13 ms·

Garmin obtains decryption key after ransomware attack

181 points by thinkmassive 6y ago

Alex3917 6y ago
> If a payment was made through a third party it could also be covered by the Treasury sanctions, which warn: "Foreign persons may be subject to secondary sanctions for knowingly facilitating a significant transaction or transactions with these designated persons." I accidentally took a phone call for a job that basically involved using Bitcoin to launder money to send ransom payments to terrorists. They told me that although it's technically illegal, the U.S. government has never prosecuted anyone for paying a ransom. I noped out after the first phone call for obvious reasons, but it was pretty interesting just to learn about the industry. Anyway when Garmin says they didn't pay the ransom themselves, they are telling the truth, instead they would have used this company or one of their competitors. You can't just open a Coinbase Pro account and buy 10 million BTC and transfer it your first day. No bank is going to allow you to do that, since they would then be liable for facilitating that transaction. Instead you need to contract with a company that specializes in ransom payments and has already accumulated the crypto in advance. Then you pay them a percentage for their services.
- CobrastanJorji 6y ago
  Weird. I would think that while it's not worth the government's time to go after individual companies paying off ransoms, it would definitely be worth their time to go after a business professionally focused on paying illegal ransoms who tell interview candidates that they are aware that what they do is illegal.
  - Alex3917 6y ago
    Maybe, maybe not. It's technically illegal to grow or possess any amount of weed, but in practice you don't get prosecuted (by the feds) unless you have over 100 plants or thousands of pounds. Until ~2004 it was illegal for native Americans to be within Boston city limits. There are thousands of things that are illegal, but in practice are rarely or ever prosecuted, even in cases where people are violating those laws at pretty significant scales. In my case that's not a risk I'd be willing to take, but I can see why other people would. The reason it's not prosecuted though isn't because of companies, it's because there are lots of wealthy people who travel overseas and then get kidnapped, and the government isn't going to prosecute their families for paying to not have their kids dismembered and the videos posted on YouTube. The reason companies aren't prosecuted is mainly because once you decide not to prosecute families for doing this, then anyone else can make an equal protection argument.
    - codeflo 6y ago
      The perspective that there are “thousands of things that are illegal” but not prosecuted always fascinates me, that’s not at all a common perception e.g. here in Germany. Is that a difference between common law and civil law systems? Maybe in places where code law is mostly binding, there’s a lot more pressure on the legislature to keep the law books up to date with the current norms of society.
      - cheschire 6y ago
        In Germany it's currently illegal for someone to leave an escooter outside of a designated parking space. How many of them have you seen just laying around? I know in Mainz I've seen dozens. Just saying, there's plenty of laws here that aren't prosecuted either.
      - paulcole 6y ago
        In Germany it seems as if something is outlawed then it is believed that thing physically can’t be done. In the United States, we take it as a challenge!
      - GlenTheMachine 6y ago
        Personally I see a big difference in the philosophy of lawmaking in the US vs Germany. Take driving, for instance. In the US, almost anyone who can physically climb behind the driver's seat of a car can get a drivers' license, and indeed having a drivers' license in the US is almost a fundamental right. Speed limits are then set, to first order, to accommodate the fact that you have marginal drivers behind the wheel. In addition, the police can - and do - selectively enforce driving laws. Ideally that power would be used to keep truly bad drivers off the roads, although the current civil unrest in America shows that that selective enforcement is, to put it mildly, abused. In Germany, the barrier to getting a drivers' license is much higher. More training, more stringent tests. But the effect of that is that drivers are (mostly) assumed to be able to adapt their driving to road conditions; as a consequence, you get unlimited legal driving speeds on part of the German road system. In good weather, traffic permitting. Of course, there are confounding facts: in my experience the average physical state of a car is much better in Germany than the US, and highways are better maintained. But still, the contrast is interesting. In the US, lifting speed limits on even straight roads through the desert would have poor outcomes.
  - meowface 6y ago
    It's a pretty legit business model; just because it's illegal doesn't necessarily mean the government wants to go after them. "Focused on paying illegal ransoms" = "allows companies to recover from devastating attacks by being a middle-man for paying the extortion fee and getting the decryption keys". It's probably one of those things that the government tells people not to do, but acknowledges is inevitable in many cases. A company I worked at once had a meeting with such a firm, and it all sounded pretty reasonable to me. Obviously, one would hope the company has backups (which are stored in a place that can't itself become encrypted), but if they don't, sometimes the cost of paying the ransom is far, far lower than the cost of staying down. These middle-man firms have probably saved companies from enormous amounts of damage. Another commenter claimed these companies are often in cahoots with the ransomers, which maybe is sometimes true, but I highly doubt it in the case of the company we dealt with, or other US-based companies with physical locations that meet on-site. Of course in an ideal world no one wants to reward criminals, but just to give an extreme example, if someone kidnapped one of your children and held them hostage, you'd probably pay anything to get them back, and that's not far off from the situation some ransomware-affected companies end up in.
    - Dahoon 6y ago
      When most of them are from a little connected with the hackers to basically the same people and live off of ransoms I wouldn't use words like Pretty legit. I'm sure the exact business you have worked with is very different, in your opinion. I'm also sure everyone says that. I doubt a single of these businesses exists that isn't connected to hackers at all. How about a name if you are sure and we'll see?
      - meowface 6y ago
        What are you basing any of this on? Can you show a single example of an American company that this applies to? The onus is on you to substantiate the claim in the first place, not on me to prove innocence.
    - the8472 6y ago
      > Of course in an ideal world no one wants to reward criminals, but just to give an extreme example, if someone kidnapped one of your children and held them hostage, you'd probably pay anything to get them back, and that's not far off from the situation some ransomware-affected companies end up in. That's an appeal to emotion though while a company can do a cost-benefit analysis. Also, if you pay for your children that means you signal that the kidnapping business model is viable and thus endanger more children. If the government keeps you at gunpoint from paying for your children then yes, in the worst case a bunch of children might die, but the business model would die with them.
