Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

anvilsecure.com

Post reply on HN
Print view View original

51–60 of 77 posts

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#51

Post by lawn »

heywhatupboys wrote: post #48

> The Atredis' CVE-2020-27486 advisory explains that the news opcode allocates the string buffer based on the length specified in the string definition, and then proceeds to call strcpy to copy the string bytes. This can lead to memory corruption, since strcpy does not use the specified length and will only stop at the first null byte. How can seemingly talented developers KEEP MAKING THIS MISTAKE ? It is like almost…

When smart people keep making the same mistakes, we need to realize that there's a problem on the systemic level.

In this case: C is riddled with these easy-to-make mistakes, and it's not enough to think that "a smart developer" is able to avoid these mistakes, but that everyone will make these (or similar) mistakes as long as we're allowed to.

It's one reason why I'm so big on Rust: because these mistakes are much harder to make.

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#52

Post by krono »

distantsounds wrote: post #46
SturgeonsLaw wrote: post #2

Anyone got a recommendation for fitness wearables where you can opt out of having to sign up with an account, and can export data out of it in open/standard formats?

We had one. It was called Pebble. And then they kickstarted a watch for 3 million and decided to sell themselves to fitbit instead.

They never shipped out my Pebble Time 2 before the project (and company, for that matter) got shelved. Something I'm still sad about even today.

No other smartwatch released before or since has even come close to Pebble's Pebbles.

Kickstarter page is still up: https://www.kickstarter.com/projects/getpebble/pebble-2-time...

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#53

Post by capableweb »

ornornor wrote: post #31
hackernewds wrote: post #23

Earlier quoted context omitted.

> This is with syncing over USB btw. Nevermind it is not worth the trouble, vs handing in anonymized data with a temp email

Right, anonymized data that shares your vitals 24/7 (which are fairly unique) and location data which totally cannot infer your home and work locations. You’re deluded if you believe this can truly be anonymized and stay anonymized.

Depends on the device I'm guessing. AFAIK, not all Garmin devices log location 24/7, but only when explicit activities have been started.

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#54

Post by m-p-3 »

SturgeonsLaw wrote: post #17
jeroenhd wrote: post #3

Earlier quoted context omitted.

I'm not aware of any major brands that offer account free service. The problem is that a smart device like this is not worth much without some kind of app ecosystem, app stores generally demand accounts, and browsing app stores from a watch is not exactly ideal. As far as I know, Tizen smart watches can function well on their own after setting up the account once and I believe cloud synchronization is even optional.…

PineTime looks like a fantastic product and if it supported GPS it would probably be the one that I purchase. I've also seen this one mentioned in my research but would love to hear from anyone who's used it: https://banglejs.com/ Thanks for the InfiniTime links, I'll check that out.

I own a BangleJS2. I don't use the fitness features but it works quite well on Android with GadgetBridge, a pricacy-focused smartwatch management app, and the OS and apps are all open-source. It was a bit rough around the edge when it came out, but so far it's been quite stable. I even made some PR fix some annoyances.

You can check all the available apps here, there should be something that will monitor which fitness activities you want, and the data can easily be exported from Gadgetbridge

https://banglejs.com/apps/

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#55

Post by depierre »

edude03 wrote: post #18

I’m very impressed by the level of technical detail in this post. I’m somewhat surprised garmin made their own language for apps but considering the low power processors they target was their any other options?

Author here. Thanks!

I am surprised as well, especially considering that their compiler does little to actually no optimization. For instance, it won't remove dead code or unused variables. These seem like low hanging fruits that could save memory and cycles on low power devices.

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#56

Post by xebbler »

edude03 wrote: post #18

I’m very impressed by the level of technical detail in this post. I’m somewhat surprised garmin made their own language for apps but considering the low power processors they target was their any other options?

Pebble ran third party native apps (generally written in C) sandboxed via the ARM SVC/USR-mode privilege system, integrated with the onboard MPU.

Fitbit - after hiring many Pebble staff - supports third party apps written in JavaScript. These run on the pre-existing JerryScript engine, and are still sandboxed on the native side should the VM have holes. This made it much easier to get started as a developer, but imposed an upper limit on app performance vs. the native apps seen on Pebble.

