21 ms·

Garmin services and production go down after ransomware attack

226 points by fbnlsr 6y ago

danielbln 6y ago
For many many hours already, including SSO, their webshop, and all of Garmin connect. The devices can't sync anymore, the mobile apps are all but useless and Garmin has yet to comment on any of this. Yikes.
- mns 6y ago
  It's weird that everything Garmin related is down. I wonder if they got hacked or something similar and just took everything offline. Their response is also weird, seems like internal infrastructure is also down. "We are currently experiencing an outage that affects Garmin Connect, and as a result, the Garmin Connect website and mobile app are down at this time. This outage also affects our call centers, and we are currently unable to receive any calls, emails or online chats. We are working to resolve this issue as quickly as possible and apologize for this inconvenience."
  - alfalfasprout 6y ago
    I’m guessing they pulled “the plug” on everything once they saw the ransomware was spreading.
    - usrusr 6y ago
      Probably after losing a few rounds of whack-a-mole with partial shutdowns. Might even be a better customer experience, a few days of a clear "Garmin is down, do everything with cables like they did back in 2010" is much less frustrating to deal with than all the services being in some form of flaky brownout state where nothing ever works reliably and you keep trying and failing.
- christoph 6y ago
  It's made me realise how crazy reliant my Garmin watch is on their infrastructure. I went onto the app this morning to try and alter a watch face I already have downloaded, which should totally be configurable through just the mobile app alone. Why the hell does it need to talk to Garmin's servers to let me do this? It should just be possible through the app alone, without needing any involvement from Garmin's servers.
  - parliament32 6y ago
    Depends on your device, but on a Fenix you can swap/configure watch faces directly on the device.
Zealotux 6y ago
It took me a whole minute to disable cookies on this website with their built-in tool, and uBlock still blocked 80 scripts. For a status page.
- ultrarunner 6y ago
  Welcome to Garmin software quality
somecommit 6y ago
I precisely like garmin watches because if you don't setup their bluetooth, you are not tracked by anyone, it's not required to connect to servers etc... It's enough for me because I only need to check BPM.
- amelius 6y ago
  Of course there isn't any guarantee that at some point, some marketing manager won't decide to break that.
  - lxgr 6y ago
    How could that happen for an existing, standalone device? (Assuming there aren't any time bombs waiting in the code only to be fixed by a firmware update, like the GPS week number epoch rollover, of course.)
    - reportgunner 6y ago
      They stop manufacturing it, the parts it needs and then they wait for your standalone device to stop working.
  - nanidin 6y ago
    It seems unlikely, Garmin is a very engineering led company. At least it was when I worked there 10 years ago! Part of that engineering focus is an insane attention to the BOM, and to support(call center) and warranty (returns & repairs) costs. I think both of these things make it unlikely that Garmin will add a cellular modem to start tracking otherwise unconnected devices.
    - polymorph1sm 6y ago
      I spoke with one the engineers at their hiring event last year, I can confirm they are still a very engineering led company.
    - amelius 6y ago
pietromenna 6y ago
I am happy I am still able to run, even with their services down. But I found no comments on the internet at all about the reason of the incident.
- jdechko 6y ago
  If you run, but you don’t post it to strava, did you even run? /s
  - nradov 6y ago
    Well you can still manually upload the FIT file to Strava.
    - jdechko 6y ago
      Of course. And workouts can be manually synced to the device with usb. As others have mentioned, the devices are fairly robust with offline support.
  - zuppy 6y ago
    This is silly. I use the data to see where can I improve, not for bragging. I can not see it on the app while the service is down. Yeah, sure, I can manually downlod it (as I can also take a paper and a pen and write the data), but that’s not a fair expectation.
    - jdechko 6y ago
      I know. I was being sarcastic. I’m the same way, and I’m pretty sure my strava is set to private. Mine was more of a comment on how everything has a social component nowadays.
      - zuppy 6y ago
        ok, i’m sorry, i’ve missed the tone :)
- 6y ago
exabrial 6y ago
Their products are designed to work offline. Despite the cloud being down I have full local functionality right now. (Though I can't see my history, surprised they don't cache that locally). Last year when I did a 9-day canoe trip with no cell phone reception, all of my Garmin gear worked flawlessly (wearables, navigation devices, and their offline map app). Can't say the same about my friends iWatches/fitbits or even some stuff on various stuff of iPhones and my pixel.
- paozac 6y ago
  Do they? Last Garmin product I had was a Vivosmart HR: an internet connection and a Garmin connect account was required to change basic settings such as the display orientation. And there was no way to disable syncing.
  - wil421 6y ago
    The Vivosmart is more like a Fitbit. I don’t see it as a stand-alone device. Does it still count steps and track your heart rate without internet?
    - thinkmassive 6y ago
      Based on my experience using a Vivosmart 4 for sleep tracking, often in remote areas w/o mobile signal, it does store that data to be synced later. Obviously it has a finite memory but I don't recall having ever lost data from the device.
    - abkfenris 6y ago
      I tracked a 20 day trip down the Grand Canyon on my VivoSmart. I think it has the storage for a few months worth of continuous tracking before it needs to sync to free space.
  - deleted 6y ago
    [deleted]
  - christoph 6y ago
    My Forerunner 935 is basically the same story today. I can't do anything on it via the mobile apps. I guess I probably could do something with their desktop app and the USB cable, but it's really struck me how crippled the device seems today with their servers down, basically nothing is available or works at all through either Garmin Connect or ConnectIQ mobile apps. The apps don't appear to have any recent data cached locally either.
montebicyclelo 6y ago
I've recently started processing the GPX data from my (oldish) Garmin watch myself, thanks to https://www.gpsbabel.org https://www.gpsbabel.org.
Molpot 6y ago
Has anybody tried to reverse engineer garmin's bluetooth protocols? I often want to buy one of their smartwatches but the idea of having to install proprietary software on my phone kind of puts me off. I'd love to write my own software but I don't have any experience doing bluetooth RE.
- barbegal 6y ago
  You can just get the activity files off the watch via USB if that would work for you. https://support.garmin.com/en-GB/?faq=Ht3ZP52Kju075uKvqTqu99&productID=541225&tab=topics https://support.garmin.com/en-GB/?faq=Ht3ZP52Kju075uKvqTqu99...
