Garmin services and production go down after ransomware attack | Hacker News Reader

Garmin services and production go down after ransomware attack

zdnet.com

226 pointsfbnlsr223 comments

Their products are designed to work offline. Despite the cloud being down I have full local functionality right now. (Though I can't see my history, surprised they don't cache that locally).

Last year when I did a 9-day canoe trip with no cell phone reception, all of my Garmin gear worked flawlessly (wearables, navigation devices, and their offline map app). Can't say the same about my friends iWatches/fitbits or even some stuff on various stuff of iPhones and my pixel.

Do they? Last Garmin product I had was a Vivosmart HR: an internet connection and a Garmin connect account was required to change basic settings such as the display orientation. And there was no way to disable syncing.

The Vivosmart is more like a Fitbit. I don’t see it as a stand-alone device.

Does it still count steps and track your heart rate without internet?

Based on my experience using a Vivosmart 4 for sleep tracking, often in remote areas w/o mobile signal, it does store that data to be synced later. Obviously it has a finite memory but I don't recall having ever lost data from the device.

I tracked a 20 day trip down the Grand Canyon on my VivoSmart.

I think it has the storage for a few months worth of continuous tracking before it needs to sync to free space.

My Forerunner 935 is basically the same story today. I can't do anything on it via the mobile apps. I guess I probably could do something with their desktop app and the USB cable, but it's really struck me how crippled the device seems today with their servers down, basically nothing is available or works at all through either Garmin Connect or ConnectIQ mobile apps. The apps don't appear to have any recent data cached locally either.

I'd consider my Forerunner 220 almost completely un-crippled. I went for a run this morning, tracked it and got pace and distance information the whole time. If I look at my wrist, it tells me correctly that the time is currently 9:49 AM. If I unlock the device and scroll to the History tab, my run, and all previous runs since last September and their details are visible there. It acquires the GPS satellites the same as it always has. If I push the start button, it starts a new run.

It's true that I can't open my phone or PC and view past activities, but that's a very small part of the way I use my watch.

What are you doing with the mobile apps that makes your watch crippled without the Connect apps?

I can't alter a watch face - i.e. alter the fields displayed. I'm not wanting to download a new face, just alter one already download and present in the app and on the watch, or alter any data fields around specific activities.

I get syncing to any 3rd party service is clearly totally out unless I manually transfer the .fit file via USB and I understand why this would need their servers, although it would be good if the mobile app allowed transfer of these files, without requiring a laptop and USB cable.

There's no reason for the entire mobile app to be totally and utterly broken because their servers are down. There's a huge amount of functionality in there that should just work locally without needing an internet connection. I can't even set an alarm via their app without it needing an internet connection!?

There is absolutely no reason for requiring an internet connection for basic features such as setting an alarm or the 12/24h time format. I contacted Garmin customer support and they replied with corporate PR stuff, not answering my questions. I sold the watch a couple weeks later, won't buy Garmin again.

On my Garmin 935 I can set an alarm directly on the device without using the mobile app.

I can do all of that directly on my 735.

Unlike on fitbit, I can set an alarm directly on my Garmin watch. (Vivoactive 3).

I consider this a huge +

I agree that the mobile app shouldn't be broken with the server down, but I've got a FR 935 and can alter my watch face and set alarms through the watch.

Watch Face

1. Hold down up/menu

2. Hit start

3. Select Watch face

4. Hit start

5. Select customize

Alarms

1. Hold down up/menu

2. Click down to select clock

3. Hit start

4. Hit start again to select alarm clock

5. Navigate down to add alarm

many people (I have no actual data to say whether it's "most" or not) buy these things and pay the related premium prices so they can use many more of the features they come with that the basic ones you list.

Try creating a relatively complex multi-step workout without garmin connect now that the old win 3.1 looking desktop app doesn't work anymore

The inability to change settings or sync data from a local device connected via Bluetooth is a huge flaw. The inability to view historical data in the app is more understandable but still a major shortcoming, especially since mine appeared to be cached until the last cloud update timed out and the cached data disappeared.

I'm fairly certain memory isn't an issue for my devices to continue collecting data, but there's no good reason to prevent Bluetooth comms between phone and watch when the internet is unreachable.

source: I use a Forerunner 945 for fitness & all-day tracking, and a Vivosmart 4 for sleep tracking

That's how the higher end Forerunners work, too, for that basic functionality -- but the more advanced stuff that the 220 doesn't offer are the things being discussed here.

> My Forerunner 935 is basically the same story today. I can't do anything on it via the mobile apps.

I also have a 935.

Today I've so far recorded two activities. I can see my heart rate, and RHR for the last 7 days, I can see my training status (including VO2 max, lactate threshold, etc), I can see footsteps taken today and over the last 7 days, I can see my calendar, I can see my calorie burn today and over the last 7 days and I can see details about activities recorded on the device all the way back to December 18th.

The device isn't at all crippled.

I could see all of that stuff (Garmin Instinct) until the app refreshed, and it all disappeared. Now only shows my steps and calories.

That said, I don’t care too much. I only use the app to track my weight and look at historical data for runs. Honestly the watch doesn’t lose much value to me

It's still there for me too on my Vivoactive 3.

Depends on the product. Something like an Edge bike computer will be fine at least.

