Garmin Connect Down?

[CrazyEnglishTriathlete]

Went out early this morning and my GPS didn't sync the ride.  It is still telling me that they are down for maintenance on my phone and laptop.  Have they been hacked?

[Greenbank]

Either a problem with the datacentre that hosts everything for them, or something technical like an SSL certificate problem.

Unlikely to be back online today according to one unofficial source.

https://twitter.com/garminfitness is the account to follow although they're not very good with communications...

(I download the FIT files off my watch and upload them to Strava anyway, so I've got my run from this morning.)

[Greenbank]

Although unconfirmed rumours elsewhere that it's ransomware: https://news.ycombinator.com/item?id=23926289

[Greenbank]

Now confirmed: https://www.zdnet.com/article/garmin-services-and-production-go-down-after-ransomware-attack/

[CrazyEnglishTriathlete]

Fortunately I only use Garmin for navigation.  My logbook is still an A6 notebook, which has survived all attempts at ransomware, backup failure and other losses.  I plan routes on RidewithGPS.

[Greenbank]

It shouldn't affect me either. I copy the FIT files off my device(s) every day so I'll never lose anything. I do this to partly as a backup and partly to upload some of them to Strava.

From they they're all backed up to my NAS and from there to Amazon S3. As close to zero chance of losing all of those backups as you can probably get.

I can re-create my history on any website I can import the FIT files into.

My 945 watch still works fine for recording runs.

It might be annoying if I was mid C25K and wanted to create a new workout for the next day, but I'm not.

[Beardy]

Thank goodness for Strava. All my activity is duplicated (backed up?) on Strava. I’ll have to rethink my intention to not renew my Strava sub in August.

[Polar Bear]

I don't back my Garmin up in any way other than it does itself but I am also completely unphased about possibly losing all of the data.  When I used to run in the eighties and nineties I didn't even keep a running diary- I ran because I enjoyed it. 

I have referred to my Garmin as my Thief of Joy.  I realise that I can manage without all of the data, all of the pressure it loads upon me, all of the comparisons and nagging it gives me.

Something will be back eventually but in the meantime I will just get on with what I have planned in my head.  I know what I have achieved so far this year and I realise that I don't need a cloud-based record as proof.  I can simply go for a run to prove that I can now run 12 continuously.

I find this strangely and refreshingly liberating.

[JenM]

[/url] https://www.dcrainmaker.com/2020/07/how-to-upload-your-garmin-workout-during-the-outage.html#comments[/url]

For those of us with rides to upload.

[yoav]

Many, many years ago, well, about 10, Garmins came with a CD to install a program on your computer to store your data before, or instead of, putting it online. Unfortunately, not only did they get rid of it, they made sure newer Garmins wouldn’t work with it. That’s progress!

[woollypigs]

Well this went a bit dark but they got a point

[Ashaman42]

Many, many years ago, well, about 10, Garmins came with a CD to install a program on your computer to store your data before, or instead of, putting it online. Unfortunately, not only did they get rid of it, they made sure newer Garmins wouldn’t work with it. That’s progress!

Garmin Express won't download off my watch (Forerunner 610 via Ant dongle) if it can't phone home but after a lot of Googling around yesterday I managed to find a copy of Garmin Ant Agent which, after jibbling some settings, will download to the PC even if it can't connect to Garmin.

Whether that would work on newer watches I don't know. Then again I believe some of the newer ones you can just connect by USB and pull the data manually rather than using an ant dongle.

[Chris S]

Oof - I wonder how that got in!?

The company I work for got done with one of these earlier in the year; someone (not me!) left a VM with Remote Desktop running, exposed to the internet; which is just fish in a barrel to a bot. All the Windows VMs on a subnet got hit and needed to be rebuilt, but the Linux VMs were just fine  .

Once it's inside the Enterprise network - you're basically stuffed.

ETA: We're no longer exposing any Windows VMs to the internet, at all. We replaced the Old Ways with key-based SSH tunnels and remote private networks.

[Greenbank]

Whether that would work on newer watches I don't know. Then again I believe some of the newer ones you can just connect by USB and pull the data manually rather than using an ant dongle.

All of the newer watches connect via USB so getting access to the data isn't a problem.

But the watches only hold a certain amount of history, the watch would wipe older activities to make space for newer ones. So if you haven't been copying them off then you can't get them from the GC website because it's down (and possibly lost forever if all of the copies within Garmin have been got via the Ransomware).

I've always taken copies of the data from my Garmins. I've got directories called "110history", "705history", "920history", "935history" and "945history".

[Greenbank]

All the Windows VMs on a subnet got hit and needed to be rebuilt, but the Linux VMs were just fine  .

I think we'll see the first big victim of a Linux specific bit of ransomware within a year. Ransomware targets the money and there's so much more stuff running on Linux (via AWS/etc) that is run by people with little or no clue about continued security, backups, DR, etc.

[Chris S]

All the Windows VMs on a subnet got hit and needed to be rebuilt, but the Linux VMs were just fine  .