  - Molpot 6y ago
    Thanks but it doesn't, I want a watch to keep track of my swimming training, I'm afraid using USB connectors would make the watch less waterproof.
    - reaktion 6y ago
      I use a vivoactive 3: it has combination usb/charging port[1] that's completely waterproof and designed to be used while swimming. I believe most garmin watches share the same port design. [1] https://www8.garmin.com/manuals/webhelp/vivoactive3/Shared/GUID-AAF5E5D5-08C2-4886-BA1D-1F411F370135-high.jpg https://www8.garmin.com/manuals/webhelp/vivoactive3/Shared/G...
      - Molpot 6y ago
        I wasn't aware of that, thanks for telling me!
    - montebicyclelo 6y ago
      They tend not to put standard USB in the watch, but connections like this: https://media.dcrainmaker.com/images/2014/06/IMG_3109_thumb.jpg https://media.dcrainmaker.com/images/2014/06/IMG_3109_thumb....
wil421 6y ago
Recently I was looking into Fish finders. Garmin has some cool tech and their maps are great. I’ll have to make sure I don’t get a connected device.
- rightbyte 6y ago
  Having your gps time-out on you might be lethal. Imagine an hypothetical auto update bricking all gps devices in the group on a mountain top or the sea and relying on a compass and map if you were smart enought to bring it. Not having a gps makes many endouvers just that much more risky. Edit: made it clear it is a hypothetical scenario
  - wil421 6y ago
    Does Garmin or any other GPS vendors have auto-update? Most of my wearables require me to confirm the incoming update (scheduled at night while charging) or I have to plug it into my computer.
    - rightbyte 6y ago
      I hope not it was a hypothetical scenario of IoT gps:es. But I mean if the fridge or cat feeder can brick it self ...
    - nradov 6y ago
      Most Garmin wearable devices can be configured to auto update. If the servers are online they will download new firmware via WiFi or Bluetooth and then install automatically. You can disable that feature.
  - mattbk1 6y ago
    You should always have backup navigation aids available (printed maps, compass, watch), regardless of whether you trust your GPS device or not.
    - rightbyte 6y ago
TheWindUpPirate 6y ago
I wonder what the root cause is? They've just tweeted that the outage is also affecting call centres and their ability to receive email. [0] I'm glad their stuff is designed with zero connectivity in mind. Just slightly irked that my history isn't cached on my phone. [0] - https://twitter.com/GarminUK/status/1286279863217926144 https://twitter.com/GarminUK/status/1286279863217926144
- codethics 6y ago
  Ransomware.
- aksss 6y ago
  I struggle to imagine what non-segregated resource would be so central as to affect their customer-facing app platform, internal email (or maybe mail gateways), and call center. Maybe DNS got hosed? I mean pretty impressive ransomware if it swept across the company that far and wide, crossing so many network boundaries and resource types so quickly. Maybe accounts/control being held for ransom instead of storage encryption (what I usually think of as ransomware).
  - nanidin 6y ago
    When I worked there, the entire internet for the campus went down. It took down the Garmin website and everything else Garmin. The culprit? Everyone was streaming music and/or videos. Everything shared the same internet pipe and streaming music starved out essential business functions. The next day all streaming services were blocked, and it was made clear we were being monitored for excess internet usage. Thus began the great brain drain to Apple, Amazon, and Samsung. Well that, and the fact that they took away the nice toilet paper and replaced it with one—ply right around the same time.
    - papito 6y ago
      One-ply toiler paper is where I draw the line. Nice toilet paper is a basic human right. Also, WHAT company of this size would try to save on toilet paper. Are you kidding me?
ytch 6y ago
https://www.ithome.com.tw/news/139004 https://www.ithome.com.tw/news/139004 (I'm not sure if it's reliable) This Taiwanese tech site says because of virus, IT system and production line are down for two days according to insider. they claim it might be ransomware.
- codethics 6y ago
  It is ransomware.
  - mox1 6y ago
    Yep, I have a friend who works there. Not looking good right now.
    - NeoFeznet 6y ago
      Holy crap.
    - petee 6y ago
      Would love to know if they've lost control of their Play Store accounts, i.e, is there any risk of compromised app updates?
- aksss 6y ago
  My own pure speculation: imagining they shut the service off so no new data comes up and are aiming for an RPO of last night or some time earlier on the 22nd. Two days to do full restoration of services and global user data, meanwhile people trying to convincingly patch vulnerabilities. Say a prayer for the IT people trying to fix this.
SketchySeaBeast 6y ago
A close relation of mine got sick back country hiking and needed to text for someone to meet at a rendezous just this week using Garmin's texting services - I hope that this doesn't last long, I'd hate to think of what would happen if he'd tried to ask for help today. Edit: Looks like Garmin 'Explore' is still up, so maybe it'd still be OK.
- zachware 6y ago
  I think the Inreach sat services operate on the iridium network. They don't sync with or connect to Garmin Connect based on my experiences.
  - SketchySeaBeast 6y ago
    That's good to know, and reassuring.
  - zachware 6y ago
    Update: They use GEOS https://www.google.com/search?client=firefox-b-1-d&q=garmin+geos+response https://www.google.com/search?client=firefox-b-1-d&q=garmin+...
- 22fred 6y ago
  InReach messaging did NOT work for quite some time. wed mid day through late Friday no send or receive at all on ours. Fri evening it was sporadic send/receive - not all messages were going through to all parties. Saturday 25th it seems to be working correctly.
mattmaroon 6y ago
I guess I always assumed Garmin made most of their money on their aviation products, since they are so dominant and so expensive. And those are designed to rarely if ever connect to the internet. But I guess I was pretty off on that, they’re only 20%. On a side note the graphs of their revenues per year and by category show a company that successfully branched out when their former big category, automotive, which was 80% of their revenue, began to be eaten by in car GPS and then smart phones.
- fbnlsr 6y ago
  I used to sell Garmin car GPS back when I worked in a retail shop. They were really good devices. But yeah I'm with you I thought most of their money came from aviation (it seems like everyone uses Garmin products), but their sports watches sell like crazy. Actually, I realized their network was down because this morning my watch would not sync after a run. :)
  - frosted-flakes 6y ago
    Honestly, they're still really good devices. I have one from last year that's a solid alternative to an in-dash navigation screen, and for what I use it for, just as good as Google Maps, and in many ways better (way more convenient and customizable, completely offline except traffic, bigger screen, auto-on...).