Although I do wonder if my ride this morning actually happened because it's not on Strava... :P

In case you don’t know this, you can connect your garmin device to a pc and manually upload the .fit file (the device looks like a usb storage device to pc/Mac) from the device to strava

They prompt you when you download Garmin Connect about whether you want to upload your data or not. If you choose not to upload then they'll store a local copy and let you look at some basic stats.

It's under Settings > Profile & Privacy > Data > Device upload. But it constantly shows "an error has occured now".

All devices function as USB mass storage devices as far as I know, so no data is lost.

I was planning to load a bike route from komoot on to my FR735 later today which will take an additional minute without Garmin servers. They're surprisingly optional.

except for possibly the data that is in the cloud and not stored locally any longer.

FYI for anyone else reading: Google maps lets you download maps for offline use.

Getting that to work consistently is a real pain in the ass. I drive around Europe a lot and I'll download maps to save on roaming data and often I've downloaded a place and my phone still wont be able to generate directions for me. I don't know if I miss little spots that are needed to connect my end points or if it is just broken. It's been this way for quite a while. I've downloaded routes themselves and had that fail as well.

Last time I tried, Google maps wouldn't do any kind of offline routing for walking or cycling, amongst other annoying limitations.

That's because Google requires their servers to offload their patented Most Dangerous Path algorithm for cycling directions.

The Graphhopper routing service is great for cycling. It even has different bike profiles, walking and hiking. The bike profile is essentially a touring bike and the algo is tuned to avoid slopes. Road bike sticks to the road, MTB uses backroads and footpaths. Hiking prefers more scenic route even if they're longer.

There are also quite a few offline navigation and hiking/adventure apps. Standalone GPS devices can be rugged but that's about their only advantage. It's silly to complain about smartphones not working off the grid when all you have to do to fix that is tap a button before you leave home.

Here we go (silly name) allows for offline maps as well and it's pretty good software.

It has a transactional guarantee of "maybe". I would _definitely_ not rely on this functionality for anything other than non-critical or time sensitive casual navigation on roadways.

When I'm out in the bush, I need my device to be up and working locally. It seems that stuff designed in SV just assumes the lifestyle of 100% connectivity is universal.

Do you have any recommendations for digital mapping solutions that “just work” without connectivity?

Trailforks is power hungry but is great if you're on-trail. If you're off trail, hilariously Garmin Explore I think is pretty good, you can download Topo and USGS maps, but logging in isn't working right now :) so look elsewhere

maps.me has saved me many times in places with zero connectivity. I can also import my planned adventures as kml files to be sure I'm on track.

Gaia GPS is fantastic. You can mix and match layers, and specify what bounds you want to download for a trip.

Right now I've got 3 GB stored locally, some of that for the usual locations that I wander out of connectivity, and some for a trip next week.

Garmin (formerly Delorme) Earthmate despite their other issues is great for state or province wide vector maps. Not as great for fine navigation and tracking (as it's designed to be paired with and control an InReach), but good for point of interest exploration.

I love Gaia on my iPhone and iPad, but I’ve had real problems with map layers not displaying lately. MapBox Streets and Gaia Streets are both hosed and I can’t figure out why.

Typical satnav devices work fine without internet connectivity. Of course, such a device won't work if it can't connect to satellites providing positioning data but I think that was not what you had in mind when you said "connectivity".

Forgive the potential facetiousness of my reply because I know it's not exactly what you're asking for, but if you know where you'll be then save the images somehow. Knowing how flakey Apple Maps is without connectivity, if it's important, then I'll take screenshots of the route before I leave, for the same reason I'll print out important slides of a presentation because even a lo-fi plan B is better than total failure.

Are online maps really that much better than a paper map? The only real improvement is the same as that of mp3 over carrying a walkman and bunch of tapes. There's not much beyond that, for all the hype.

Like so many things (Amp/SPA websites; social media; 24 hour rolling news…) they seem to me to not really improvements over what we had, because someone somewhere tried to lock the customer in. Maybe that's just misanthropic luddite me.

Here Maps for vehicle nav. If you download the maps of course. OSMAnd and Windy Maps w/ on device maps for outdoor. Here is also used on Audi's satnav I think. The voice is the same and the missing roads are the same.

OSMAnd.

https://osmand.net/

I installed it on my old phone (and the new one and my tablet .) I placed it on a handlebar mount and I'm mapping and navigating my vacation.

And given that GPS services are free, it's fantastic when you need to find your way around a town in a foreign city. I was using it to find my way around the medina in Marrakech last year.

Osmand has full offline navigational functionality for free and uses as well as contributes to the open street maps data set instead of a proprietary one. I've used it to save my bacon a few times when I tried to start navigation well away from cell coverage.

What about their Inreach products, which are designed for backcountry SOS emergency calls to search and rescue? That certainly needs a network.

From my understanding it doesn't rely on the internet or Garmin servers. I believe it was called Iridium satellite network. It needs to work anywhere on the planet. It is a separate subscription based service.

They do use Iridium, but its not clear who runs the end-service...if you use the SOS feature, it contacts a Garmin center (i believe), who then dispatch the appropriate services. Its not an actual sarsat plb.

So if Garmin's system is down, there is a very real risk that these services won't have anyone on the other end to answer the call.