  - dogma1138 6y ago
    Paying ransom is illegal in some jurisdictions because it’s seems to be the easy way to prevent ransoms if it works or not I don’t know. Ransom works when the target is capable and has sufficient incentive to pay out, if you make it so that you’ll face jail time as a CEO who orders a ransom to be paid out it’s quite likely might reduce acts of ransom. I know that there is grey area that is common in the energy and global construction sectors where companies might not be able to pay ransom legally essentially have a ransom insurance so when 3 of your workers get kidnapped in Djibouti you have your “insurance company” which also often facilitates negotiations, extraction and repatriation handle the case. (This is also common for other reasons, especially liability reduction if something goes wrong the company can wash their hands of the case and send the families after the “insurance provider”.) There is also the grey area of “private emergency services” which range from private medevac on standby to assault teams capable of executing asset recovery missions some even take pride of being able and willing to perform prison breaks.
- brianbreslin 6y ago
  I heard on NPR I think that some of these middlemen companies are actually often in cahoots with the ransomware distributors.
  - superhuzza 6y ago
    I remember reading a fascinating article on the nature of the companies that deal with ransomware. I think it was this one. The TLDR is that these middleman companies allow ransomware victims to both pay the fine and save face, by acting as if they didn't pay the fine. The perpetrators prefer to deal with the middlemen as they know how to pay in crypto, and are predictable - the middleman and the hackers are closer to partners than adversaries. https://features.propublica.org/ransomware/ransomware-attack-data-recovery-firms-paying-hackers/ https://features.propublica.org/ransomware/ransomware-attack...
    - usrusr 6y ago
      Somehow you missed to mention the part where the middlemen put up a slow claiming to do it by computer forensics and cryptoanalysis, supplying deniability to those who do want to pay and fooling those who don't.
      - superhuzza 6y ago
        Yes sorry I missed that, I read the article several months ago. Pretty scummy of them.
- gpm 6y ago
  I'm curious, when you say terrorist, do you mean groups like Evil Corp (mentioned in the article), or do you mean groups of more "traditional" terrorists funding themselves via malware? Edit: Or were the ransomware payments at hand not even malware related, but more "traditional" ransoms?
- SkyBelow 6y ago
  If I handed you $110 to go buy $100 of drugs, then I'm still paying for the drugs. What judge would be willing to allow such a gotcha to actually pass? There would be a massive industry for legally paying for illegal things if that were the case. Then again, the acceptability of a gotcha seems to correlate more with the amount of money spent on lawyers than on the rationality of the gotcha, so as long as they have a large enough legal department the worse they'll have is a fine that they likely already included in the cost of the attack.
  - jdkrkrkf 6y ago
    You could argue that they are paying under duress. No judge will hold that against you.
- mytailorisrich 6y ago
  I don't think that it is illegal to pay a ransom in general under US law. It is illegal to receive a ransom, though. As mentioned in the article, they are caveats related to terrorism and to dealing with entities on sanctions lists. Now, if Garmin obtained the decryption keys, as is alleged in the article, it is clear that they paid. Note that the 'anonymous sources' cited did not even deny payment but only used a weasel turn of phrase 'did not directly make a payment', which is quite different from 'did not pay'. My best guess, if a payment was made, is that they hired people experts in dealing with these situations who arranged everything and who will bill for 'consulting services'...
  - Alex3917 6y ago
    > I don't think that it is illegal to pay a ransom in general under US law. I mean I’m pretty sure you’re not allowed to go wire money to Al Qaeda, or to conspire to evade anti money laundering controls in order to do so.
    - mytailorisrich 6y ago
      That's why I wrote 'in general' and that there were caveats related to terrorism. Money laundering is another issue. In general I think people are still free to spend their legitimate money (it's not money laundering to begin with).
- tzs 6y ago
  > They told me that although it's technically illegal, the U.S. government has never prosecuted anyone for paying a ransom If I was going to take a job doing something that is illegal, I think I might prefer one where the government has prosecuted people. Then I could look at those cases and see what people got off with just probation, which got light sentences, which got harsh sentences, what kind of plea deals were offered. Then I could at least have a decent chance of figuring out if the pay and benefits are worth the risk. If they haven't prosecuted anyone (and this is not a line of work that has been around for a very long time), I'd worry that they just haven't gotten around to it yet, and I could end up being the first. Being first could be very bad, because they might be pushing for a harsh sentence to discourage others or encourage people prosecuted later to take plea bargains.
  - WrtCdEvrydy 6y ago
    To be honest, it's probably a third part company. Funny enough, back when ransomware was simpler and used the same encryption key, we managed to recover one place by using Memory Forensics on a fucked machine. I wonder if extracting the key, decrypting the files to not pay $100,000 in BTC would be illegal in some way.
    - Simon_says 6y ago
      Of course. In the US it violates DMCA.
      - nix23 6y ago
        Yes ransomware has copyrights too and often its closed source, so take the key out (disassemble) would be illegal ;)
      - cxr 6y ago
        This is simply not true.
bt3 6y ago
It's not clear to me from the article that Garmin did in fact get the decryption key. There's enough verbiage suggesting they didn't pay the ransom, so are we to assume they had other means? It also took Garmin quite awhile to acknowledge the ongoing situation formally (their outage page has been accurate with red lights across the board). Could it be that Garmin just started to spin up more hardware and began a migration of their last backups? (I'm so far removed from how their service operates so apologies if this sounds impractical)
- vb6sp6 6y ago
  > There's enough verbiage suggesting they didn't pay the ransom It says they "did not directly make a payment to the hackers". You can't just take 10mil and convert it to bitcoin. My best guess is that a 3rd party made the payment and garmin will be reimbursing
  - NotSammyHagar 6y ago
    saying they did not directly make a payment makes it certain someone paid.
  - usrusr 6y ago
