Hacker News Reader

Comment by _salmon | Hacker News Reader

There's nothing definitive that says they paid the ransom or obtained the decryption key from the attackers. Rumors on Twitter say that they're rebuilding services from backups and slowly getting things back online

View on HN

I can imagine it's possible that a 1-week outage + cyber risk insurance claim + rebuilding from backups could net out to less than $10M.

It doesn't matter. Unless a live is at risk, you never ever pay ransoms, or others will try again.

The outage took out at least some of their aviation services. If they are unable to update routes and IFR approach procedures then lives could indeed be at risk.

Not quite. The onus is on the pilots to never fly with out-of-date navigation information (it's actually illegal), so if they can't get that from Garmin, they'd just have to get it from somewhere else instead. Garmin's data services being unavailable isn't endangering anyone.

Yep, Plenty of planes flying out there without any electronic maps.

The attack happened about a week after the FAA’s last update went into force. And I believe they’re distributed a week before that.

So the only groundings would’ve been those that have been parked for a while (I guess. I don’t know how they do updates).

https://www.faa.gov/air_traffic/flight_info/aeronav/aero_dat...

—armchair aviator

It's crazy to think that airplanes fly by wire over a cloud computing service.

They don't. Garmin's cloud services supply map/chart data updates and backend services for their mobile app (which is separate from installed avionics) to support flight planning functionality.

Ex Garmin employee here. Some of their infrastructure supports emergency response. Hard to know how much of what went offline, but if /that/ goes down, people die. On-call was not fun.

Also should note: the life-critical infrastructure was somewhat insolated from the rest of it.

supposedly inReach wasn't included in the down time? Wonder if due to better infra or just highly (and rightfully so) prioritized once things went south

Checking https://status.inreach.garmin.com/ (oh the memories) Looks like the meat and potatoes held together! I'd credit segregated infrastructure and redundancy.

Most of it runs over Iridium, so I wonder how much IoT is really involved vs just being a different hardware front-end for Iridium services.

Ah, that would probably explain it. I was wondering if the actors wanted to avoid touching services that could impact peoples lives, due to that potentially leading to more motivated investigations. Possibly, but also could just be that it is largely a hardware front-end for Iridium's service.

It's super easy to make statements like that, when you are unaffected third party.

I'm against fueling ransoms, but this isn't black and white when it hits home.

You are right. Thinking with a cooler head I can see that it's just another risk to consider, not the only thing that matters.

So? $10M ransom plus trying again is cheaper than collapsing a $1B business.

Reply on news.ycombinator.com