It doesn't contact Garmin. It's a shared emergency response center akin to some home security system companies. They share with a few tracker services.

Update: The use GEOS https://www.google.com/search?client=firefox-b-1-d&q=garmin+...

Do you happen to know the name of the company? I didn't see one while i've been browsing for it, and it doesn't seem to be iridium themselves

edit: Thanks!

GEOS https://www.google.com/search?client=firefox-b-1-d&q=garmin+...

Messaging and SOS are up, billing is the only thing that's down: https://status.inreach.garmin.com/

InReach messaging was down for quite some time. It worked wed am, did not work at all after that (either sending or receiving) through mid day fri at which point sending was very spotty (messages sent to groups were not received by all group members). Appears to have improved by Friday evening but not 100% even then. Saturday 25th it seems to be working... no idea if SOS was similarly impacted but I would suspect it may have been.

For anyone considering an InReach: If you only need it for SOS (not for messaging), it’s a very bad investment. You can get a cospas/sarsat based PLB which has the same SOS functionality with no subscription fee. It’s funded by various governments.

About two weeks ago, my wife, young sons, and father-in-law saved the life of a hiker in Colorado using an InReach. The messaging helped dispatch decide to send helicopter. According to doctors, she had less than an hour to live by the time she arrived.

Also, having the messaging functionality meant that we knew they weren't injured.

Beacons don't allow you to provide details, but they are better than nothing. Out of 30 hikers that passed by, my family was the only one with satellite-based emergency reporting capability.

I was give a garmin vivofit 3 as a gift and was soured by the fact that I had to create an account and log in to set the time.

I've been very slowly working on a fork of gadgetbridge[1] to support the vivofit 3 for a while now and can successfuly set the time with no account!

1: https://github.com/mjsir911/gadgetbridge

Exactly the same here, except I got Vívomove HR. My fork with WIP implementation for Garmin is at https://github.com/mormegil-cz/Gadgetbridge/tree/garmin-wip Basically everything (time, FIT data sync) is working except the primary thing I wanted (notifications) which seems to work fine, except it does nothing. (And the code is ugly and sometimes problematic.)

> to set the time.

A month or two ago I was stumped by this on my Forerunner 735: the time was wrong but I could not find a way to set it, even after a factory reset. Turns out the time sets itself from GPS after a solid lock, but you have to make it trigger a lock, by e.g starting an activity. Only after the on-device setup and having a correct time did I sync it with the app (it wasn’t even phone paired)

Garmin Connect app won't even show you data sync'd from a watch unless its online and connected. Simple things like hours slept, or miles walked will not show. Right now it just has a "server maintenance" message, and won't show anything that uses a graph, or historical data...nothing is stored locally.

On my recent hiking trip, the watch had no problem recording and sync'ing tracks, but the connect app refused to render any of that data until mobile data was connected again.

Just never use apps that require cloud connection to store your data.

I can see current stats in app... steps, weakly activity and so on. Sync doesn't work properly, but high level stats are there.

Update: it won't load the weather anymore either. I'm fairly sick of the 'cloud' in general nowadays

I can't use the express app with my watch, even though I got the link to the express app from my watch's documentation page :D good grief

I can upload basic metrics from my Fenix 3 (steps, HR, etc) and see them in the app but I can't upload an activity I did earlier today (a run) to see the stats on it.

You can upload the activity via PC: the FIT files are directly accessible via USB mass storage in the "Activity" directory. This allows you to upload FIT files to cloud-based services such as Strava to see your running stats, or into a PC-based application to do the same locally.

I seem to recall my iWatch syncing fine without cell service. I've got a Forerunner 945 right now, it's always stunned me that the app caches nothing. You cannot so much as see how many steps you had or how many hours of sleep you got without data service to your own. And Garmin software is... not exactly first-rate, let's put it that way.

I can't add a new device. just got a garmin index scale and it's a paperweight until they solve this.

Ouch. Index 2 is being released this autumn.

Don't worry, even if you could add the scale to your profile the scale doesn't currently work.

I concede the point though changing settings on some of their devices should not require the cloud. I appreciate their design allows you to change stuff from their web console and apps, but the dissenters in this thread make great points with good counter examples.

A leaked email from Garmin's Taiwan office says everything including the production line has been shut down for two days: https://translate.google.com/translate?sl=auto&tl=en&u=https...

Local media suspects a ransomware attack, which is about the only thing that could explain how widespread this is.

Can confirm it is a ransomware attack.

Source? Do you work there? Do you know whats the ransomware used or how much they're demanding?

Total speculation, my guess is WastedLocker. It has been hitting all types of companies in the past few months. Have a friend who's company was hit recently. They were somehow were able to encrypt the backups.

My vote is something's being held for ransom like DNS or account access rather than traditional storage encryption. It's pretty impressive if storage encryption crossed so many network boundaries and affected so many diverse resource types - phones, chat, email, website, distributed app platform. What other central resource besides DNS would have such a broad impact?

Or their network isolation is very poor, super common in older tech companies.

Or they're hugely Windows based (Exchange, SQL Server, AD Servers, etc) and the same exploit got into a huge number of diverse machines.

Or shudder far reaching writeable network mounts.

Yes, exactly. My friend's company was Windows based with mapped drives to external servers.