    They might have paid one of those ransomware subcontractors who claim to solve the problem on a technical level while they actually just pass on the money they are paid after taking a cut. This could have happened both knowingly (on Garmin's side) and not.
- solumos 6y ago
  Migrating to backups seems possible. Garmin is pretty complex in that it produces hardware and software across a few verticals, but I don't think there's anything that makes them particularly unique in the way they'd handle backups/failover. I think it's also possible that Garmin proactively pulled the plug on their public-facing services in order to mitigate the spread of the attack. It would be _really_ bad if the attackers could make the hop from Garmin's web services to consumer devices.
_salmon 6y ago
There's nothing definitive that says they paid the ransom or obtained the decryption key from the attackers. Rumors on Twitter say that they're rebuilding services from backups and slowly getting things back online
- solumos 6y ago
  I can imagine it's possible that a 1-week outage + cyber risk insurance claim + rebuilding from backups could net out to less than $10M.
  - nomdep 6y ago
    It doesn't matter. Unless a live is at risk, you never ever pay ransoms, or others will try again.
    - keitmo 6y ago
      The outage took out at least some of their aviation services. If they are unable to update routes and IFR approach procedures then lives could indeed be at risk.
      - aaronmdjones 6y ago
        Not quite. The onus is on the pilots to never fly with out-of-date navigation information (it's actually illegal), so if they can't get that from Garmin, they'd just have to get it from somewhere else instead. Garmin's data services being unavailable isn't endangering anyone.
        Scoundreller 6y ago
        Yep, Plenty of planes flying out there without any electronic maps. The attack happened about a week after the FAA’s last update went into force. And I believe they’re distributed a week before that. So the only groundings would’ve been those that have been parked for a while (I guess. I don’t know how they do updates). https://www.faa.gov/air_traffic/flight_info/aeronav/aero_data/NASR_Subscription/ https://www.faa.gov/air_traffic/flight_info/aeronav/aero_dat... —armchair aviator
hangonhn 6y ago
I wonder if going after such a well known target was a mistake since once the news leaked out it put Garmin in a position where it would be much harder for them to pay the ransom. I wonder if their chances of success are higher by going after a larger number of lesser known and less valuable targets who may not garner the attention nor have the IT staff to deal with the issue.
- interestica 6y ago
  But then you're not going to get as high of a payout? Maybe this math works, or maybe it's a feeler to figure out where the line is.
  - loa_in_ 6y ago
    Maybe the smaller targets were already tried but didn't make the news
- sukilot 6y ago
  They go after everyone.
NotSammyHagar 6y ago
I'm quite surprised that people seem kind of ok with the idea of ransomware. It's a horrible, criminal corrupt practice and it's destructive to pay or participate in anything to do with this.
- bitxbitxbitcoin 6y ago
  I think the kind of ok feel is from the "they should have had backups, that'll teach 'em" crowd.
SimonPStevens 6y ago
This title is overly misleading. There is no evidence presented in the article to even suggest they paid the ransom. And Garmin declined to comment. It's possible they paid, but it's also possible they are just restoring backups.
- NotSammyHagar 6y ago
  I'm certain they paid, that's why they are making ambiguous statements. I hope they prosecute them for this payment. An indirect payment is still a criminal action in my opinion. If the mafia said they'd burn their building down or kill their ceo or whatever, and they paid them off through some abstract indirect transaction it would still be wrong. This should make them a direct target now, they will pay you off. Among many many reasons allowing payments like this will just encourage these criminals to keep doing this bullshit.
  - sukilot 6y ago
    I don't want to live in a country where the government prosecutes victims of crimes instead doing its primary duty of national defense against foreign attackers.
    - NotSammyHagar 6y ago
      That sounds great in theory, don't prosecute victims of crimes. The govt. must go after these people, regardless of victimization. Yet if the victim encourages more dangerous actions and the 'victim' was a billion dollar corporation they can afford it. It shouldn't be legal to pay off mafia threats, and that's what this basically is. Who is the victim in prostitution (where no one was trafficed), how about if I buy pot, who is the victim where it's illegal? That theoretical vision of how you want society to work is not matched by the reality of the US.
- beloch 6y ago
  If they didn't pay off the hackers and are recovering on their own, it would be in Garmin's best interests to issue a public statement explicitly saying so. Failing to do so may make them a target for other hacker groups. Their vulnerability is now proven and their willingness to pay strongly suggested.
rodgerd 6y ago
I am a lot more interested in the answers to questions like: 1. Why was there lateral spread across low-criticality devices fitness devices and avionics devices? 2. Why was there lateral spread across manufacturing, customer support, and PII regions? 3. What assurances are there that health information wasn't leaked? 4. What's the general security position around avionics, marine, and health data at Garmin?
- Spooky23 6y ago
  Segmentation is expensive and slows stuff down. Businesses are bad at segmenting risk. I'd expect the avionics and marine stuff to be a little better due to compliance requirements.
  - dylan604 6y ago
    I don't know. It seems like whenever a company needs to have data shared, it by default is siloed. Yet when a company needs siloed/segmented verticals, they are shared with no boundaries. You rarely hear about companies that have done it correctly, yet everyone has worked for a company that does it badly.
- drtillberg 6y ago
  You want to know if Garmin pushed malware/ransomware via its app onto 1 million smartphones? The apps seem to have been last updated July 21, and Garmin's systems were locked July 23, so.... ?
ideals 6y ago
A few people have commented on the logistics of paying a large Bitcoin ransom which can entail hiring a 3rd party to pay it. Could an independent party buy the decryption keys from the ransomware party for their asking price then attempt to resell this to Garmin (or other party) for more money? Of course it's a bit game theory because you're depending on the target to pay and the ransomware attacker to not relinquish and resell the key to anyone else including the target. Ignore the legality of it all else it's not very interesting to think about.
- usrusr 6y ago
  More likely scenario: the attackers demand 10 mil knowing that 10 would be an unlikely best case scenario and a more likely outcome would be something like 2 mil, passed on on exchange for the keys by a cooperating fake computer forensics firm that claims to be able to restore the data without paying the attackers. For only 3 mil, an absolute bargain. The victim would pay the 3 mil, either falling for the show or claiming to be falling for the show.
exabrial 6y ago