    - kevin_thibedeau 6y ago
      Their latest motorcycle units are dog slow because some dumb product manager decided to build it on their old hardware platform using newer firmware which isn't a good mix. I have a 10 year old auto unit that is better then the junk they have now.
  - parliament32 6y ago
    Yeah I noticed this morning too, Garmin Connect says "maintenance" but of course HN has the real story.
  - 6y ago
codethics 6y ago
Confirmed hacked.
- recrudesce 6y ago
  provide an official source for the "confirmation" other than that ithome website...
- jstr 6y ago
  Source?
9nGQluzmnq3M 6y ago
A leaked email from Garmin's Taiwan office says everything including the production line has been shut down for two days: https://translate.google.com/translate?sl=auto&tl=en&u=https%3A%2F%2Fwww.ithome.com.tw%2Fnews%2F139004 https://translate.google.com/translate?sl=auto&tl=en&u=https... Local media suspects a ransomware attack, which is about the only thing that could explain how widespread this is.
- codethics 6y ago
  Can confirm it is a ransomware attack.
  - sn_master 6y ago
    Source? Do you work there? Do you know whats the ransomware used or how much they're demanding?
    - deleted 6y ago
      [deleted]
    - francisofascii 6y ago
      Total speculation, my guess is WastedLocker. It has been hitting all types of companies in the past few months. Have a friend who's company was hit recently. They were somehow were able to encrypt the backups.
      - aksss 6y ago
        My vote is something's being held for ransom like DNS or account access rather than traditional storage encryption. It's pretty impressive if storage encryption crossed so many network boundaries and affected so many diverse resource types - phones, chat, email, website, distributed app platform. What other central resource besides DNS would have such a broad impact?
        5h 6y ago
some_random 6y ago
Talked to someone I know there who said it looked like ransomware targeting all windows boxes, including those connected via VPN.
- coldcode 6y ago
  Either the people in charge of security were dumb (dealt with some of those) or they were smart and the executives refused to listen or fund them (met those as well) or both (and have worked at places like that too). I wonder how many companies fall into these categories.
  - TwoBit 6y ago
    What would they have suggested that executives might not listen to?
foobarbecue 6y ago
Yikes, does this affect inreach service? If so, lives are at stake.
- macNchz 6y ago
  I just put my inreach device out on my back deck and sent myself a test email and sms–seems to be working fine. I can't log in to manage my account, but their status page claims that the critical inreach services (SOS and comms) are up and running: https://status.inreach.garmin.com/ https://status.inreach.garmin.com/
  - foobarbecue 6y ago
    Yep just tried mine too. Well, that's a relief.
- parliament32 6y ago
  Everything inreach is up except for billing, it's a separate system: https://status.inreach.garmin.com/ https://status.inreach.garmin.com/
jacquesm 6y ago
The internet-of-things that aren't really your things strikes again. When will manufacturers learn that their hardware should function even if their services are down? The whole account/subscription tacked on for no apparent reason thing is highly irritating, and Garmin is actually better than most.
- nradov 6y ago
  Yes the Garmin Connect mobile app ought to be able to do a lot more without a server connection. But in fairness to Garmin they don't charge subscription fees. After you buy a device you can use the service for free.
  - jacquesm 6y ago
    If it is up.
- notdang 6y ago
  the Garmin devices that I own are working, it's just that I cannot synchronize the activities to the cloud.
- mdoms 6y ago
  My watch is functioning just fine. I can see historic data, log a run, tell the time etc.
  - asimilator 6y ago
    The mobile app is 100% nonfunctional. Also any changes you made on the mobile app (eg editing rep counts in a weight lifting activity) are not synced back to the watch.
- kettro 6y ago
  When I worked for Garmin, we deliberately designed products to work for as long as possible offline - the Bike Speed & Cadence Monitors (~2018) are able to work for 1 year, riding every day, then a battery change, and then another year, all before a sync to a device is required. All of the rides should be stored on-device.
ShepherdKing 6y ago
Not sure if it's related, but asteroid 2020 ND is supposed to be passing by the Earth on July 24th. https://indianexpress.com/article/explained/explained-nasa-asteroid-2020-potentially-dangerous-to-earth-6515170/ https://indianexpress.com/article/explained/explained-nasa-a...
- sonofgod 6y ago
  That's passing fourteen times further away from the moon. It won't have any effect on satellite operations. For a sense of scale on satellites: https://en.wikipedia.org/wiki/Low_Earth_orbit#/media/File:Orbitalaltitudes.jpg https://en.wikipedia.org/wiki/Low_Earth_orbit#/media/File:Or...
humanlion87 6y ago
Even the status page is not loading for me. Which seems weird.
deleted 6y ago
[deleted]
fery09 6y ago
This very stupid big company ever..., going down for 12 hours. What their IT doing, their IT never thing about Disaster Recovery ? Or the company very stingy to invest for disaster recovery plan. Now my Fenix 6 like a stupid smart watch.
PaulPfeiffer 6y ago
While I am concerned a little for the location of my home now being in the hands of the wrong people. I am more Concerned with Garmin's Unprofessionalism... People who own yachts should probably be the most concerned..
- aksss 6y ago
  Why's that? Concern over location data or something? I don't own a yacht but the Garmin gear in my boat assumes no Internet connection (kinda the point of the boat) and sees no impact from this event. Garmin wearables, however, are in use all day, every day, have associated PII to a minor degree, a broader audience and have been severely crippled by this. Curious what the yacht angle is that I may not be acknowledging.
- alfalfasprout 6y ago
  Marine and aviation units don’t connect to the internet for data typically. Their inReach satellite communicators also use a totally different network that’s unaffected
cnbuff410 6y ago
How does ransomware attack work if the company host all of their service in the cloud (aws/gcloud/etc.)? Based on some preliminary readings, it seems like ransomware attack is mostly conducted on a physical machine. If your service data is all stored in the cloud and not synced with any of the machines owned by your employees, are you still subject to this type of attack?
- clairegraham 6y ago