> Total speculation

The link was updated more than 2 hours before your comment to a zdnet article that even mentions a WastedLocker variant.

Looks like their backups were mishandled. Any listing of best practices for backups includes their being stored offline.

And the list of best practices for ransomware attackers includes keeping a low profile for a an undisclosed timespan before sending demands so that the victim does not know how far back the last clean backup would be. Backups are an important tool when solving the attack, but they are not the solution.

I guess I always assumed Garmin made most of their money on their aviation products, since they are so dominant and so expensive. And those are designed to rarely if ever connect to the internet. But I guess I was pretty off on that, they’re only 20%.

On a side note the graphs of their revenues per year and by category show a company that successfully branched out when their former big category, automotive, which was 80% of their revenue, began to be eaten by in car GPS and then smart phones.

I used to sell Garmin car GPS back when I worked in a retail shop. They were really good devices. But yeah I'm with you I thought most of their money came from aviation (it seems like everyone uses Garmin products), but their sports watches sell like crazy.

Actually, I realized their network was down because this morning my watch would not sync after a run. :)

Honestly, they're still really good devices. I have one from last year that's a solid alternative to an in-dash navigation screen, and for what I use it for, just as good as Google Maps, and in many ways better (way more convenient and customizable, completely offline except traffic, bigger screen, auto-on...).

Their latest motorcycle units are dog slow because some dumb product manager decided to build it on their old hardware platform using newer firmware which isn't a good mix. I have a 10 year old auto unit that is better then the junk they have now.

Yeah I noticed this morning too, Garmin Connect says "maintenance" but of course HN has the real story.

I've found even the absolute cheapest Garmin car GPS to be better than other brands 3x the price. I got some clearance-bin obsolete-model $99 Garmin GPS for my camping/roadtrip beater car and it's infinitely better than most the others I tried that were 3-4x the price (returned 2 other more expensive ones before giving up and buying the cheap Garmin).

My small sailboat has over $5k in Garmin navigation electronics. I love that whenever I've had a problem I can almost immediately reach a knowledgeable and helpful support employee in Kansas (I think?) to help me.

Used to work in Garmin's marine division on these products.. thanks for the kind words and bringing up fond memories :)

GPS (obviously) and what else? Weather? Fish finders? I know next to nothing about sailing.

Radar, wind speed and direction, water speed, depth, water temp, and I also have their forward scanning sonar transducer.

For many many hours already, including SSO, their webshop, and all of Garmin connect. The devices can't sync anymore, the mobile apps are all but useless and Garmin has yet to comment on any of this. Yikes.

It's weird that everything Garmin related is down. I wonder if they got hacked or something similar and just took everything offline.

Their response is also weird, seems like internal infrastructure is also down.

"We are currently experiencing an outage that affects Garmin Connect, and as a result, the Garmin Connect website and mobile app are down at this time. This outage also affects our call centers, and we are currently unable to receive any calls, emails or online chats. We are working to resolve this issue as quickly as possible and apologize for this inconvenience."

I’m guessing they pulled “the plug” on everything once they saw the ransomware was spreading.

Probably after losing a few rounds of whack-a-mole with partial shutdowns.

Might even be a better customer experience, a few days of a clear "Garmin is down, do everything with cables like they did back in 2010" is much less frustrating to deal with than all the services being in some form of flaky brownout state where nothing ever works reliably and you keep trying and failing.

It's made me realise how crazy reliant my Garmin watch is on their infrastructure. I went onto the app this morning to try and alter a watch face I already have downloaded, which should totally be configurable through just the mobile app alone. Why the hell does it need to talk to Garmin's servers to let me do this? It should just be possible through the app alone, without needing any involvement from Garmin's servers.

Depends on your device, but on a Fenix you can swap/configure watch faces directly on the device.

https://www.ithome.com.tw/news/139004

(I'm not sure if it's reliable)

This Taiwanese tech site says because of virus, IT system and production line are down for two days according to insider.

they claim it might be ransomware.

It is ransomware.

Yep, I have a friend who works there. Not looking good right now.

Holy crap.

Would love to know if they've lost control of their Play Store accounts, i.e, is there any risk of compromised app updates?

My own pure speculation: imagining they shut the service off so no new data comes up and are aiming for an RPO of last night or some time earlier on the 22nd. Two days to do full restoration of services and global user data, meanwhile people trying to convincingly patch vulnerabilities.

Say a prayer for the IT people trying to fix this.

This is frustrating. I have a Garmin Fenix 6X Sapphire (that I absolutely love) and on seeing this headline I checked the Connect app on my phone and sure enough I cannot access any of my previous activities. You'd think that in this day and age of phones with 128GB+ storage that they'd be caching at least some of your historical data locally, but nope it's all in the cloud, which is currently inaccessible.

I've been tinkering with the idea of writing a service agent that detects when my Garmin GPS watch is connected to my desktop (where / how I charge it) and automatically pulls down any new activities to store locally as a backup.

Starting around 2012... I used to scrape my activities off of the Garmin Connect website, I eventually got tired of the manual nature of this process and also having to keep up with changes they made to their site. After that, I used something called, I believe, Tapatirik, for a while, to automatically sync them to a Dropbox account. But, it wasn't flaky sometimes, so I eventually gave up entirely and just turned on the sync to Strava option. But that also has spurious failures that are annoying to deal with. And on and on it goes...

