The IT Nerd

If you have a Garmin product and you rely on any of Garmin’s online services, well things don’t look good as it appears that Garmin is suffering a major outage tied to all of their online services:

From what I can tell, things went down just after 1PM EST. And there’s nothing posted from the company on their Twitter account. So your guess is as good as mine as to what’s going on, and when things might come back online. So I’ll be keeping an eye on this as I might be personally affected by this as I have a Garmin bike computer and I planned on going on a ride later today. And I want to upload that ride to places like Apple Health and Strava.

More on this as it comes.

UPDATE: Things appear to be back online.

There’s a saying that endurance athletes have that relates to their use of the fitness app named Strava. If it’s not on Strava, it never happened. And many of those athletes upload their runs, rides, swims, hikes or whatever they do via Garmin Connect if they have a Garmin wearable or cycling computer.

Well, they’re not doing that today as some of Garmin’s online services are down based on Down Detector:

The Garmin Connect App:

And Garmin’s status page:

Unlike the last time that they had an outage, not everything is down. But the question has to be asked if they were pwned again. Garmin has said very little about this outage other than this:

Given the fact that they were not only pwned, and that they paid the ransom to get back online the last time that they were hacked, Garmin needs to be a whole lot more up front about what’s going on and when it will be resolved. Otherwise people will not only not trust Garmin, but make their purchasing decisions based on that trust. Or rather lack of trust.

Over to you Garmin.

UPDATE: According to Garmin’s status page, this has been fixed:

Last week I posted a story with Sky News claiming that Garmin had paid the people behind their ransomware attack. The people behind this are likely Evil Corp for the record as the ransomware that was used was reportedly “wasted locker”. In that story I said this:

The thing is, Sky News offers up no proof whatsoever. At least when the news that Garmin had been pwned by ransomware first appeared, there was proof from a variety of sources to back this up. But that’s not the case here. 

Well, Sky News is back, and they back up their claims this time:

According to people with knowledge of the matter, speaking to Sky News on the condition of anonymity, Garmin had initially sought to pay the ransom using another firm which specialises in responding to these incidents.

However, this firm responded that it didn’t negotiate ransom payments in WastedLocker cases due to the risk of running foul of the sanctions.

The sources said after being initially rebuked, Garmin then sought the services of Arete IR, a firm which claims that the links between the WastedLocker ransomware and sanctioned individuals have not been proven.

And:

Separate sources confirmed to Sky News that Arete IR made the payment as part of its ransomware negotiation services, although Arete argues that WastedLocker is not conclusively the work of Evil Corp.

Neither Garmin nor Arete IR disputed that the payment was made when offered the opportunity to do so.

Arete IR is a company that does the following:

Arete Advisors has assembled an elite global team of incident response experts to create unparalleled capability to assist clients in preparing for and defending themselves against a cyber-attack, from incident response readiness assessments to post-incident remediation and ongoing hunt services. Our core skills include triage, digital forensics, malware reverse engineering, remediation, managed detection response, hunt and testifying expertise. Arete works with organization of all size to provide highly customized advice specific to your industry. Arete’s advisory services provide legally defensible, compliant cyber strategies that assist the C-Suite and Boards of Directors to continuously improve the organizations’ cyber posture, by aligning cyber risk management strategy with corporate risk.

But more interestingly, they also do this:

While some companies require insureds to get funds up front, costing precious hours and days to the clients in crises. Arete, has created a simple, easy way for Breach Coaches and Insureds to immediately respond by facilitating the entire technical and financial process of purchasing the Bitcoin, while managing the negotiation with the bad actor for a flat fee, to be paid in 30 days. Allowing clients to focus on restoring their business to health

Thus it’s safe to conclude that Garmin paid the gang behind the ransomware. And the fact that neither Garmin nor Arete IR deny that they paid underscores that. So Evil Corp or whomever was behind this won. I get that the need for Garmin to get back up and running, but I am a firm believer that you should never pay the ransom as it only encourages these scumbags. So it is unfortunate that the bad guys have effectively won.