I should be able to see all of my locally recorded stuff without the cloud. I was happy that basic functions of my Garmin Venu continued to work. But some stuff should be cached, or stuff that hasn't been sync'd should be available locally.
- zwaps 6y ago
  I want to say that previous versions of Garmin connect did have the data locally, such that you could see your runs or activities without being connected to the Garmin services. The present version of Garmin connect does nothing if you are not connected to Garmin servers. E.g. you can't see your activities, your data or anything else. When this change occurred, I remember that it annoyed me greatly. Why not have some local data cached on your phone? Other apps seem to manage that no problem. If you'd have no internet access, you could at least still use the app to see your activities and sync them later. This seems so obvious to me that I have trouble understanding why they chose the current route. Of course, it's still not a total disaster. Garmin devices still work and track, you can still view the data on them, and they usually plug in as a USB drive anywhere so you can upload the data manually. Still, for smartwatch users, this could have been a really minor inconvenience rather than what it is now.
jrockway 6y ago
Has there been any discussion about the technical details of the attack? I am having a hard time imagining how a compromise of a workstation could result in the entire company -- their own apps, their call center -- going down for days. I can see how malware could break production severely ("kubectl delete deployments" from a trusted workstation). I can see how malware can wipe out your desktop. I can see how malware could f your cloud infrastructure account. But I'm not drawing the line to "we can't build a new release and deploy it on another provider" or "we can't buy an emergency Dialpad account to start taking calls from customers". My guess is this: two separate attacks occurred. The first attack involved compromising production, and installed a scheduled job that, at a certain time, would delete all database backups and code repositories, deschedule all workloads, delete all DNS records, etc. The next attack involves the fact that all source code is on managed workstations, so they compromised the IT management system to push malware to every machine globally at the exact same time that would destroy all git repositories (etc.) on the workstations. The result was that when the scheduled time occurred, production would crash and there would be no backups. (They must have wiped all the tapes at their offsite backup facility, too. I guess anything can be done for a price!) To me, this sounds too complicated to even be feasible. I am still impressed when I edit some manifest with a new version number that 90% of the time that code eventually starts running. Being able to orchestrate a multiday outage just seems amazing to me, and that you'd make a lot more money being a cloud provider than a cybercriminal. The other thought I had was that maybe they just kept thinking "we're so close to getting it back" for three days, rather than saying "everything is lost, revert to backups".
- james412 6y ago
  > I am having a hard time imagining how a compromise of a workstation could result in the entire company -- their own apps, their call center -- going down for days Can't guess at specifics, but if it's a Windows network, I would be utterly unsurprised if all users had excess permissions to shared drives Many Windows networks just have a giant X: everyone can write to, and it's been like that forever, and it's so deeply baked into everyone's workflow that it never gets fixed
  - 6y ago
interestica 6y ago
> Smartwatch maker Garmin has obtained the decryption key to recover its computer files from a ransomware attack last Thursday, Sky News has learned. Is this really the aspect of their business that they're most known for now? I still think of them as a GPS/Geolocation device company.
- thelean12 6y ago
  GPS smart watches are probably their most successful consumer product currently. If you glance at their website you might think that's all that they do.
- usrusr 6y ago
  It's their absolute boom segment right now, dwarfing the revenue of all others. Somehow the Apple watch made a lot of people who'd rather wear a Garmin suddenly think that it's perfectly fine to wear an absurdly expensive GPS watch. Garmin has succeeded in establishing a price range where the Apple offering would barely make the upper third.
  - aeyes 6y ago
    They and many competitors offer models in every price range, starting at 50$. Of course they will also offer very high end devices with features you won't find on an Apple watch. I'm pretty sure the 200$ model has features that Apple doesn't have. One is primarily a lifestyle product and the other is primarily focused towards athletes. Both brands overlap with some products but I wouldn't say they found a way to really get their foot into others' market.
  - glenngillen 6y ago
    I feel seen by this comment! TBF, I already had a Garmin GPS watch that I bought circa 2006 (one of their first I believe) for tracking my runs. When it came time to upgrade I compared it to the Apple watch. And you're right. I definitely decided I'd much rather spend that much money on something with a 12yr upgrade cycle vs the 2-4 year cycle on many of my Apple devices. What I've found most surprising is I have young children, and having a Garmin activity tracker watch (seems to be not much more than a step counter) has become the thing every 6yo is expected to have these days. We've avoided it so far, but from speaking to parents with children at neighboring schools they're nearly ubiquitous in the youngest year levels now.
truthwhisperer 6y ago
that probably points them to the right direction. However, would be scared to trust Garmin with any medical or medical related data. This happening is a big no-go
verytrivial 6y ago
For the vast majority of users Garmin have ZERO liability re data retention. They could just say WHOOPS! and zero all accounts and require everyone to resync. And I would have respected them for that as they've now sent $10M to these assailants to increase the sophistication of their attacks and retain/lure/entrap more skilled developers. But then I'm a bit of a moral absolutist. If their financial records were all toast too I wonder what the fines would have been ...
- cafebabbe 6y ago
  brand reputation is a heck of a liability
- kochthesecond 6y ago
  Yeah, Id also accept all my data zeroed instead of financing hackers. It still puzzles me greatly how this ransomware has such a huge impact. How Does it allow hacking and encrypting the db servers?
concerto 6y ago
I was confused by the use of "sanctioned" in the byline. They meant it mean "had sanctions imposed", but I understood it as "given permission" which set the article in a completely different tone. What an odd word.
- bobbylarrybobby 6y ago
  More fun examples here: https://en.wikipedia.org/wiki/Auto-antonym?wprov=sfti1 https://en.wikipedia.org/wiki/Auto-antonym?wprov=sfti1
- theli0nheart 6y ago
  I had the same reaction. "Sanctioned by" would be the correct usage here.
JohnTClark 6y ago
Does US or other western country ever retaliate? It seams to me that Russia and China keep attacking as and we do nothing. Was vkontakte ever taken down? What would happen if an US hacker group "independent" of NSA would attack a Russian company?

