

Timmy269 wrote:I have a garmin edge 1000 which always sychronisezed with my smartphone using garmin connect and strava sychronized with strava. Cause the problems with Garmin connect since friday i wanted to upload my ride from yesterday to strava tu connect the garmin edge to the pc. The only thing is uploading the battery, the usb device not recognized. I used several cables and tried, with my desktop, laptop, desktop at work, nothing. I'm almost sure it's a problem with the garmin edge. the stupid thing also is that de activities are saved on the edge's harddisk and not in the sd card.
As mentioned by jlok, this sounds like you're using charging cables. Your issue is not related to the garmin connect situation

by Weenie


Post Reply