Frustrating is one word for it. I'm at a point where I find it to be completely anti-consumer.

GoldenCheetah can do at least some of what you want. https://www.goldencheetah.org/

Thanks for that!

It's not as automatic, but Garmin BaseCamp does let you pull your activities from the watch. I believe it has an option to transfer every time it's open and a device is plugged in, but it doesn't run in the background.

I have a much older version of Fenix (v3) and I can see my activities even from the last year. In Fenix 3 it's in History->Activities menu of the watch.

This only affects viewing the activities on Garmin Connect. You can view them on the watch just fine, and you can use Garmin BaseCamp on a computer to download the GPX files.

I think working at a crypto startup has changed my life because I see stuff we store about our clients as a total liability...

Based on my experience with their invented proprietary "language" based on Java (with a busted barely-working toolchain) I'm not confident that a lot of thought has gone into doing things sustainably. It has the feeling of being held together with tape and bubblegum wrappers; that the native device and SDKs are a burden to be overcome rather than an empowering interface. I wasn't surprised that they went down during Jim Walmsley's solo Hardrock 100 FKT. I am shocked (but not exactly surprised) that they are still down 24 hours later. I loved the idea of ConnectIQ, and really really wanted them to succeed, but the crippled $500 watch on my wrist will almost certainly be replaced by another brand when its time comes.

The internet-of-things that aren't really your things strikes again. When will manufacturers learn that their hardware should function even if their services are down? The whole account/subscription tacked on for no apparent reason thing is highly irritating, and Garmin is actually better than most.

Yes the Garmin Connect mobile app ought to be able to do a lot more without a server connection. But in fairness to Garmin they don't charge subscription fees. After you buy a device you can use the service for free.

If it is up.

the Garmin devices that I own are working, it's just that I cannot synchronize the activities to the cloud.

My watch is functioning just fine. I can see historic data, log a run, tell the time etc.

The mobile app is 100% nonfunctional. Also any changes you made on the mobile app (eg editing rep counts in a weight lifting activity) are not synced back to the watch.

When I worked for Garmin, we deliberately designed products to work for as long as possible offline - the Bike Speed & Cadence Monitors (~2018) are able to work for 1 year, riding every day, then a battery change, and then another year, all before a sync to a device is required. All of the rides should be stored on-device.

What’s the significance of 365 days?

(I’ll accept “CA certificate expires” - but why isn’t there a workaround?)

Presumably related to the size of the on-device storage?

Storing stuff for so long on device is great, but I still miss Garmin Training Center where I had all the graphing and mapping on my MacBook

> The whole account/subscription tacked on for no apparent reason thing is highly irritating, and Garmin is actually better than most.

I agree that the Garmin’s app/services should be more useful without an internet connection, but I think it’s fair to say that these days customers want and expect an ecosystem that syncs their data and ties in Garmin’s devices. I wouldn’t call such an essential feature tacked on.

Has anybody tried to reverse engineer garmin's bluetooth protocols? I often want to buy one of their smartwatches but the idea of having to install proprietary software on my phone kind of puts me off. I'd love to write my own software but I don't have any experience doing bluetooth RE.

You can just get the activity files off the watch via USB if that would work for you.

https://support.garmin.com/en-GB/?faq=Ht3ZP52Kju075uKvqTqu99...

Thanks but it doesn't, I want a watch to keep track of my swimming training, I'm afraid using USB connectors would make the watch less waterproof.

I use a vivoactive 3: it has combination usb/charging port[1] that's completely waterproof and designed to be used while swimming. I believe most garmin watches share the same port design.

[1] https://www8.garmin.com/manuals/webhelp/vivoactive3/Shared/G...

I wasn't aware of that, thanks for telling me!

They tend not to put standard USB in the watch, but connections like this: https://media.dcrainmaker.com/images/2014/06/IMG_3109_thumb....

Nice, I didn't know that, thanks for telling me!

A good chunk of their watches are designed for triathalons, and if im not mistaken pretty much all use the same (proprietary) usb.

They are all perfectly waterproof. (Current owner of a forerunner 945)

try the garmin swim 2. I gave one to a coworker to try and he was really frustrated that he couldn't break it. it just kept on going, counting his strokes and all. He tried several different wearables (cheap to expensive) and he said, nothing could come close to the swim 2

What phone to do you own that doesn’t require proprietary software? What wearable doesn’t require installing an App on your iPhone or android?

I'm currently using a Sony Xperia X running Sailfish OS but I'd like to switch to a Pinephone running Postmarket OS.

I respect that you're this motivated to remain free from the clutches of the corporate overlords - but damn, it sounds exhausting.

as someone who is waiting on their pinephone order right now, a major factor for me is supporting the existence of not-google not-apple. i want other options and even though they are not great yet, if enough of us support that niche it will become better. i hope enough people buying into it now will hasten viable daily driver phones running linux proper.

I think your mobile experience and capabilities is drastically different than 99.999% of cell phone users, I could probably put another 9 in there and still be right.

I tried and had some success about 5 years ago on a Fenix 2. Protocol got encrypted afterwards but looks to be still similar (I got the Fenix 3 to "work" at some point). In any case, not an easy task by any means.