181 points by thinkmassive 6y ago

> If a payment was made through a third party it could also be covered by the Treasury sanctions, which warn: "Foreign persons may be subject to secondary sanctions for knowingly facilitating a significant transaction or transactions with these designated persons." I accidentally took a phone call for a job that basically involved using Bitcoin to launder money to send ransom payments to terrorists. They told me that although it's technically illegal, the U.S. government has never prosecuted anyone for paying a ransom. I noped out after the first phone call for obvious reasons, but it was pretty interesting just to learn about the industry. Anyway when Garmin says they didn't pay the ransom themselves, they are telling the truth, instead they would have used this company or one of their competitors. You can't just open a Coinbase Pro account and buy 10 million BTC and transfer it your first day. No bank is going to allow you to do that, since they would then be liable for facilitating that transaction. Instead you need to contract with a company that specializes in ransom payments and has already accumulated the crypto in advance. Then you pay them a percentage for their services.

CobrastanJorji 6y ago
Weird. I would think that while it's not worth the government's time to go after individual companies paying off ransoms, it would definitely be worth their time to go after a business professionally focused on paying illegal ransoms who tell interview candidates that they are aware that what they do is illegal.
- Alex3917 6y ago
  Maybe, maybe not. It's technically illegal to grow or possess any amount of weed, but in practice you don't get prosecuted (by the feds) unless you have over 100 plants or thousands of pounds. Until ~2004 it was illegal for native Americans to be within Boston city limits. There are thousands of things that are illegal, but in practice are rarely or ever prosecuted, even in cases where people are violating those laws at pretty significant scales. In my case that's not a risk I'd be willing to take, but I can see why other people would. The reason it's not prosecuted though isn't because of companies, it's because there are lots of wealthy people who travel overseas and then get kidnapped, and the government isn't going to prosecute their families for paying to not have their kids dismembered and the videos posted on YouTube. The reason companies aren't prosecuted is mainly because once you decide not to prosecute families for doing this, then anyone else can make an equal protection argument.
  - codeflo 6y ago
    The perspective that there are “thousands of things that are illegal” but not prosecuted always fascinates me, that’s not at all a common perception e.g. here in Germany. Is that a difference between common law and civil law systems? Maybe in places where code law is mostly binding, there’s a lot more pressure on the legislature to keep the law books up to date with the current norms of society.
    - cheschire 6y ago
      In Germany it's currently illegal for someone to leave an escooter outside of a designated parking space. How many of them have you seen just laying around? I know in Mainz I've seen dozens. Just saying, there's plenty of laws here that aren't prosecuted either.
    - paulcole 6y ago
      In Germany it seems as if something is outlawed then it is believed that thing physically can’t be done. In the United States, we take it as a challenge!
    - GlenTheMachine 6y ago
      Personally I see a big difference in the philosophy of lawmaking in the US vs Germany. Take driving, for instance. In the US, almost anyone who can physically climb behind the driver's seat of a car can get a drivers' license, and indeed having a drivers' license in the US is almost a fundamental right. Speed limits are then set, to first order, to accommodate the fact that you have marginal drivers behind the wheel. In addition, the police can - and do - selectively enforce driving laws. Ideally that power would be used to keep truly bad drivers off the roads, although the current civil unrest in America shows that that selective enforcement is, to put it mildly, abused. In Germany, the barrier to getting a drivers' license is much higher. More training, more stringent tests. But the effect of that is that drivers are (mostly) assumed to be able to adapt their driving to road conditions; as a consequence, you get unlimited legal driving speeds on part of the German road system. In good weather, traffic permitting. Of course, there are confounding facts: in my experience the average physical state of a car is much better in Germany than the US, and highways are better maintained. But still, the contrast is interesting. In the US, lifting speed limits on even straight roads through the desert would have poor outcomes.
- meowface 6y ago
  It's a pretty legit business model; just because it's illegal doesn't necessarily mean the government wants to go after them. "Focused on paying illegal ransoms" = "allows companies to recover from devastating attacks by being a middle-man for paying the extortion fee and getting the decryption keys". It's probably one of those things that the government tells people not to do, but acknowledges is inevitable in many cases. A company I worked at once had a meeting with such a firm, and it all sounded pretty reasonable to me. Obviously, one would hope the company has backups (which are stored in a place that can't itself become encrypted), but if they don't, sometimes the cost of paying the ransom is far, far lower than the cost of staying down. These middle-man firms have probably saved companies from enormous amounts of damage. Another commenter claimed these companies are often in cahoots with the ransomers, which maybe is sometimes true, but I highly doubt it in the case of the company we dealt with, or other US-based companies with physical locations that meet on-site. Of course in an ideal world no one wants to reward criminals, but just to give an extreme example, if someone kidnapped one of your children and held them hostage, you'd probably pay anything to get them back, and that's not far off from the situation some ransomware-affected companies end up in.
  - Dahoon 6y ago
    When most of them are from a little connected with the hackers to basically the same people and live off of ransoms I wouldn't use words like Pretty legit. I'm sure the exact business you have worked with is very different, in your opinion. I'm also sure everyone says that. I doubt a single of these businesses exists that isn't connected to hackers at all. How about a name if you are sure and we'll see?
    - meowface 6y ago
      What are you basing any of this on? Can you show a single example of an American company that this applies to? The onus is on you to substantiate the claim in the first place, not on me to prove innocence.
  - the8472 6y ago
    > Of course in an ideal world no one wants to reward criminals, but just to give an extreme example, if someone kidnapped one of your children and held them hostage, you'd probably pay anything to get them back, and that's not far off from the situation some ransomware-affected companies end up in. That's an appeal to emotion though while a company can do a cost-benefit analysis. Also, if you pay for your children that means you signal that the kidnapping business model is viable and thus endanger more children. If the government keeps you at gunpoint from paying for your children then yes, in the worst case a bunch of children might die, but the business model would die with them.
- dogma1138 6y ago