  You could still encrypt all the stored data in the cloud and delete everything that is unencrypted. Since most of the historical data that customers upload is in the Garmin cloud, not on their local devices (I believe the local device only stores a small period of recent activity), this potentially means a lot of lost data for customers. I would also imagine things like accounts and their relations to hardware devices (which account is associated with which device) is stored in the cloud somewhere, so those associations alone are important for synchronizing data to the cloud. This will be a mess to cleanup if true, if they don't have some kind of separate off-site backups outside of this compromise.
- grl 6y ago
  Ransomware and cloud are very generic terms. Ransomware is a concept of encrypting data to deny service. Cloud really references virtual architecture that is easy to expand and contract, often in a 3rd party cloud provider like Azure or AWS. The "machines" could be windows, linux, docker containers, Lamda functions (AWS), etc. running virtually in "the cloud". So, a ransomware in the cloud just means that someone encrypted data that is stored on cloud architecture. Certainly quite possible, but not as common as encrypting windows machines, which is what usually makes the news.
  - userbinator 6y ago
    but not as common as encrypting windows machines, which is what usually makes the news. It could be Windows machines in the cloud.
DebtDeflation 6y ago
This is frustrating. I have a Garmin Fenix 6X Sapphire (that I absolutely love) and on seeing this headline I checked the Connect app on my phone and sure enough I cannot access any of my previous activities. You'd think that in this day and age of phones with 128GB+ storage that they'd be caching at least some of your historical data locally, but nope it's all in the cloud, which is currently inaccessible.
- scruple 6y ago
  I've been tinkering with the idea of writing a service agent that detects when my Garmin GPS watch is connected to my desktop (where / how I charge it) and automatically pulls down any new activities to store locally as a backup. Starting around 2012... I used to scrape my activities off of the Garmin Connect website, I eventually got tired of the manual nature of this process and also having to keep up with changes they made to their site. After that, I used something called, I believe, Tapatirik, for a while, to automatically sync them to a Dropbox account. But, it wasn't flaky sometimes, so I eventually gave up entirely and just turned on the sync to Strava option. But that also has spurious failures that are annoying to deal with. And on and on it goes... Frustrating is one word for it. I'm at a point where I find it to be completely anti-consumer.
  - nradov 6y ago
    GoldenCheetah can do at least some of what you want. https://www.goldencheetah.org/ https://www.goldencheetah.org/
    - scruple 6y ago
      Thanks for that!
  - mackmgg 6y ago
    It's not as automatic, but Garmin BaseCamp does let you pull your activities from the watch. I believe it has an option to transfer every time it's open and a device is plugged in, but it doesn't run in the background.
dang 6y ago
We changed the URL from https://connect.garmin.com/status/ https://connect.garmin.com/status/ to an article with more info.
- fbnlsr 6y ago
  Thanks!
deleted 6y ago
[deleted]
GaryNumanVevo 6y ago
I've got a Fenix 5x, and I'm kind of old school about it. I don't use bluetooth, since my phone is typically off when I'm backcountry hiking. I load up all my traces and map layers over USB, have been for 12 years across a bunch of my Garmin devices
artemisyna 6y ago
Hm. I recently bought a Garmin Inreach Mini (satellite emergency communication device), intending to use it for some long backcountry hiking/backpacking trips I'm planning on taking. Really hope this isn't effecting their emergency service/emergency communication devices. Subscription management, at a minimum, was via the Garmin website.
- zachware 6y ago
  Garmin sat trackers use the Iridium sat network and outsource the response to GEOS so you'll be fine. https://www.google.com/search?client=firefox-b-1-d&q=garmin+geos+response https://www.google.com/search?client=firefox-b-1-d&q=garmin+...
- davidbanham 6y ago
  I suspended my inReach plan during the lockdown but was about to re-enable it for a motorcycle camping trip next weekend. Hope the website is back up in time!
sakopov 6y ago
It appears that even some garmin.com assets are failing to load right now.
guzik 6y ago
Yikes. Going through the comments it seems their products can still work offline? How about caching? Garmin is our direct competitor, but we wish them a quick recovery.
- petee 6y ago
  If there is one thing Garmin really needs, its competition. I'd love to hear who you work for, and I hope you gain some ground
  - saagarjha 6y ago
    From their profile, it looks like it's Aidlab.
aksss 6y ago
This might be a fine time to plug an app called RunGap - https://www.rungap.com/ https://www.rungap.com/ Disclaimer: I'm not associated with them other than being a satisfied user of it. RunGap takes your activity data from one service and migrates it across others - so your activities you upload to Garmin Connect will be copied over to MapMyRun, Runalyze or whatever, including DropBox and/or iCloud. It won't help you now, but in the future it may be a good way to derisk the loss of your activity history. I think it's apple device only though. :/
- fredrikaverpil 6y ago
  There's also https://tapiriik.com https://tapiriik.com for syncing.
justkez 6y ago
It’ll be interesting to see how Strava copes when the tap is turned on again. Maybe there’s some rate limiting built in but they’ll be getting a flood of accumulated data to process
aksss 6y ago
My Garmin Connect app is now syncing with wearable and showing steps and other stats again. I briefly had an updated banner that said they were planning system maintenance from 7am on the 24th to some end time, and then it went back to the "down for maintenance" message within a three-minute span. Interesting. They may be staggering trying to bring some workarounds online.
ackbar03 6y ago
Nobody seems to be mentioning how the data is potentially more valuable then the ransom? If customer data is stored on their servers, the hacker potentially has the historical location data and identities of a lot of their customers now, which could potentially contain sensitive information of important people and possibly valuable to state actors
helsinkiandrew 6y ago
Does anybody have any understanding of either the WastedLocker ransom ware or Garmin's internal systems that can explain how it can have such a massive affect on its website, production backends (including airplane navigational systems), call centre, and possibly manufacturing systems. Is this windows everywhere? or badly partitioned systems or have they pulled the plug on everything just to be sure
joann56 6y ago
Be warned, most of these so called hackers are imposters, I’ve been ripped off twice already, thankfully my friend gave me a reliable contact, he works with discretion and delivers, he does all sorts of hacking and help me hack my ex Facebook, Whatsapp, iCloud, IG, Snapchat and Phone messages remotely with the software he bought, I would prefer to let his services speak for itself, you can contact him at eaglespyhacker @ gmail . com , thank me later