The sync protocol mostly just sends all the files to the Garmin server so there is not a lot of logic locally. I no longer have any interest in the topic but if I were to restart, I'd focus on the "Explore" protocol which seems to allow upload/download of waypoints/tracks which is all that I wanted from the device in the first place.

IIRC they have a library you can drop in a mobile app to talk to their watches. At least they did a few years ago.

I've actually done extensive work with reverse engineering garmin's bluetooth protocol for setting the time on my vivofit 3 watch without making an account!

It's mostly shambled together stuff but I have a wireshark plugin that works pretty good for the few pieces it supports

https://github.com/mjsir911/GarminBLE

I started this project with no bluetooth experience either, it's definitely been a lot of learning.

Let me know if you are interested in continuing / working on this, might give me a nudge to get back on it.

Yeah, they are complicated. Like, seven different protocols for different things. But it is workable. My WIP fork of Gadgetbridge (partially) supporting Garmin Vívomove HR is at https://github.com/mormegil-cz/Gadgetbridge/tree/garmin-wip

I can barely keep my Vivoactive 4 to maintain a Bluetooth connection with my iPhone. So frustrating, because one of the most useful tools, find my phone, is rarely available due to a broken Bluetooth connection. !!!

And since someone from Garmin is definitely reading this: Dear Garmin: we really want you to use open protocols so we don't have to install garbage software on our phones. I have an old "don't care" iphone that I use for software that I absolutely must install just to use a device. This is inconvenient and means I can only use certain functionality for that device at home. More often, I just pass on devices that need custom mobile software in order to work.

Open your protocols and you'll get lots of nerdy cheerleaders for your devices.

It took me a whole minute to disable cookies on this website with their built-in tool, and uBlock still blocked 80 scripts. For a status page.

Welcome to Garmin software quality

It’ll be interesting to see how Strava copes when the tap is turned on again. Maybe there’s some rate limiting built in but they’ll be getting a flood of accumulated data to process

I precisely like garmin watches because if you don't setup their bluetooth, you are not tracked by anyone, it's not required to connect to servers etc... It's enough for me because I only need to check BPM.

Of course there isn't any guarantee that at some point, some marketing manager won't decide to break that.

How could that happen for an existing, standalone device?

(Assuming there aren't any time bombs waiting in the code only to be fixed by a firmware update, like the GPS week number epoch rollover, of course.)

They stop manufacturing it, the parts it needs and then they wait for your standalone device to stop working.

It seems unlikely, Garmin is a very engineering led company. At least it was when I worked there 10 years ago!

Part of that engineering focus is an insane attention to the BOM, and to support(call center) and warranty (returns & repairs) costs. I think both of these things make it unlikely that Garmin will add a cellular modem to start tracking otherwise unconnected devices.

I spoke with one the engineers at their hiring event last year, I can confirm they are still a very engineering led company.

> Part of that engineering focus is an insane attention to the BOM

Do they develop their own ASICs?

Garmin does already sell one smart watch containing an LTE cellular modem and is supposed to release another one later this year. LTE is an extra cost option, like with the Apple watch.

Interesting. It surprises me how BAD most of Garmin's software is. They regularly break syncing functionality for weeks at a time. Sometimes watches need reboots to figure out how to sync to a phone. The sunrise/sunset graph on my $600 watch has NEVER been right.

You can push activities to your Garmin account but they don't bother engineering in any additional functionality, eg, to show your last activity if uploaded from outside, or to account for externally uploaded activities in your training metrics. It never feels like they're interested in improving the functionality of existing devices.

Don't get me wrong, I'm happier with my Forerunner 945 than I was with my Apple Watch, but only just. Basically, it does enough things that my Apple Watch can't do, to make suffering with the majority of things it's somewhat worse at, worthwhile as a tradeoff.

I think they're hardware engineering focused, not software engineering. Hence your Forerunner 945 will last most of a week (minus gas-enabled exercise time), where your Apple Watch goes about 2 days at most.

In that case, perhaps they should open source the software or open the hardware interface.

This might be a fine time to plug an app called RunGap - https://www.rungap.com/

Disclaimer: I'm not associated with them other than being a satisfied user of it.

RunGap takes your activity data from one service and migrates it across others - so your activities you upload to Garmin Connect will be copied over to MapMyRun, Runalyze or whatever, including DropBox and/or iCloud. It won't help you now, but in the future it may be a good way to derisk the loss of your activity history.

I think it's apple device only though. :/

There's also https://tapiriik.com for syncing.

I wonder what the root cause is? They've just tweeted that the outage is also affecting call centres and their ability to receive email. [0]

I'm glad their stuff is designed with zero connectivity in mind. Just slightly irked that my history isn't cached on my phone.

[0] - https://twitter.com/GarminUK/status/1286279863217926144

Ransomware.

I struggle to imagine what non-segregated resource would be so central as to affect their customer-facing app platform, internal email (or maybe mail gateways), and call center.

Maybe DNS got hosed? I mean pretty impressive ransomware if it swept across the company that far and wide, crossing so many network boundaries and resource types so quickly.

Maybe accounts/control being held for ransom instead of storage encryption (what I usually think of as ransomware).

