Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Garmin services and production go down after ransomware attack

zdnet.com

Post reply on HN
Print view View original

121–130 of 232 posts

Re: Garmin services and production go down after ransomware attack

#121

Post by clairegraham »

cnbuff410 wrote: post #111

How does ransomware attack work if the company host all of their service in the cloud (aws/gcloud/etc.)? Based on some preliminary readings, it seems like ransomware attack is mostly conducted on a physical machine. If your service data is all stored in the cloud and not synced with any of the machines owned by your employees, are you still subject to this type of attack?

You could still encrypt all the stored data in the cloud and delete everything that is unencrypted.

Since most of the historical data that customers upload is in the Garmin cloud, not on their local devices (I believe the local device only stores a small period of recent activity), this potentially means a lot of lost data for customers.

I would also imagine things like accounts and their relations to hardware devices (which account is associated with which device) is stored in the cloud somewhere, so those associations alone are important for synchronizing data to the cloud.

This will be a mess to cleanup if true, if they don't have some kind of separate off-site backups outside of this compromise.

Re: Garmin services and production go down after ransomware attack

#122

Post by parliament32 »

fbnlsr wrote: post #52
mattmaroon wrote: post #36

I guess I always assumed Garmin made most of their money on their aviation products, since they are so dominant and so expensive. And those are designed to rarely if ever connect to the internet. But I guess I was pretty off on that, they’re only 20%. On a side note the graphs of their revenues per year and by category show a company that successfully branched out when their former big category, automotive, which was…

I used to sell Garmin car GPS back when I worked in a retail shop. They were really good devices. But yeah I'm with you I thought most of their money came from aviation (it seems like everyone uses Garmin products), but their sports watches sell like crazy. Actually, I realized their network was down because this morning my watch would not sync after a run. :)

Yeah I noticed this morning too, Garmin Connect says "maintenance" but of course HN has the real story.

Re: Garmin services and production go down after ransomware attack

#123

Post by parliament32 »

christoph wrote: post #27
danielbln wrote: post #2

For many many hours already, including SSO, their webshop, and all of Garmin connect. The devices can't sync anymore, the mobile apps are all but useless and Garmin has yet to comment on any of this. Yikes.

It's made me realise how crazy reliant my Garmin watch is on their infrastructure. I went onto the app this morning to try and alter a watch face I already have downloaded, which should totally be configurable through just the mobile app alone. Why the hell does it need to talk to Garmin's servers to let me do this? It should just be possible through the app alone, without needing any involvement from Garmin's server…

Depends on your device, but on a Fenix you can swap/configure watch faces directly on the device.

Re: Garmin services and production go down after ransomware attack

#125

Post by rconti »

exabrial wrote: post #6

Their products are designed to work offline. Despite the cloud being down I have full local functionality right now. (Though I can't see my history, surprised they don't cache that locally). Last year when I did a 9-day canoe trip with no cell phone reception, all of my Garmin gear worked flawlessly (wearables, navigation devices, and their offline map app). Can't say the same about my friends iWatches/fitbits or eve…

I seem to recall my iWatch syncing fine without cell service. I've got a Forerunner 945 right now, it's always stunned me that the app caches nothing. You cannot so much as see how many steps you had or how many hours of sleep you got without data service to your own. And Garmin software is... not exactly first-rate, let's put it that way.

Re: Garmin services and production go down after ransomware attack

#126

Post by rconti »

LeifCarrotson wrote: post #46
christoph wrote: post #38

Earlier quoted context omitted.

My Forerunner 935 is basically the same story today. I can't do anything on it via the mobile apps. I guess I probably could do something with their desktop app and the USB cable, but it's really struck me how crippled the device seems today with their servers down, basically nothing is available or works at all through either Garmin Connect or ConnectIQ mobile apps. The apps don't appear to have any recent data cach…

I'd consider my Forerunner 220 almost completely un-crippled. I went for a run this morning, tracked it and got pace and distance information the whole time. If I look at my wrist, it tells me correctly that the time is currently 9:49 AM. If I unlock the device and scroll to the History tab, my run, and all previous runs since last September and their details are visible there. It acquires the GPS satellites the same…

That's how the higher end Forerunners work, too, for that basic functionality -- but the more advanced stuff that the 220 doesn't offer are the things being discussed here.

Re: Garmin services and production go down after ransomware attack

#127

Post by rconti »

nanidin wrote: post #50
amelius wrote: post #7

Earlier quoted context omitted.

Of course there isn't any guarantee that at some point, some marketing manager won't decide to break that.

It seems unlikely, Garmin is a very engineering led company. At least it was when I worked there 10 years ago! Part of that engineering focus is an insane attention to the BOM, and to support(call center) and warranty (returns & repairs) costs. I think both of these things make it unlikely that Garmin will add a cellular modem to start tracking otherwise unconnected devices.

Interesting. It surprises me how BAD most of Garmin's software is. They regularly break syncing functionality for weeks at a time. Sometimes watches need reboots to figure out how to sync to a phone. The sunrise/sunset graph on my $600 watch has NEVER been right.

You can push activities to your Garmin account but they don't bother engineering in any additional functionality, eg, to show your last activity if uploaded from outside, or to account for externally uploaded activities in your training metrics. It never feels like they're interested in improving the functionality of existing devices.

Don't get me wrong, I'm happier with my Forerunner 945 than I was with my Apple Watch, but only just. Basically, it does enough things that my Apple Watch can't do, to make suffering with the majority of things it's somewhat worse at, worthwhile as a tradeoff.

Re: Garmin services and production go down after ransomware attack

#128

Post by rconti »

pietromenna wrote: post #5

I am happy I am still able to run, even with their services down. But I found no comments on the internet at all about the reason of the incident.

This is sorta interesting, my wife is doing a virtual race on Saturday where she'll need to push Garmin data to Runkeeper to validate times for top 100. Might need to test some things out. Though I guess if everyone's impacted, the event will need to figure out a workaround.

Re: Garmin services and production go down after ransomware attack

#129

Post by grl »

cnbuff410 wrote: post #111

How does ransomware attack work if the company host all of their service in the cloud (aws/gcloud/etc.)? Based on some preliminary readings, it seems like ransomware attack is mostly conducted on a physical machine. If your service data is all stored in the cloud and not synced with any of the machines owned by your employees, are you still subject to this type of attack?

Ransomware and cloud are very generic terms. Ransomware is a concept of encrypting data to deny service. Cloud really references virtual architecture that is easy to expand and contract, often in a 3rd party cloud provider like Azure or AWS. The "machines" could be windows, linux, docker containers, Lamda functions (AWS), etc. running virtually in "the cloud". So, a ransomware in the cloud just means that someone encrypted data that is stored on cloud architecture. Certainly quite possible, but not as common as encrypting windows machines, which is what usually makes the news.
Post reply on HN