226 points by fbnlsr 6y ago

For many many hours already, including SSO, their webshop, and all of Garmin connect. The devices can't sync anymore, the mobile apps are all but useless and Garmin has yet to comment on any of this. Yikes.

mns 6y ago
It's weird that everything Garmin related is down. I wonder if they got hacked or something similar and just took everything offline. Their response is also weird, seems like internal infrastructure is also down. "We are currently experiencing an outage that affects Garmin Connect, and as a result, the Garmin Connect website and mobile app are down at this time. This outage also affects our call centers, and we are currently unable to receive any calls, emails or online chats. We are working to resolve this issue as quickly as possible and apologize for this inconvenience."
- alfalfasprout 6y ago
  I’m guessing they pulled “the plug” on everything once they saw the ransomware was spreading.
  - usrusr 6y ago
    Probably after losing a few rounds of whack-a-mole with partial shutdowns. Might even be a better customer experience, a few days of a clear "Garmin is down, do everything with cables like they did back in 2010" is much less frustrating to deal with than all the services being in some form of flaky brownout state where nothing ever works reliably and you keep trying and failing.
christoph 6y ago
It's made me realise how crazy reliant my Garmin watch is on their infrastructure. I went onto the app this morning to try and alter a watch face I already have downloaded, which should totally be configurable through just the mobile app alone. Why the hell does it need to talk to Garmin's servers to let me do this? It should just be possible through the app alone, without needing any involvement from Garmin's servers.
- parliament32 6y ago
  Depends on your device, but on a Fenix you can swap/configure watch faces directly on the device.

Zealotux 6y ago

It took me a whole minute to disable cookies on this website with their built-in tool, and uBlock still blocked 80 scripts. For a status page.

ultrarunner 6y ago
Welcome to Garmin software quality

somecommit 6y ago

I precisely like garmin watches because if you don't setup their bluetooth, you are not tracked by anyone, it's not required to connect to servers etc... It's enough for me because I only need to check BPM.

amelius 6y ago
Of course there isn't any guarantee that at some point, some marketing manager won't decide to break that.
- lxgr 6y ago
  How could that happen for an existing, standalone device? (Assuming there aren't any time bombs waiting in the code only to be fixed by a firmware update, like the GPS week number epoch rollover, of course.)
  - reportgunner 6y ago
    They stop manufacturing it, the parts it needs and then they wait for your standalone device to stop working.
- nanidin 6y ago
  It seems unlikely, Garmin is a very engineering led company. At least it was when I worked there 10 years ago! Part of that engineering focus is an insane attention to the BOM, and to support(call center) and warranty (returns & repairs) costs. I think both of these things make it unlikely that Garmin will add a cellular modem to start tracking otherwise unconnected devices.
  - polymorph1sm 6y ago
    I spoke with one the engineers at their hiring event last year, I can confirm they are still a very engineering led company.
  - amelius 6y ago

pietromenna 6y ago

I am happy I am still able to run, even with their services down. But I found no comments on the internet at all about the reason of the incident.

jdechko 6y ago
If you run, but you don’t post it to strava, did you even run? /s
- nradov 6y ago
  Well you can still manually upload the FIT file to Strava.
  - jdechko 6y ago
    Of course. And workouts can be manually synced to the device with usb. As others have mentioned, the devices are fairly robust with offline support.
- zuppy 6y ago
  This is silly. I use the data to see where can I improve, not for bragging. I can not see it on the app while the service is down. Yeah, sure, I can manually downlod it (as I can also take a paper and a pen and write the data), but that’s not a fair expectation.
  - jdechko 6y ago
    I know. I was being sarcastic. I’m the same way, and I’m pretty sure my strava is set to private. Mine was more of a comment on how everything has a social component nowadays.
    - zuppy 6y ago
      ok, i’m sorry, i’ve missed the tone :)
6y ago

exabrial 6y ago

Their products are designed to work offline. Despite the cloud being down I have full local functionality right now. (Though I can't see my history, surprised they don't cache that locally). Last year when I did a 9-day canoe trip with no cell phone reception, all of my Garmin gear worked flawlessly (wearables, navigation devices, and their offline map app). Can't say the same about my friends iWatches/fitbits or even some stuff on various stuff of iPhones and my pixel.

paozac 6y ago
Do they? Last Garmin product I had was a Vivosmart HR: an internet connection and a Garmin connect account was required to change basic settings such as the display orientation. And there was no way to disable syncing.
- wil421 6y ago
  The Vivosmart is more like a Fitbit. I don’t see it as a stand-alone device. Does it still count steps and track your heart rate without internet?
  - thinkmassive 6y ago
    Based on my experience using a Vivosmart 4 for sleep tracking, often in remote areas w/o mobile signal, it does store that data to be synced later. Obviously it has a finite memory but I don't recall having ever lost data from the device.
  - abkfenris 6y ago
    I tracked a 20 day trip down the Grand Canyon on my VivoSmart. I think it has the storage for a few months worth of continuous tracking before it needs to sync to free space.
- deleted 6y ago
  [deleted]
- christoph 6y ago
  My Forerunner 935 is basically the same story today. I can't do anything on it via the mobile apps. I guess I probably could do something with their desktop app and the USB cable, but it's really struck me how crippled the device seems today with their servers down, basically nothing is available or works at all through either Garmin Connect or ConnectIQ mobile apps. The apps don't appear to have any recent data cached locally either.

montebicyclelo 6y ago

I've recently started processing the GPX data from my (oldish) Garmin watch myself, thanks to https://www.gpsbabel.org https://www.gpsbabel.org.