I think we'll see the first big victim of a Linux specific bit of ransomware within a year. Ransomware targets the money and there's so much more stuff running on Linux (via AWS/etc) that is run by people with little or no clue about continued security, backups, DR, etc.

I'm no security expert, so I don't know what risks there are around exposing ports 80/443 and some random port for key-only SSH; maybe some form of injection attack on an API/HTTP request might get you access to the server's disk - but if that's separated from the internal enterprise network, it's still going to be tough to get at the stuff that matters. Maybe.

The safest thing to do is expose nothing to the internet at all - but that's kinda limited.

[Ashaman42]

Whether that would work on newer watches I don't know. Then again I believe some of the newer ones you can just connect by USB and pull the data manually rather than using an ant dongle.

All of the newer watches connect via USB so getting access to the data isn't a problem.

But the watches only hold a certain amount of history, the watch would wipe older activities to make space for newer ones. So if you haven't been copying them off then you can't get them from the GC website because it's down (and possibly lost forever if all of the copies within Garmin have been got via the Ransomware).

I've always taken copies of the data from my Garmins. I've got directories called "110history", "705history", "920history", "935history" and "945history".

Ah I see what you mean. I've got all my running so far onto Garmin Connect, then I've been downloading/exporting the tcxs from there into a folder on my PC and then manually uploading to Strava. Which is a bit convoluted but does mean I have a backup.

My cycling is normally just recorded directly on the Strava app on my phone. I did do a full download from Strava a couple weeks ago but I should probably make a habit of doing it more often.

[Greenbank]

Linux isn't immune to remote attacks. Any bit of software that listens on a port can theoretically have an exploit that can end up with shell access on the machine. From there it's a game of privilege escalation. There's always going to be some part of the OS or tool installed that can be abused to give root access.

Ransomware has two main requirements:-
a) Get in the door somehow (being infected over the Internet is unlikely) so it generally requires someone to do something stupid
b) Spread internally once in

For part (a) given how much software on Linux comes with installation instructions along the lines of:-

curl <url> | sudo sh

I'm surprised there aren't as many infections based on targeting the source sites and going from there.

As for spreading in a non-Windows environment, the proliferation of passwordless logins with ssh keys within organisations means it's possible to get to many different machines if you have access to one user account (or root access on a machine giving you access to every users ssh keys).

All that Linux is lacking is a nice consistent way of informing the user that their files are now encrypted and a ransom payment is required.

[Beardy]

Remote access stacks are the journos sexy approach with tropes of teenagers in dark rooms trying to type faster than the security specialist in the ops centre. In reality for something as big as this it’s like to be an insider who’s either been compromised in some way or is part of the gang. Occam’s razor suggests that they’ve probably loaded a patch and set a cron job to run.

There’s nothing ‘sexy’ about cyber crime these days and Organised Crime is probably involved somewhere.

[fuaran]

Many, many years ago, well, about 10, Garmins came with a CD to install a program on your computer to store your data before, or instead of, putting it online. Unfortunately, not only did they get rid of it, they made sure newer Garmins wouldn’t work with it. That’s progress!

Garmin Training Center. It should still work if you can find it to download somewhere. Though it has been discontinued for about 10 years, so no updates. Probably doesn't support newer Garmins, but you could manually import the files.

Or Turtle Sport may be a better option, a bit more up to date.
Or Golden Cheetah if you want more detailed analysis.

Or can just load all of your rides in Garmin Basecamp. It doesn't really have any sort of calendar view, but you could create lists and folders for various categories, or for each year, and get totals for those.

[Pedal Castro]

Thank goodness for Strava. All my activity is duplicated (backed up?) on Strava. I’ll have to rethink my intention to not renew my Strava sub in August.

Maybe Strava will be next?

[Kim]

Glad to be an eTrex luddite with a local^[1] copy of all the data and a shell script to upload to Strava.

Friend who uses a high-end Garmin smartwatch to help manage their disability seems rather discombobulated thobut.

It's the usual lesson about relying on the internet-of-shit, with a side-order of anyone-can-screw-the-pooch.


_{[1] In the sense that it's automatically backed up to a machine in another city.}

[Davef]

I am not particularly fussed about uploading activities. GC is a useful for getting courses onto a device. BaseCamp is great when you are still at BaseCamp but when you are at camp 3 more difficult. Luckily I have the grouteloader iq app.. though you will need gc to install it


Sent from my iPhone using Tapatalk

[Davef]

I must admit I did have a moment of panic yesterday as it all happened minutes after I started experimenting with one of the Garmin apis. I thought it was going to be a repeat of my inland revenue mainframe incident of 1997.


Sent from my iPhone using Tapatalk

[TimC]

All the Garmin devices I've ever had (and that goes back to the Forerunner 201) have been accessible directly from within Windows Explorer or MacOS Finder. The data is stored in the 'Activities'  folder on the device, and the data can be directly copied to your PC and then uploaded to whichever activity recording website or app that you prefer. There is no need to have an online connection via Garmin Connect.