Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM • Hacker News Board

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#71

Post by qrohlf » Mon, Apr 24, 2023, 4:05 PM UTC

depierre wrote: post #68

qrohlf wrote: post #66

My sense, as someone who has written more than one CiQ app is that Garmin got caught completely by surprise with the popularity of 3rd party apps on wearable platforms and MonkeyC graduated from “interesting side project” to “critical ecosystem capability” in the space of a couple months, years ago. The early CiQ SDK versions had some truly insane conventions like using constants named “THAI_SPICY_HOT” for font sizes…

Your remark seems to match what I've observed during the reverse engineering part of the project. With magic constants like `0xc0debabe` [0] or opcodes like `canhazplz` [1] that you would expect more from a student CS project for instance. [0]: https://github.com/anvilsecure/garmin-ciq-app-research/blob/... [1]: https://github.com/anvilsecure/garmin-ciq-app-research/blob/...

Yeah, exactly. THAI_SPICY_HOT was just one of many signals that I got that the MonkeyC project could have very much started out as an intern project or similar.

The list of languages the documentation claims MonkeyC takes inspiration from also denotes a certain type of programmer background:

> C, Java™, JavaScript, Python™, Lua, Ruby, and PHP all influenced the design for Monkey C

(source: https://developer.garmin.com/connect-iq/monkey-c/)

If I asked an embedded hardware expert to design a novel programming language for my highly resource-constrained wearables platform, I would be very surprised if these were the language touch points they used as their references in the design brief.

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#72

Post by Ruthalas » Mon, Apr 24, 2023, 5:12 PM UTC

LelouBil wrote: post #41

SturgeonsLaw wrote: post #2

Anyone got a recommendation for fitness wearables where you can opt out of having to sign up with an account, and can export data out of it in open/standard formats?

Look at the supported wearables for GadgetBridge https://codeberg.org/Freeyourgadget/Gadgetbridge FOSS, doesn't have network permissions, can export data or interface with other apps

I can also vouch for Gadgetbridge being a great option.

I use it with a MiBand 6.

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#73

Post by nradov » Mon, Apr 24, 2023, 6:10 PM UTC

saltcured wrote: post #63

capableweb wrote: post #53

Earlier quoted context omitted.

Depends on the device I'm guessing. AFAIK, not all Garmin devices log location 24/7, but only when explicit activities have been started.

Don't a lot of people start and/or end their regular fitness runs or bike rides at their doorstep? The thing about these fitness tracking tools is that you start wanting to track all your activities to get the statistical trends. It becomes integrated into your day to day lifestyle.

Yes, that is common practice for some athletes. The Garmin Connect platform has pretty good privacy controls which allow users to hide activities or mask tracks near certain locations. Of course if Garmin gets hacked then all of the raw data could be exposed, but the same concern applies to smartphone platforms as well.

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#74

Post by ben7799 » Tue, Apr 25, 2023, 3:18 PM UTC

Great article. I've owned a bunch of Garmin devices. Right now I'm not sure if any of them even support Connect IQ. When I tried Connect IQ the apps rarely did anything I much cared about.

If I cared about that kind of thing I'd be wearing an Apple Watch. I like the Garmin devices cause they're so much simpler and does the specific built in sports functionality very very well. They are also far more tailored towards being functional whether or not you have internet connectivity.

I would far far prefer Garmin to make Garmin Connect on iOS/Android work without internet connectivity than almost anything else. It's ridiculous the devices (this is not just watches) can't sync to the phone for you to review data on the phone if you there is no internet. What they do right now is send everything from the device right to the cloud, then have the phone download something else from the cloud.

In my case one of my devices (Edge 1030) is completely capable of mapping and navigation without any internet connectivity but you can't do anything on the phone with the data till you return to internet connectivity.

Garmin even has another app (Explore) that has mapping on the phone without internet connectivity once you download the maps. The mapping data in that app is amazing. Yet Garmin Connect only works with Apple Maps data, not Garmin's own map data. When you're on the Garmin device you get a vastly superior map compared to what Apple maps can provide!

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#75

Post by xur17 » Tue, Apr 25, 2023, 3:52 PM UTC

ben7799 wrote: post #74

Great article. I've owned a bunch of Garmin devices. Right now I'm not sure if any of them even support Connect IQ. When I tried Connect IQ the apps rarely did anything I much cared about. If I cared about that kind of thing I'd be wearing an Apple Watch. I like the Garmin devices cause they're so much simpler and does the specific built in sports functionality very very well. They are also far more tailored towards…

> I like the Garmin devices cause they're so much simpler and does the specific built in sports functionality very very well. They are also far more tailored towards being functional whether or not you have internet connectivity.

I wholeheartedly concur with your point. Garmin watches excel at sports tracking as their primary focus, with notifications and messaging features taking a backseat. Conversely, Apple and Google watches prioritize communication functions.

Previously, I owned an Android Wear watch, primarily for monitoring my runs. Although it sufficed, I found myself wearing it exclusively during runs. The device required daily charging, had an irritating touchscreen, and lacked navigation capabilities without being paired to a phone, despite its built-in LTE modem.

A few months ago, I opted to purchase a Garmin Fenix 6 watch. Upon using it for several days, I recognized that this was the device I had initially sought. The battery life spans two weeks—although heavy GPS use reduces this to about one week—and the watch includes maps for the entire United States. I have found it invaluable for hiking, running, and more, and its exceptional performance has led me to wear it continuously rather than solely during activity tracking.

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#76

Post by tweetle_beetle » Tue, Apr 25, 2023, 7:26 PM UTC

SturgeonsLaw wrote: post #17

jeroenhd wrote: post #3

Earlier quoted context omitted.

I'm not aware of any major brands that offer account free service. The problem is that a smart device like this is not worth much without some kind of app ecosystem, app stores generally demand accounts, and browsing app stores from a watch is not exactly ideal. As far as I know, Tizen smart watches can function well on their own after setting up the account once and I believe cloud synchronization is even optional.…

PineTime looks like a fantastic product and if it supported GPS it would probably be the one that I purchase. I've also seen this one mentioned in my research but would love to hear from anyone who's used it: https://banglejs.com/ Thanks for the InfiniTime links, I'll check that out.

I own a Bangle.js 2 and really wanted to like it. I have a pretty high tolerance for awkward workarounds to maintain a moral high ground, but it just was no fun. The touchscreen tended not to respond as expected - it seemed to regularly, but not always, have an input offset of around 20% of the screen. My first one's button broke despite minimal use due to the above - only really wore it as a novelty (it was replaced to be fair). The app ecosystem requires attention to stop different apps intefering with each other. The Gadgetbridge connection wasn't especially reliable for me. Etc.

I finally gave up when I found the tiny magnets which hold the charger on to the watch had fallen out and were lost when I went to charge it one day.

Re: Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

#77

Post by sam_lowry_ » Thu, May 04, 2023, 2:36 PM UTC

wkat4242 wrote: post #50

LelouBil wrote: post #41

Earlier quoted context omitted.

Look at the supported wearables for GadgetBridge https://codeberg.org/Freeyourgadget/Gadgetbridge FOSS, doesn't have network permissions, can export data or interface with other apps

+1 for this. It makes my Amazfit watch from a privacy nightmare into a great cheap privacy conscious watch. I just wish it could export SpO2 values and update the AGPS almanac. Because of this a GPS lock takes very long.

Late Amazfit watches require online signup in a quite cumbersome way in order to pair.