Molpot 6y ago

Has anybody tried to reverse engineer garmin's bluetooth protocols? I often want to buy one of their smartwatches but the idea of having to install proprietary software on my phone kind of puts me off. I'd love to write my own software but I don't have any experience doing bluetooth RE.

barbegal 6y ago
You can just get the activity files off the watch via USB if that would work for you. https://support.garmin.com/en-GB/?faq=Ht3ZP52Kju075uKvqTqu99&productID=541225&tab=topics https://support.garmin.com/en-GB/?faq=Ht3ZP52Kju075uKvqTqu99...
- Molpot 6y ago
  Thanks but it doesn't, I want a watch to keep track of my swimming training, I'm afraid using USB connectors would make the watch less waterproof.
  - reaktion 6y ago
    I use a vivoactive 3: it has combination usb/charging port[1] that's completely waterproof and designed to be used while swimming. I believe most garmin watches share the same port design. [1] https://www8.garmin.com/manuals/webhelp/vivoactive3/Shared/GUID-AAF5E5D5-08C2-4886-BA1D-1F411F370135-high.jpg https://www8.garmin.com/manuals/webhelp/vivoactive3/Shared/G...
    - Molpot 6y ago
      I wasn't aware of that, thanks for telling me!
  - montebicyclelo 6y ago
    They tend not to put standard USB in the watch, but connections like this: https://media.dcrainmaker.com/images/2014/06/IMG_3109_thumb.jpg https://media.dcrainmaker.com/images/2014/06/IMG_3109_thumb....

wil421 6y ago

Recently I was looking into Fish finders. Garmin has some cool tech and their maps are great. I’ll have to make sure I don’t get a connected device.

rightbyte 6y ago
Having your gps time-out on you might be lethal. Imagine an hypothetical auto update bricking all gps devices in the group on a mountain top or the sea and relying on a compass and map if you were smart enought to bring it. Not having a gps makes many endouvers just that much more risky. Edit: made it clear it is a hypothetical scenario
- wil421 6y ago
  Does Garmin or any other GPS vendors have auto-update? Most of my wearables require me to confirm the incoming update (scheduled at night while charging) or I have to plug it into my computer.
  - rightbyte 6y ago
    I hope not it was a hypothetical scenario of IoT gps:es. But I mean if the fridge or cat feeder can brick it self ...
  - nradov 6y ago
    Most Garmin wearable devices can be configured to auto update. If the servers are online they will download new firmware via WiFi or Bluetooth and then install automatically. You can disable that feature.
- mattbk1 6y ago
  You should always have backup navigation aids available (printed maps, compass, watch), regardless of whether you trust your GPS device or not.
  - rightbyte 6y ago

TheWindUpPirate 6y ago

I wonder what the root cause is? They've just tweeted that the outage is also affecting call centres and their ability to receive email. [0] I'm glad their stuff is designed with zero connectivity in mind. Just slightly irked that my history isn't cached on my phone. [0] - https://twitter.com/GarminUK/status/1286279863217926144 https://twitter.com/GarminUK/status/1286279863217926144

codethics 6y ago
Ransomware.
aksss 6y ago
I struggle to imagine what non-segregated resource would be so central as to affect their customer-facing app platform, internal email (or maybe mail gateways), and call center. Maybe DNS got hosed? I mean pretty impressive ransomware if it swept across the company that far and wide, crossing so many network boundaries and resource types so quickly. Maybe accounts/control being held for ransom instead of storage encryption (what I usually think of as ransomware).
- nanidin 6y ago
  When I worked there, the entire internet for the campus went down. It took down the Garmin website and everything else Garmin. The culprit? Everyone was streaming music and/or videos. Everything shared the same internet pipe and streaming music starved out essential business functions. The next day all streaming services were blocked, and it was made clear we were being monitored for excess internet usage. Thus began the great brain drain to Apple, Amazon, and Samsung. Well that, and the fact that they took away the nice toilet paper and replaced it with one—ply right around the same time.
  - papito 6y ago
    One-ply toiler paper is where I draw the line. Nice toilet paper is a basic human right. Also, WHAT company of this size would try to save on toilet paper. Are you kidding me?

ytch 6y ago

https://www.ithome.com.tw/news/139004 https://www.ithome.com.tw/news/139004 (I'm not sure if it's reliable) This Taiwanese tech site says because of virus, IT system and production line are down for two days according to insider. they claim it might be ransomware.

codethics 6y ago
It is ransomware.
- mox1 6y ago
  Yep, I have a friend who works there. Not looking good right now.
  - NeoFeznet 6y ago
    Holy crap.
  - petee 6y ago
    Would love to know if they've lost control of their Play Store accounts, i.e, is there any risk of compromised app updates?
aksss 6y ago
My own pure speculation: imagining they shut the service off so no new data comes up and are aiming for an RPO of last night or some time earlier on the 22nd. Two days to do full restoration of services and global user data, meanwhile people trying to convincingly patch vulnerabilities. Say a prayer for the IT people trying to fix this.

SketchySeaBeast 6y ago

A close relation of mine got sick back country hiking and needed to text for someone to meet at a rendezous just this week using Garmin's texting services - I hope that this doesn't last long, I'd hate to think of what would happen if he'd tried to ask for help today. Edit: Looks like Garmin 'Explore' is still up, so maybe it'd still be OK.

zachware 6y ago
I think the Inreach sat services operate on the iridium network. They don't sync with or connect to Garmin Connect based on my experiences.
- SketchySeaBeast 6y ago
  That's good to know, and reassuring.
- zachware 6y ago
  Update: They use GEOS https://www.google.com/search?client=firefox-b-1-d&q=garmin+geos+response https://www.google.com/search?client=firefox-b-1-d&q=garmin+...
22fred 6y ago
InReach messaging did NOT work for quite some time. wed mid day through late Friday no send or receive at all on ours. Fri evening it was sporadic send/receive - not all messages were going through to all parties. Saturday 25th it seems to be working correctly.

mattmaroon 6y ago

I guess I always assumed Garmin made most of their money on their aviation products, since they are so dominant and so expensive. And those are designed to rarely if ever connect to the internet. But I guess I was pretty off on that, they’re only 20%. On a side note the graphs of their revenues per year and by category show a company that successfully branched out when their former big category, automotive, which was 80% of their revenue, began to be eaten by in car GPS and then smart phones.

fbnlsr 6y ago
I used to sell Garmin car GPS back when I worked in a retail shop. They were really good devices. But yeah I'm with you I thought most of their money came from aviation (it seems like everyone uses Garmin products), but their sports watches sell like crazy. Actually, I realized their network was down because this morning my watch would not sync after a run. :)
- frosted-flakes 6y ago
  Honestly, they're still really good devices. I have one from last year that's a solid alternative to an in-dash navigation screen, and for what I use it for, just as good as Google Maps, and in many ways better (way more convenient and customizable, completely offline except traffic, bigger screen, auto-on...).
  - kevin_thibedeau 6y ago
    Their latest motorcycle units are dog slow because some dumb product manager decided to build it on their old hardware platform using newer firmware which isn't a good mix. I have a 10 year old auto unit that is better then the junk they have now.
- parliament32 6y ago
  Yeah I noticed this morning too, Garmin Connect says "maintenance" but of course HN has the real story.
- 6y ago

codethics 6y ago

Confirmed hacked.

recrudesce 6y ago
provide an official source for the "confirmation" other than that ithome website...
jstr 6y ago
Source?