Now I have spent a lot of time talking about the Garmin ransomware attack that has pretty much crippled Garmin and pretty much infuriated users of of their products. And I’ve mentioned that the word on the street is that the people behind this want $10 million in ransom. But now that Garmin’s services appear to be coming back on line, it’s time to talk about who the people are behind this ransomware attack?

The ransomware that is apparently being used is “WastedLocker” made by a group of hackers calling themselves “Evil Corp.” MalwareBytes has more info on both:

The ransomware name is derived from the filename it creates which includes an abbreviation of the victim’s name and the string “wasted”.

For each encrypted file, the attackers create a separate file that contains the ransomware note. The ransom note has the same name as the associated file with the addition of “_info”.

The ransom demands are steep, ranging from $500,000 to over $10 million in Bitcoin. Given that the operators make every effort to go after any backups, some organizations may feel the need to pay up. Where other ransomware operators are adding the exfiltration and even auction of stolen data to their arsenal, the Evil Corp gang has shown no inclination in that direction yet.

Historically the Evil Corp gang targets mostly US organizations and it looks like they are staying on that track with a few victims in Europe. The main players in the group are believed to be Russian.

The ransomware itself is very interesting in terms of how it operates:

The ransomware itself is custom built for each client so there is nothing to be gained by doing a full analysis. The attacks do have some commonalities though which we will discuss here.

• Deletes shadow copies, which are the default backups made by the Windows OS.
• The main executable for the ransomware is copied to the system folder and gets elevated permissions
• A service is created that runs during encryption.
• During encryption the encrypted files are renamed, and the ransom notes are created.
• A log file is created that lists the number of targeted files, the number of encrypted files, and the number of files that were not encrypted due to access rights issues.
• The service is stopped and deleted.

This is very crafty and would almost be worthy of praise were it not for the damage that it causes.

Now over to Evil Corp. Their top guy is said to be a fellow by the name of Maksim Yakubets according to the FBI. His right hand man is said to be Igor Olegovich Turashev and both are Russian nationals wanted by the FBI. And if you’re interested in why the FBI wants to get them into a jail cell, this Wired article can help you with that. They’ve been around for a while and have become increasingly more sophisticated, which makes them a threat to computer users everywhere. And if they are truly behind the Garmin ransomware attack, they’ve now got the eyeballs of a whole lot of people behind them who would love to take them down. Especially if the rumors are true that Garmin paid the ransom to get themselves out of this. Thus I would not want to be them as there’s not a whole lot of places outside of Russia that they can go without the FBI being able to nab them. Plus with this latest attack, the FBI is going to work double time to get them into a nice cosy jail cell.

A report from Sky News says that Garmin has “obtained” the decryption key to get them out of their ransomware mess:

Smartwatch maker Garmin has obtained the decryption key to recover its computer files from a ransomware attack last Thursday, Sky News has learned.

The thing is, Sky News offers up no proof whatsoever. At least when the news that Garmin had been pwned by ransomware first appeared, there was proof from a variety of sources to back this up. But that’s not the case here. And what makes this report questionable:

Security sources who spoke to Sky News said WastedLocker is believed to be developed by Evil Corp, a hacking group based in Russia which was sanctioned by the US Treasury last December

The sanctions mean that “US persons are generally prohibited from engaging in transactions” with the cyber criminals, although the US Treasury did not respond to questions about whether the general prohibition applied in the circumstances of extortion.

Sources with knowledge of the Garmin incident who spoke to Sky News on the condition of anonymity said that the company – an American multinational which is publicly listed on the NASDAQ – did not directly make a payment to the hackers.

So if Garmin did make the payment, they didn’t do so directly to try and evade the fact that paying Evil Corp would be illegal. That’s not unusual as I have heard of these third party payments to ransomware gangs happening in other situations. It all depends on how much the data is worth to the organization that got pwned.