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#57

Post by depierre »

ck2 wrote: post #16

I've long wished for a Cyanogenmod (LineageOS) for Garmin But without source that can't ever happen I guess. Also I think they encrypt firmware after the 5 series in the Fenix 6/7 models Coros has proved it is possible to use cheap hardware to make clones but their metrics are supposedly nowhere near as good as the Firstbeat algorithms.

Author here.

They did start encrypting the firmware of their latest devices. I noted that the firmware images for Forerunner 55, 945 and 955 were encrypted. Most likely others are as well.

In the live demo I did at Hack in the Box a couple of days ago (slides available [0]) I've shown how to exploit one of the vulnerabilities to read the memory of the Forerunner 55, making it possible to dump the firmware unencrypted. The CIQ demo app is also on our GitHub repo [1].

[0]: https://conference.hitb.org/hitbsecconf2023ams/materials/D2T... [1]: https://github.com/anvilsecure/garmin-ciq-app-research/tree/...

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#58

Post by depierre »

stonepresto wrote: post #13

What is the "so what" here? Are these internet connected?

Author here. Fair question!

They get access to the internet via the Garmin Connect companion app. But if you're asking to know if they can be exploited from the internet, that's not what we showed yeah.

The vulnerabilities we've disclosed require a malicious app to be installed (e.g. from the CIQ app store) so let's not cry wolf.

What I think this project highlights and what we should remember is the current level of security of Garmin devices.

GarminOS deploys none of the security mitigations one would expect in modern devices (let's exclude crappy IoT devices flooding the market). No stack canaries, no W^X, etc. It does not implement isolation between user-supplied code and the rest of the OS either. And their C code base does not appear to receive much scrutiny in terms of security review.

It would be much easier to exploit the watch (e.g. sending a malicious message to the user's phone that sends it to the watch to show the notification) than exploit the user's smartphone. And this could be performed from the internet.

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#59

Post by gnicholas »

goosedragons wrote: post #44
suddenclarity wrote: post #30

Earlier quoted context omitted.

Are you doing something special with the watch? I've gotten several weeks out of all my Garmin models except the first one I bought around 2005. Battery life is one of their main selling points and the only reason I have one over a proper smartwatch. Maybe have a second look at optimising the settings for battery life. There are quite a few recommendations on how to do that.

That model plays music and uses an OLED display. Playing music off the watch burns through battery IME and I'm betting how you've configured the OLED display matters. It's "Up to 13 days" and I'm guessing those 13 days don't involve using GPS, don't involve playing music and don't involve using always on display. Misleading maybe.

Yeah, and I don't do any of these things. I just get notifications from my watch and use it as a remote control for podcast playback/ffwd (from my phone to my AirPods). And I have AOD turned off.

The "up to 13 days" number is based on a specific set of behaviors/usage, [1] and the Garmin support people have not been able to explain why I'm not getting it. They have looked at logs for my device and have been content to say that 60% of the "up to" number is normal for their devices.

I was hoping for much better, especially considering the Verge's reviewer [2] said she was getting 6.5 days with AOD turned on, and was on track for 15 with it turned off. I wonder if she was given a bespoke unit by Garmin, which is better than the ones that we get in retail stores.

1: https://support.garmin.com/en-US/?faq=daNp4hnaAZ9Fg1XdFcZez5

2: https://www.theverge.com/23632332/garmin-forerunner-265s-rev...

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#60

Post by gnicholas »

ilikehurdles wrote: post #39
gnicholas wrote: post #12

Earlier quoted context omitted.

Really? I recently got a forerunner 265 and it definitely didn’t give the impression that was possible. The battery life is also nowhere near the advertised length (13 days). Most disappointing is that their support people say to expect about 60% of that, which is what I’m getting. That said, this will likely be the replacement for my Pebble. Battery life over 6 days, buttons to control music playback, and an English…

The SpO2 sensor uses significant battery life. This is why is princely only enabled during workouts and sleep, but it can be set to run nonstop or not at all. Double check that setting. My 945 is pretty close to advertised when I’m not too active.

Yeah I have this disabled. I’ve chatted with their support team several times and they’ve confirmed my settings are about as low-energy as possible (aside from disconnecting from my phone, which would defeat the purpose).
Post reply on HN