9nGQluzmnq3M 6y ago

A leaked email from Garmin's Taiwan office says everything including the production line has been shut down for two days: https://translate.google.com/translate?sl=auto&tl=en&u=https%3A%2F%2Fwww.ithome.com.tw%2Fnews%2F139004 https://translate.google.com/translate?sl=auto&tl=en&u=https... Local media suspects a ransomware attack, which is about the only thing that could explain how widespread this is.

codethics 6y ago
Can confirm it is a ransomware attack.
- sn_master 6y ago
  Source? Do you work there? Do you know whats the ransomware used or how much they're demanding?
  - deleted 6y ago
    [deleted]
  - francisofascii 6y ago
    Total speculation, my guess is WastedLocker. It has been hitting all types of companies in the past few months. Have a friend who's company was hit recently. They were somehow were able to encrypt the backups.
    - aksss 6y ago
      My vote is something's being held for ransom like DNS or account access rather than traditional storage encryption. It's pretty impressive if storage encryption crossed so many network boundaries and affected so many diverse resource types - phones, chat, email, website, distributed app platform. What other central resource besides DNS would have such a broad impact?
      - 5h 6y ago

some_random 6y ago

Talked to someone I know there who said it looked like ransomware targeting all windows boxes, including those connected via VPN.

coldcode 6y ago
Either the people in charge of security were dumb (dealt with some of those) or they were smart and the executives refused to listen or fund them (met those as well) or both (and have worked at places like that too). I wonder how many companies fall into these categories.
- TwoBit 6y ago
  What would they have suggested that executives might not listen to?

foobarbecue 6y ago

Yikes, does this affect inreach service? If so, lives are at stake.

macNchz 6y ago
I just put my inreach device out on my back deck and sent myself a test email and sms–seems to be working fine. I can't log in to manage my account, but their status page claims that the critical inreach services (SOS and comms) are up and running: https://status.inreach.garmin.com/ https://status.inreach.garmin.com/
- foobarbecue 6y ago
  Yep just tried mine too. Well, that's a relief.
parliament32 6y ago
Everything inreach is up except for billing, it's a separate system: https://status.inreach.garmin.com/ https://status.inreach.garmin.com/

jacquesm 6y ago

The internet-of-things that aren't really your things strikes again. When will manufacturers learn that their hardware should function even if their services are down? The whole account/subscription tacked on for no apparent reason thing is highly irritating, and Garmin is actually better than most.

nradov 6y ago
Yes the Garmin Connect mobile app ought to be able to do a lot more without a server connection. But in fairness to Garmin they don't charge subscription fees. After you buy a device you can use the service for free.
- jacquesm 6y ago
  If it is up.
notdang 6y ago
the Garmin devices that I own are working, it's just that I cannot synchronize the activities to the cloud.
mdoms 6y ago
My watch is functioning just fine. I can see historic data, log a run, tell the time etc.
- asimilator 6y ago
  The mobile app is 100% nonfunctional. Also any changes you made on the mobile app (eg editing rep counts in a weight lifting activity) are not synced back to the watch.
kettro 6y ago
When I worked for Garmin, we deliberately designed products to work for as long as possible offline - the Bike Speed & Cadence Monitors (~2018) are able to work for 1 year, riding every day, then a battery change, and then another year, all before a sync to a device is required. All of the rides should be stored on-device.

ShepherdKing 6y ago

Not sure if it's related, but asteroid 2020 ND is supposed to be passing by the Earth on July 24th. https://indianexpress.com/article/explained/explained-nasa-asteroid-2020-potentially-dangerous-to-earth-6515170/ https://indianexpress.com/article/explained/explained-nasa-a...

sonofgod 6y ago
That's passing fourteen times further away from the moon. It won't have any effect on satellite operations. For a sense of scale on satellites: https://en.wikipedia.org/wiki/Low_Earth_orbit#/media/File:Orbitalaltitudes.jpg https://en.wikipedia.org/wiki/Low_Earth_orbit#/media/File:Or...

humanlion87 6y ago

Even the status page is not loading for me. Which seems weird.

deleted 6y ago

[deleted]

fery09 6y ago

This very stupid big company ever..., going down for 12 hours. What their IT doing, their IT never thing about Disaster Recovery ? Or the company very stingy to invest for disaster recovery plan. Now my Fenix 6 like a stupid smart watch.

PaulPfeiffer 6y ago

While I am concerned a little for the location of my home now being in the hands of the wrong people. I am more Concerned with Garmin's Unprofessionalism... People who own yachts should probably be the most concerned..

aksss 6y ago
Why's that? Concern over location data or something? I don't own a yacht but the Garmin gear in my boat assumes no Internet connection (kinda the point of the boat) and sees no impact from this event. Garmin wearables, however, are in use all day, every day, have associated PII to a minor degree, a broader audience and have been severely crippled by this. Curious what the yacht angle is that I may not be acknowledging.
alfalfasprout 6y ago
Marine and aviation units don’t connect to the internet for data typically. Their inReach satellite communicators also use a totally different network that’s unaffected

cnbuff410 6y ago

How does ransomware attack work if the company host all of their service in the cloud (aws/gcloud/etc.)? Based on some preliminary readings, it seems like ransomware attack is mostly conducted on a physical machine. If your service data is all stored in the cloud and not synced with any of the machines owned by your employees, are you still subject to this type of attack?