When I worked there, the entire internet for the campus went down. It took down the Garmin website and everything else Garmin. The culprit? Everyone was streaming music and/or videos. Everything shared the same internet pipe and streaming music starved out essential business functions.

The next day all streaming services were blocked, and it was made clear we were being monitored for excess internet usage. Thus began the great brain drain to Apple, Amazon, and Samsung.

Well that, and the fact that they took away the nice toilet paper and replaced it with one—ply right around the same time.

One-ply toiler paper is where I draw the line. Nice toilet paper is a basic human right.

Also, WHAT company of this size would try to save on toilet paper. Are you kidding me?

While I am concerned a little for the location of my home now being in the hands of the wrong people. I am more Concerned with Garmin's Unprofessionalism... People who own yachts should probably be the most concerned..

Why's that? Concern over location data or something? I don't own a yacht but the Garmin gear in my boat assumes no Internet connection (kinda the point of the boat) and sees no impact from this event. Garmin wearables, however, are in use all day, every day, have associated PII to a minor degree, a broader audience and have been severely crippled by this. Curious what the yacht angle is that I may not be acknowledging.

Marine and aviation units don’t connect to the internet for data typically. Their inReach satellite communicators also use a totally different network that’s unaffected

We changed the URL from https://connect.garmin.com/status/ to an article with more info.

Thanks!

Does anybody have any understanding of either the WastedLocker ransom ware or Garmin's internal systems that can explain how it can have such a massive affect on its website, production backends (including airplane navigational systems), call centre, and possibly manufacturing systems. Is this windows everywhere? or badly partitioned systems or have they pulled the plug on everything just to be sure

A close relation of mine got sick back country hiking and needed to text for someone to meet at a rendezous just this week using Garmin's texting services - I hope that this doesn't last long, I'd hate to think of what would happen if he'd tried to ask for help today.

Edit: Looks like Garmin 'Explore' is still up, so maybe it'd still be OK.

I think the Inreach sat services operate on the iridium network. They don't sync with or connect to Garmin Connect based on my experiences.

That's good to know, and reassuring.

Update: They use GEOS https://www.google.com/search?client=firefox-b-1-d&q=garmin+...

InReach messaging did NOT work for quite some time. wed mid day through late Friday no send or receive at all on ours. Fri evening it was sporadic send/receive - not all messages were going through to all parties. Saturday 25th it seems to be working correctly.

Nobody seems to be mentioning how the data is potentially more valuable then the ransom? If customer data is stored on their servers, the hacker potentially has the historical location data and identities of a lot of their customers now, which could potentially contain sensitive information of important people and possibly valuable to state actors

Talked to someone I know there who said it looked like ransomware targeting all windows boxes, including those connected via VPN.

Either the people in charge of security were dumb (dealt with some of those) or they were smart and the executives refused to listen or fund them (met those as well) or both (and have worked at places like that too). I wonder how many companies fall into these categories.

What would they have suggested that executives might not listen to?

I am happy I am still able to run, even with their services down. But I found no comments on the internet at all about the reason of the incident.

If you run, but you don’t post it to strava, did you even run? /s

Well you can still manually upload the FIT file to Strava.

Of course. And workouts can be manually synced to the device with usb. As others have mentioned, the devices are fairly robust with offline support.

This is silly. I use the data to see where can I improve, not for bragging. I can not see it on the app while the service is down.

Yeah, sure, I can manually downlod it (as I can also take a paper and a pen and write the data), but that’s not a fair expectation.

I know. I was being sarcastic. I’m the same way, and I’m pretty sure my strava is set to private. Mine was more of a comment on how everything has a social component nowadays.

ok, i’m sorry, i’ve missed the tone :)

This is sorta interesting, my wife is doing a virtual race on Saturday where she'll need to push Garmin data to Runkeeper to validate times for top 100. Might need to test some things out. Though I guess if everyone's impacted, the event will need to figure out a workaround.

Can connect the watch to a computer using the charger cable and then grab the file from there.

My Garmin Connect app is now syncing with wearable and showing steps and other stats again. I briefly had an updated banner that said they were planning system maintenance from 7am on the 24th to some end time, and then it went back to the "down for maintenance" message within a three-minute span. Interesting. They may be staggering trying to bring some workarounds online.

How does ransomware attack work if the company host all of their service in the cloud (aws/gcloud/etc.)? Based on some preliminary readings, it seems like ransomware attack is mostly conducted on a physical machine. If your service data is all stored in the cloud and not synced with any of the machines owned by your employees, are you still subject to this type of attack?

You could still encrypt all the stored data in the cloud and delete everything that is unencrypted.

Since most of the historical data that customers upload is in the Garmin cloud, not on their local devices (I believe the local device only stores a small period of recent activity), this potentially means a lot of lost data for customers.

I would also imagine things like accounts and their relations to hardware devices (which account is associated with which device) is stored in the cloud somewhere, so those associations alone are important for synchronizing data to the cloud.

This will be a mess to cleanup if true, if they don't have some kind of separate off-site backups outside of this compromise.