  Paying ransom is illegal in some jurisdictions because it’s seems to be the easy way to prevent ransoms if it works or not I don’t know. Ransom works when the target is capable and has sufficient incentive to pay out, if you make it so that you’ll face jail time as a CEO who orders a ransom to be paid out it’s quite likely might reduce acts of ransom. I know that there is grey area that is common in the energy and global construction sectors where companies might not be able to pay ransom legally essentially have a ransom insurance so when 3 of your workers get kidnapped in Djibouti you have your “insurance company” which also often facilitates negotiations, extraction and repatriation handle the case. (This is also common for other reasons, especially liability reduction if something goes wrong the company can wash their hands of the case and send the families after the “insurance provider”.) There is also the grey area of “private emergency services” which range from private medevac on standby to assault teams capable of executing asset recovery missions some even take pride of being able and willing to perform prison breaks.
brianbreslin 6y ago
I heard on NPR I think that some of these middlemen companies are actually often in cahoots with the ransomware distributors.
- superhuzza 6y ago
  I remember reading a fascinating article on the nature of the companies that deal with ransomware. I think it was this one. The TLDR is that these middleman companies allow ransomware victims to both pay the fine and save face, by acting as if they didn't pay the fine. The perpetrators prefer to deal with the middlemen as they know how to pay in crypto, and are predictable - the middleman and the hackers are closer to partners than adversaries. https://features.propublica.org/ransomware/ransomware-attack-data-recovery-firms-paying-hackers/ https://features.propublica.org/ransomware/ransomware-attack...
  - usrusr 6y ago
    Somehow you missed to mention the part where the middlemen put up a slow claiming to do it by computer forensics and cryptoanalysis, supplying deniability to those who do want to pay and fooling those who don't.
    - superhuzza 6y ago
      Yes sorry I missed that, I read the article several months ago. Pretty scummy of them.
gpm 6y ago
I'm curious, when you say terrorist, do you mean groups like Evil Corp (mentioned in the article), or do you mean groups of more "traditional" terrorists funding themselves via malware? Edit: Or were the ransomware payments at hand not even malware related, but more "traditional" ransoms?
SkyBelow 6y ago
If I handed you $110 to go buy $100 of drugs, then I'm still paying for the drugs. What judge would be willing to allow such a gotcha to actually pass? There would be a massive industry for legally paying for illegal things if that were the case. Then again, the acceptability of a gotcha seems to correlate more with the amount of money spent on lawyers than on the rationality of the gotcha, so as long as they have a large enough legal department the worse they'll have is a fine that they likely already included in the cost of the attack.
- jdkrkrkf 6y ago
  You could argue that they are paying under duress. No judge will hold that against you.
mytailorisrich 6y ago
I don't think that it is illegal to pay a ransom in general under US law. It is illegal to receive a ransom, though. As mentioned in the article, they are caveats related to terrorism and to dealing with entities on sanctions lists. Now, if Garmin obtained the decryption keys, as is alleged in the article, it is clear that they paid. Note that the 'anonymous sources' cited did not even deny payment but only used a weasel turn of phrase 'did not directly make a payment', which is quite different from 'did not pay'. My best guess, if a payment was made, is that they hired people experts in dealing with these situations who arranged everything and who will bill for 'consulting services'...
- Alex3917 6y ago
  > I don't think that it is illegal to pay a ransom in general under US law. I mean I’m pretty sure you’re not allowed to go wire money to Al Qaeda, or to conspire to evade anti money laundering controls in order to do so.
  - mytailorisrich 6y ago
    That's why I wrote 'in general' and that there were caveats related to terrorism. Money laundering is another issue. In general I think people are still free to spend their legitimate money (it's not money laundering to begin with).
tzs 6y ago
> They told me that although it's technically illegal, the U.S. government has never prosecuted anyone for paying a ransom If I was going to take a job doing something that is illegal, I think I might prefer one where the government has prosecuted people. Then I could look at those cases and see what people got off with just probation, which got light sentences, which got harsh sentences, what kind of plea deals were offered. Then I could at least have a decent chance of figuring out if the pay and benefits are worth the risk. If they haven't prosecuted anyone (and this is not a line of work that has been around for a very long time), I'd worry that they just haven't gotten around to it yet, and I could end up being the first. Being first could be very bad, because they might be pushing for a harsh sentence to discourage others or encourage people prosecuted later to take plea bargains.
- WrtCdEvrydy 6y ago
  To be honest, it's probably a third part company. Funny enough, back when ransomware was simpler and used the same encryption key, we managed to recover one place by using Memory Forensics on a fucked machine. I wonder if extracting the key, decrypting the files to not pay $100,000 in BTC would be illegal in some way.
  - Simon_says 6y ago
    Of course. In the US it violates DMCA.
    - nix23 6y ago
      Yes ransomware has copyrights too and often its closed source, so take the key out (disassemble) would be illegal ;)
    - cxr 6y ago
      This is simply not true.

bt3 6y ago

It's not clear to me from the article that Garmin did in fact get the decryption key. There's enough verbiage suggesting they didn't pay the ransom, so are we to assume they had other means? It also took Garmin quite awhile to acknowledge the ongoing situation formally (their outage page has been accurate with red lights across the board). Could it be that Garmin just started to spin up more hardware and began a migration of their last backups? (I'm so far removed from how their service operates so apologies if this sounds impractical)

vb6sp6 6y ago
> There's enough verbiage suggesting they didn't pay the ransom It says they "did not directly make a payment to the hackers". You can't just take 10mil and convert it to bitcoin. My best guess is that a 3rd party made the payment and garmin will be reimbursing
- NotSammyHagar 6y ago
  saying they did not directly make a payment makes it certain someone paid.
- usrusr 6y ago
  They might have paid one of those ransomware subcontractors who claim to solve the problem on a technical level while they actually just pass on the money they are paid after taking a cut. This could have happened both knowingly (on Garmin's side) and not.
solumos 6y ago
Migrating to backups seems possible. Garmin is pretty complex in that it produces hardware and software across a few verticals, but I don't think there's anything that makes them particularly unique in the way they'd handle backups/failover. I think it's also possible that Garmin proactively pulled the plug on their public-facing services in order to mitigate the spread of the attack. It would be _really_ bad if the attackers could make the hop from Garmin's web services to consumer devices.