clairegraham 6y ago
You could still encrypt all the stored data in the cloud and delete everything that is unencrypted. Since most of the historical data that customers upload is in the Garmin cloud, not on their local devices (I believe the local device only stores a small period of recent activity), this potentially means a lot of lost data for customers. I would also imagine things like accounts and their relations to hardware devices (which account is associated with which device) is stored in the cloud somewhere, so those associations alone are important for synchronizing data to the cloud. This will be a mess to cleanup if true, if they don't have some kind of separate off-site backups outside of this compromise.
grl 6y ago
Ransomware and cloud are very generic terms. Ransomware is a concept of encrypting data to deny service. Cloud really references virtual architecture that is easy to expand and contract, often in a 3rd party cloud provider like Azure or AWS. The "machines" could be windows, linux, docker containers, Lamda functions (AWS), etc. running virtually in "the cloud". So, a ransomware in the cloud just means that someone encrypted data that is stored on cloud architecture. Certainly quite possible, but not as common as encrypting windows machines, which is what usually makes the news.
- userbinator 6y ago
  but not as common as encrypting windows machines, which is what usually makes the news. It could be Windows machines in the cloud.

DebtDeflation 6y ago

This is frustrating. I have a Garmin Fenix 6X Sapphire (that I absolutely love) and on seeing this headline I checked the Connect app on my phone and sure enough I cannot access any of my previous activities. You'd think that in this day and age of phones with 128GB+ storage that they'd be caching at least some of your historical data locally, but nope it's all in the cloud, which is currently inaccessible.

scruple 6y ago
I've been tinkering with the idea of writing a service agent that detects when my Garmin GPS watch is connected to my desktop (where / how I charge it) and automatically pulls down any new activities to store locally as a backup. Starting around 2012... I used to scrape my activities off of the Garmin Connect website, I eventually got tired of the manual nature of this process and also having to keep up with changes they made to their site. After that, I used something called, I believe, Tapatirik, for a while, to automatically sync them to a Dropbox account. But, it wasn't flaky sometimes, so I eventually gave up entirely and just turned on the sync to Strava option. But that also has spurious failures that are annoying to deal with. And on and on it goes... Frustrating is one word for it. I'm at a point where I find it to be completely anti-consumer.
- nradov 6y ago
  GoldenCheetah can do at least some of what you want. https://www.goldencheetah.org/ https://www.goldencheetah.org/
  - scruple 6y ago
    Thanks for that!
- mackmgg 6y ago
  It's not as automatic, but Garmin BaseCamp does let you pull your activities from the watch. I believe it has an option to transfer every time it's open and a device is plugged in, but it doesn't run in the background.

dang 6y ago

We changed the URL from https://connect.garmin.com/status/ https://connect.garmin.com/status/ to an article with more info.

fbnlsr 6y ago
Thanks!

deleted 6y ago

[deleted]

GaryNumanVevo 6y ago

I've got a Fenix 5x, and I'm kind of old school about it. I don't use bluetooth, since my phone is typically off when I'm backcountry hiking. I load up all my traces and map layers over USB, have been for 12 years across a bunch of my Garmin devices

artemisyna 6y ago

Hm. I recently bought a Garmin Inreach Mini (satellite emergency communication device), intending to use it for some long backcountry hiking/backpacking trips I'm planning on taking. Really hope this isn't effecting their emergency service/emergency communication devices. Subscription management, at a minimum, was via the Garmin website.

zachware 6y ago
Garmin sat trackers use the Iridium sat network and outsource the response to GEOS so you'll be fine. https://www.google.com/search?client=firefox-b-1-d&q=garmin+geos+response https://www.google.com/search?client=firefox-b-1-d&q=garmin+...
davidbanham 6y ago
I suspended my inReach plan during the lockdown but was about to re-enable it for a motorcycle camping trip next weekend. Hope the website is back up in time!

sakopov 6y ago

It appears that even some garmin.com assets are failing to load right now.

guzik 6y ago

Yikes. Going through the comments it seems their products can still work offline? How about caching? Garmin is our direct competitor, but we wish them a quick recovery.

petee 6y ago
If there is one thing Garmin really needs, its competition. I'd love to hear who you work for, and I hope you gain some ground
- saagarjha 6y ago
  From their profile, it looks like it's Aidlab.

aksss 6y ago

This might be a fine time to plug an app called RunGap - https://www.rungap.com/ https://www.rungap.com/ Disclaimer: I'm not associated with them other than being a satisfied user of it. RunGap takes your activity data from one service and migrates it across others - so your activities you upload to Garmin Connect will be copied over to MapMyRun, Runalyze or whatever, including DropBox and/or iCloud. It won't help you now, but in the future it may be a good way to derisk the loss of your activity history. I think it's apple device only though. :/

fredrikaverpil 6y ago
There's also https://tapiriik.com https://tapiriik.com for syncing.

justkez 6y ago

It’ll be interesting to see how Strava copes when the tap is turned on again. Maybe there’s some rate limiting built in but they’ll be getting a flood of accumulated data to process

aksss 6y ago

My Garmin Connect app is now syncing with wearable and showing steps and other stats again. I briefly had an updated banner that said they were planning system maintenance from 7am on the 24th to some end time, and then it went back to the "down for maintenance" message within a three-minute span. Interesting. They may be staggering trying to bring some workarounds online.

ackbar03 6y ago

Nobody seems to be mentioning how the data is potentially more valuable then the ransom? If customer data is stored on their servers, the hacker potentially has the historical location data and identities of a lot of their customers now, which could potentially contain sensitive information of important people and possibly valuable to state actors

helsinkiandrew 6y ago

Does anybody have any understanding of either the WastedLocker ransom ware or Garmin's internal systems that can explain how it can have such a massive affect on its website, production backends (including airplane navigational systems), call centre, and possibly manufacturing systems. Is this windows everywhere? or badly partitioned systems or have they pulled the plug on everything just to be sure

joann56 6y ago

Be warned, most of these so called hackers are imposters, I’ve been ripped off twice already, thankfully my friend gave me a reliable contact, he works with discretion and delivers, he does all sorts of hacking and help me hack my ex Facebook, Whatsapp, iCloud, IG, Snapchat and Phone messages remotely with the software he bought, I would prefer to let his services speak for itself, you can contact him at eaglespyhacker @ gmail . com , thank me later