Ransomware and cloud are very generic terms. Ransomware is a concept of encrypting data to deny service. Cloud really references virtual architecture that is easy to expand and contract, often in a 3rd party cloud provider like Azure or AWS. The "machines" could be windows, linux, docker containers, Lamda functions (AWS), etc. running virtually in "the cloud". So, a ransomware in the cloud just means that someone encrypted data that is stored on cloud architecture. Certainly quite possible, but not as common as encrypting windows machines, which is what usually makes the news.

but not as common as encrypting windows machines, which is what usually makes the news.

It could be Windows machines in the cloud.

Hm. I recently bought a Garmin Inreach Mini (satellite emergency communication device), intending to use it for some long backcountry hiking/backpacking trips I'm planning on taking.

Really hope this isn't effecting their emergency service/emergency communication devices. Subscription management, at a minimum, was via the Garmin website.

Garmin sat trackers use the Iridium sat network and outsource the response to GEOS so you'll be fine.

https://www.google.com/search?client=firefox-b-1-d&q=garmin+...

I suspended my inReach plan during the lockdown but was about to re-enable it for a motorcycle camping trip next weekend. Hope the website is back up in time!

Even the status page is not loading for me. Which seems weird.

Recently I was looking into Fish finders. Garmin has some cool tech and their maps are great. I’ll have to make sure I don’t get a connected device.

Having your gps time-out on you might be lethal. Imagine an hypothetical auto update bricking all gps devices in the group on a mountain top or the sea and relying on a compass and map if you were smart enought to bring it.

Not having a gps makes many endouvers just that much more risky.

Edit: made it clear it is a hypothetical scenario

Does Garmin or any other GPS vendors have auto-update? Most of my wearables require me to confirm the incoming update (scheduled at night while charging) or I have to plug it into my computer.

I hope not it was a hypothetical scenario of IoT gps:es. But I mean if the fridge or cat feeder can brick it self ...

Most Garmin wearable devices can be configured to auto update. If the servers are online they will download new firmware via WiFi or Bluetooth and then install automatically. You can disable that feature.

You should always have backup navigation aids available (printed maps, compass, watch), regardless of whether you trust your GPS device or not.

Ye. I do alot of sailing and did it in the 90s and early 00s with only map and compass, so I know how hard it is. Without gps you need to sail in such a way that you are in line with landmarks etc. With gps you can roam freely.

If you are out on the sea and the gps dies and you have not been tracking the paper map you are lost, so GPS are in practice realy critical devices. Especially since many sailors nowadays might be rusty on map navigation.

I mean garmin have high quality and I agree people need to not trust electronoc tools too much and be too dependent on them

Garmins update by USB, not GPS. There's no way for them to push an update to you on top of a mountain or in the middle of the sea.

Also, when I plug my Garmin watch into my computer by USB, it just brings up a USB mass storage device. I could drag a new firmware image over if I had one, but it's not going to auto-update and time out. I last updated in 2016, it's been going strong since 2013. Incidentally, battery capacity is down significantly, but it still lasts multiple days and multiple workouts.

They're actually really well engineered against accidental automatic bricking and loss of function, unlike most IoT devices and websites.

My watch updates via bluetooth every time a new firmware ships. It can also update via USB.

Ye sorry was not clear it was a hypotetichal dystopic scenario about modern ad-driven development.

You can receive GMS on the sea and on mountains though, so it is not impossible to have over the air updates like a Tesla.

If you're in signal service for an update, you have alternatives. If you have no alternatives, you're out of range of updates. The sorts of devices involved (and here I'm thinking of the GPSMAP series and friends) don't do over-the-air updates anyway, and don't rely on networked mapping services. Maps are stored on the device before you ever leave the house.

It appears that even some garmin.com assets are failing to load right now.

Yikes, does this affect inreach service? If so, lives are at stake.

I just put my inreach device out on my back deck and sent myself a test email and sms–seems to be working fine. I can't log in to manage my account, but their status page claims that the critical inreach services (SOS and comms) are up and running: https://status.inreach.garmin.com/

Yep just tried mine too. Well, that's a relief.

Everything inreach is up except for billing, it's a separate system: https://status.inreach.garmin.com/

I've recently started processing the GPX data from my (oldish) Garmin watch myself, thanks to https://www.gpsbabel.org.

Confirmed hacked.

provide an official source for the "confirmation" other than that ithome website...

Source?

Yikes. Going through the comments it seems their products can still work offline? How about caching?

Garmin is our direct competitor, but we wish them a quick recovery.

If there is one thing Garmin really needs, its competition. I'd love to hear who you work for, and I hope you gain some ground

From their profile, it looks like it's Aidlab.

I've got a Fenix 5x, and I'm kind of old school about it. I don't use bluetooth, since my phone is typically off when I'm backcountry hiking. I load up all my traces and map layers over USB, have been for 12 years across a bunch of my Garmin devices

This very stupid big company ever..., going down for 12 hours. What their IT doing, their IT never thing about Disaster Recovery ? Or the company very stingy to invest for disaster recovery plan. Now my Fenix 6 like a stupid smart watch.

Not sure if it's related, but asteroid 2020 ND is supposed to be passing by the Earth on July 24th. https://indianexpress.com/article/explained/explained-nasa-a...

That's passing fourteen times further away from the moon. It won't have any effect on satellite operations.

For a sense of scale on satellites: https://en.wikipedia.org/wiki/Low_Earth_orbit#/media/File:Or...

Reply on news.ycombinator.com