_salmon 6y ago

There's nothing definitive that says they paid the ransom or obtained the decryption key from the attackers. Rumors on Twitter say that they're rebuilding services from backups and slowly getting things back online

solumos 6y ago
I can imagine it's possible that a 1-week outage + cyber risk insurance claim + rebuilding from backups could net out to less than $10M.
- nomdep 6y ago
  It doesn't matter. Unless a live is at risk, you never ever pay ransoms, or others will try again.
  - keitmo 6y ago
    The outage took out at least some of their aviation services. If they are unable to update routes and IFR approach procedures then lives could indeed be at risk.
    - aaronmdjones 6y ago
      Not quite. The onus is on the pilots to never fly with out-of-date navigation information (it's actually illegal), so if they can't get that from Garmin, they'd just have to get it from somewhere else instead. Garmin's data services being unavailable isn't endangering anyone.
      - Scoundreller 6y ago
        Yep, Plenty of planes flying out there without any electronic maps. The attack happened about a week after the FAA’s last update went into force. And I believe they’re distributed a week before that. So the only groundings would’ve been those that have been parked for a while (I guess. I don’t know how they do updates). https://www.faa.gov/air_traffic/flight_info/aeronav/aero_data/NASR_Subscription/ https://www.faa.gov/air_traffic/flight_info/aeronav/aero_dat... —armchair aviator

hangonhn 6y ago

I wonder if going after such a well known target was a mistake since once the news leaked out it put Garmin in a position where it would be much harder for them to pay the ransom. I wonder if their chances of success are higher by going after a larger number of lesser known and less valuable targets who may not garner the attention nor have the IT staff to deal with the issue.

interestica 6y ago
But then you're not going to get as high of a payout? Maybe this math works, or maybe it's a feeler to figure out where the line is.
- loa_in_ 6y ago
  Maybe the smaller targets were already tried but didn't make the news
sukilot 6y ago
They go after everyone.

NotSammyHagar 6y ago

I'm quite surprised that people seem kind of ok with the idea of ransomware. It's a horrible, criminal corrupt practice and it's destructive to pay or participate in anything to do with this.

bitxbitxbitcoin 6y ago
I think the kind of ok feel is from the "they should have had backups, that'll teach 'em" crowd.

SimonPStevens 6y ago

This title is overly misleading. There is no evidence presented in the article to even suggest they paid the ransom. And Garmin declined to comment. It's possible they paid, but it's also possible they are just restoring backups.

NotSammyHagar 6y ago
I'm certain they paid, that's why they are making ambiguous statements. I hope they prosecute them for this payment. An indirect payment is still a criminal action in my opinion. If the mafia said they'd burn their building down or kill their ceo or whatever, and they paid them off through some abstract indirect transaction it would still be wrong. This should make them a direct target now, they will pay you off. Among many many reasons allowing payments like this will just encourage these criminals to keep doing this bullshit.
- sukilot 6y ago
  I don't want to live in a country where the government prosecutes victims of crimes instead doing its primary duty of national defense against foreign attackers.
  - NotSammyHagar 6y ago
    That sounds great in theory, don't prosecute victims of crimes. The govt. must go after these people, regardless of victimization. Yet if the victim encourages more dangerous actions and the 'victim' was a billion dollar corporation they can afford it. It shouldn't be legal to pay off mafia threats, and that's what this basically is. Who is the victim in prostitution (where no one was trafficed), how about if I buy pot, who is the victim where it's illegal? That theoretical vision of how you want society to work is not matched by the reality of the US.
beloch 6y ago
If they didn't pay off the hackers and are recovering on their own, it would be in Garmin's best interests to issue a public statement explicitly saying so. Failing to do so may make them a target for other hacker groups. Their vulnerability is now proven and their willingness to pay strongly suggested.

rodgerd 6y ago

I am a lot more interested in the answers to questions like: 1. Why was there lateral spread across low-criticality devices fitness devices and avionics devices? 2. Why was there lateral spread across manufacturing, customer support, and PII regions? 3. What assurances are there that health information wasn't leaked? 4. What's the general security position around avionics, marine, and health data at Garmin?

Spooky23 6y ago
Segmentation is expensive and slows stuff down. Businesses are bad at segmenting risk. I'd expect the avionics and marine stuff to be a little better due to compliance requirements.
- dylan604 6y ago
  I don't know. It seems like whenever a company needs to have data shared, it by default is siloed. Yet when a company needs siloed/segmented verticals, they are shared with no boundaries. You rarely hear about companies that have done it correctly, yet everyone has worked for a company that does it badly.
drtillberg 6y ago
You want to know if Garmin pushed malware/ransomware via its app onto 1 million smartphones? The apps seem to have been last updated July 21, and Garmin's systems were locked July 23, so.... ?

ideals 6y ago

A few people have commented on the logistics of paying a large Bitcoin ransom which can entail hiring a 3rd party to pay it. Could an independent party buy the decryption keys from the ransomware party for their asking price then attempt to resell this to Garmin (or other party) for more money? Of course it's a bit game theory because you're depending on the target to pay and the ransomware attacker to not relinquish and resell the key to anyone else including the target. Ignore the legality of it all else it's not very interesting to think about.

usrusr 6y ago
More likely scenario: the attackers demand 10 mil knowing that 10 would be an unlikely best case scenario and a more likely outcome would be something like 2 mil, passed on on exchange for the keys by a cooperating fake computer forensics firm that claims to be able to restore the data without paying the attackers. For only 3 mil, an absolute bargain. The victim would pay the 3 mil, either falling for the show or claiming to be falling for the show.

