Live data from Hacker News

Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

anvilsecure.com

41–50 of 77 posts

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#41

Anyone got a recommendation for fitness wearables where you can opt out of having to sign up with an account, and can export data out of it in open/standard formats?

Look at the supported wearables for GadgetBridge

https://codeberg.org/Freeyourgadget/Gadgetbridge

FOSS, doesn't have network permissions, can export data or interface with other apps

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#42
post #10

Anyone got a recommendation for fitness wearables where you can opt out of having to sign up with an account, and can export data out of it in open/standard formats?

Garmin watches work well with the desktop sports tracking program MyTourBook. I've never had to activate a Garmin watch or register it online in order to use it. Not connecting it to Garmin Services and apps may limit access to 3rd party apps, or at least make it harder to load them load though. (I haven't researched side loading since base features are fine for me). MyTourBook supports FIT/GPX/TCX/etc, has maps, cal…

I use ActivityLog2 which also reads FIT files.

https://github.com/alex-hhh/ActivityLog2/releases

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#43

Pretty cool what they did. There doesn't seem to be a mainstream embedded OS that allows dynamically loading binaries, but it would be so nice.

> There doesn't seem to be a mainstream embedded OS that allows dynamically loading binaries

I'm not up to date on embedded programming vernacular, but isn't that just a regular OS with apps? (Apple Watch OS, Android Wear, etc)

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#44

Earlier quoted context omitted.

Really? I recently got a forerunner 265 and it definitely didn’t give the impression that was possible. The battery life is also nowhere near the advertised length (13 days). Most disappointing is that their support people say to expect about 60% of that, which is what I’m getting. That said, this will likely be the replacement for my Pebble. Battery life over 6 days, buttons to control music playback, and an English…

Are you doing something special with the watch? I've gotten several weeks out of all my Garmin models except the first one I bought around 2005. Battery life is one of their main selling points and the only reason I have one over a proper smartwatch. Maybe have a second look at optimising the settings for battery life. There are quite a few recommendations on how to do that.

That model plays music and uses an OLED display. Playing music off the watch burns through battery IME and I'm betting how you've configured the OLED display matters. It's "Up to 13 days" and I'm guessing those 13 days don't involve using GPS, don't involve playing music and don't involve using always on display. Misleading maybe.

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#45

Earlier quoted context omitted.

Your 265 can be mounted as a usb drive, as can pretty any Garmin device for maybe 10+ years.

On a Mac, it requires some utility made for reading Android devices. It doesn't pop up as a drive when plugged in. Can the device receive notifications from my iPhone without an account? That's one of the main reasons I use the device.

Yeah, because Apple doesn't support MTP at all. On OSs that do they just pop up.

I think to get notifications it has to use the app.

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#46

Anyone got a recommendation for fitness wearables where you can opt out of having to sign up with an account, and can export data out of it in open/standard formats?

We had one. It was called Pebble. And then they kickstarted a watch for 3 million and decided to sell themselves to fitbit instead.

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#47

Anyone got a recommendation for fitness wearables where you can opt out of having to sign up with an account, and can export data out of it in open/standard formats?

Only tangentially related, but let me plug my new project https://cubetrek.com, a Strava alternative for viewing and managing your GPS tracks.

As discussed in https://news.ycombinator.com/item?id=35671245

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#48
> The Atredis' CVE-2020-27486 advisory explains that the news opcode allocates the string buffer based on the length specified in the string definition, and then proceeds to call strcpy to copy the string bytes. This can lead to memory corruption, since strcpy does not use the specified length and will only stop at the first null byte.

How can seemingly talented developers KEEP MAKING THIS MISTAKE? It is like almost every police officer shooting themselves in the foot with their service gun.

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#49
post #18

I’m very impressed by the level of technical detail in this post. I’m somewhat surprised garmin made their own language for apps but considering the low power processors they target was their any other options?

strict subset of JVM, like the old days of mobile phones and SIM cards

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#50

Anyone got a recommendation for fitness wearables where you can opt out of having to sign up with an account, and can export data out of it in open/standard formats?

Look at the supported wearables for GadgetBridge https://codeberg.org/Freeyourgadget/Gadgetbridge FOSS, doesn't have network permissions, can export data or interface with other apps

+1 for this. It makes my Amazfit watch from a privacy nightmare into a great cheap privacy conscious watch.

I just wish it could export SpO2 values and update the AGPS almanac. Because of this a GPS lock takes very long.

Post reply on HN