exabrial 6y ago

I should be able to see all of my locally recorded stuff without the cloud. I was happy that basic functions of my Garmin Venu continued to work. But some stuff should be cached, or stuff that hasn't been sync'd should be available locally.

zwaps 6y ago
I want to say that previous versions of Garmin connect did have the data locally, such that you could see your runs or activities without being connected to the Garmin services. The present version of Garmin connect does nothing if you are not connected to Garmin servers. E.g. you can't see your activities, your data or anything else. When this change occurred, I remember that it annoyed me greatly. Why not have some local data cached on your phone? Other apps seem to manage that no problem. If you'd have no internet access, you could at least still use the app to see your activities and sync them later. This seems so obvious to me that I have trouble understanding why they chose the current route. Of course, it's still not a total disaster. Garmin devices still work and track, you can still view the data on them, and they usually plug in as a USB drive anywhere so you can upload the data manually. Still, for smartwatch users, this could have been a really minor inconvenience rather than what it is now.

jrockway 6y ago

Has there been any discussion about the technical details of the attack? I am having a hard time imagining how a compromise of a workstation could result in the entire company -- their own apps, their call center -- going down for days. I can see how malware could break production severely ("kubectl delete deployments" from a trusted workstation). I can see how malware can wipe out your desktop. I can see how malware could f your cloud infrastructure account. But I'm not drawing the line to "we can't build a new release and deploy it on another provider" or "we can't buy an emergency Dialpad account to start taking calls from customers". My guess is this: two separate attacks occurred. The first attack involved compromising production, and installed a scheduled job that, at a certain time, would delete all database backups and code repositories, deschedule all workloads, delete all DNS records, etc. The next attack involves the fact that all source code is on managed workstations, so they compromised the IT management system to push malware to every machine globally at the exact same time that would destroy all git repositories (etc.) on the workstations. The result was that when the scheduled time occurred, production would crash and there would be no backups. (They must have wiped all the tapes at their offsite backup facility, too. I guess anything can be done for a price!) To me, this sounds too complicated to even be feasible. I am still impressed when I edit some manifest with a new version number that 90% of the time that code eventually starts running. Being able to orchestrate a multiday outage just seems amazing to me, and that you'd make a lot more money being a cloud provider than a cybercriminal. The other thought I had was that maybe they just kept thinking "we're so close to getting it back" for three days, rather than saying "everything is lost, revert to backups".

james412 6y ago
> I am having a hard time imagining how a compromise of a workstation could result in the entire company -- their own apps, their call center -- going down for days Can't guess at specifics, but if it's a Windows network, I would be utterly unsurprised if all users had excess permissions to shared drives Many Windows networks just have a giant X: everyone can write to, and it's been like that forever, and it's so deeply baked into everyone's workflow that it never gets fixed
- 6y ago

interestica 6y ago

> Smartwatch maker Garmin has obtained the decryption key to recover its computer files from a ransomware attack last Thursday, Sky News has learned. Is this really the aspect of their business that they're most known for now? I still think of them as a GPS/Geolocation device company.

thelean12 6y ago
GPS smart watches are probably their most successful consumer product currently. If you glance at their website you might think that's all that they do.
usrusr 6y ago
It's their absolute boom segment right now, dwarfing the revenue of all others. Somehow the Apple watch made a lot of people who'd rather wear a Garmin suddenly think that it's perfectly fine to wear an absurdly expensive GPS watch. Garmin has succeeded in establishing a price range where the Apple offering would barely make the upper third.
- aeyes 6y ago
  They and many competitors offer models in every price range, starting at 50$. Of course they will also offer very high end devices with features you won't find on an Apple watch. I'm pretty sure the 200$ model has features that Apple doesn't have. One is primarily a lifestyle product and the other is primarily focused towards athletes. Both brands overlap with some products but I wouldn't say they found a way to really get their foot into others' market.
- glenngillen 6y ago
  I feel seen by this comment! TBF, I already had a Garmin GPS watch that I bought circa 2006 (one of their first I believe) for tracking my runs. When it came time to upgrade I compared it to the Apple watch. And you're right. I definitely decided I'd much rather spend that much money on something with a 12yr upgrade cycle vs the 2-4 year cycle on many of my Apple devices. What I've found most surprising is I have young children, and having a Garmin activity tracker watch (seems to be not much more than a step counter) has become the thing every 6yo is expected to have these days. We've avoided it so far, but from speaking to parents with children at neighboring schools they're nearly ubiquitous in the youngest year levels now.

truthwhisperer 6y ago

that probably points them to the right direction. However, would be scared to trust Garmin with any medical or medical related data. This happening is a big no-go

verytrivial 6y ago

For the vast majority of users Garmin have ZERO liability re data retention. They could just say WHOOPS! and zero all accounts and require everyone to resync. And I would have respected them for that as they've now sent $10M to these assailants to increase the sophistication of their attacks and retain/lure/entrap more skilled developers. But then I'm a bit of a moral absolutist. If their financial records were all toast too I wonder what the fines would have been ...

cafebabbe 6y ago
brand reputation is a heck of a liability
kochthesecond 6y ago
Yeah, Id also accept all my data zeroed instead of financing hackers. It still puzzles me greatly how this ransomware has such a huge impact. How Does it allow hacking and encrypting the db servers?

concerto 6y ago

I was confused by the use of "sanctioned" in the byline. They meant it mean "had sanctions imposed", but I understood it as "given permission" which set the article in a completely different tone. What an odd word.

bobbylarrybobby 6y ago
More fun examples here: https://en.wikipedia.org/wiki/Auto-antonym?wprov=sfti1 https://en.wikipedia.org/wiki/Auto-antonym?wprov=sfti1
theli0nheart 6y ago
I had the same reaction. "Sanctioned by" would be the correct usage here.

JohnTClark 6y ago

Does US or other western country ever retaliate? It seams to me that Russia and China keep attacking as and we do nothing. Was vkontakte ever taken down? What would happen if an US hacker group "independent" of NSA would attack a Russian company?