But let’s move from rumor to fact. Garmin Connect is down again based on their status page as of 10PM Monday. Here’s a screenshot:

This has stretched the patience of Garmin users as it was partially up earlier today, which gave Garmin users some hope. But any hope is likely gone now and Garmin is now back to handling a PR disaster. If everything that happened over the weekend wasn’t going to drive Garmin customers to competitive products, I’m going to guess that this latest incident will.

It sure sucks to be Garmin right now.

UPDATE: As of 11:15 PM Garmin Connect appears to be back to being somewhat online.

Garmin has just posted a news release admitting that it was a victim of a cyberattack. Here’s the relevant part:

Garmin Ltd., today announced it was the victim of a cyber attack that encrypted some of our systems on July 23, 2020. As a result, many of our online services were interrupted including website functions, customer support, customer facing applications, and company communications. We immediately began to assess the nature of the attack and started remediation. We have no indication that any customer data, including payment information from Garmin Pay™, was accessed, lost or stolen. Additionally, the functionality of Garmin products was not affected, other than the ability to access online services.

Affected systems are being restored and we expect to return to normal operation over the next few days. We do not expect any material impact to our operations or financial results because of this outage. As our affected systems are restored, we expect some delays as the backlog of information is being processed. We are grateful for our customers’ patience and understanding during this incident and look forward to continuing to provide the exceptional customer service and support that has been our hallmark and tradition.

Well, this is better than what Garmin had been doing up until this point. Which is to not have that much communication with their customer base. In my testing with my Garmin Edge 830 cycling computer along with the Garmin Connect app I can confirm that some of the functionality is working. Specifically:

• I can see my activity history again in Garmin Connect. Though I am missing a cycling activity from Thursday that is thankfully present in Strava. Because, if it is not in Strava, it didn’t happen.
• Syncing from my Edge 830 isn’t working. None of the activities that I see in Garmin Connect isn’t syncing down to the Edge 830.
• There are still error messages in Garmin Connect saying that they are still down which isn’t a surprise as Garmin has made it clear that it will take days to fully bring things online.

The thing is that this will not likely keep people from asking questions about what happened, and more importantly what Garmin is going to do to make sure that this doesn’t happen again. I suspect that we might get those answers on Wednesday when Garmin releases their quarterly statement.

UPDATE: If you want to check the status of Garmin’s various services that are related to Garmin Connect, click here to see their status page.

This Garmin ransomware attack is a huge deal. Sure the thing that people are talking about is that athletes who use their kit can’t upload and analyze their runs, rides, or anything else that they might have done for the last several days. But it’s much worse than that on multiple fronts. Let’s start with the fact that Garmin does more than just fitness gear. They do car SatNav systems, marine SatNav systems, and aviation SatNav systems. The latter has now become an issue based on this Reddit post:

As of right now the FAA has just grounded our small fleet of aircraft (won’t say which company) as we rely on Garmin aviation database on our navigational systems. We need to run an up-to-date version of this database (it’s a FAA requirement) and can’t comply. from r/Garmin

That’s not good. If aircraft get grounded, and aircraft fleet owners can’t make money, lawyers get called. And Garmin’s nightmare will go from bad to worse when those lawyers start to call Garmin HQ.

And there’s the fact that it appears that their top end smart watches that are preferred by runners seem to have developed issues since this outage has started:

Garmin’s smartwatch woes continue as GPS and run tracking for distance wasn’t available and devices such as the Fenix line were caught in a “saving” loop that required a reset. The same problem affects indoor activities even without GPS connections. 

At the moment, it’s unclear whether the GPS signal issues with the Garmin devices are related to the company’s ransomware attackand bungled handling of it, but your Sunday morning run won’t be quantified.

Bad as that those two things are, it’s actually worse than that.

Let’s say whomever launched this attack was in Garmin’s network for weeks, months, or years. They could have stolen all sorts of data from Garmin’s network. Be it intellectual property, like the designs for new products. Or your personal data. Such as your name, address, your email address, the name or names of your emergency contact info and their personal info. Not to mention all the location data from whatever activities you do. The personal info could be used to launch targeted phishing attacks that would be very convincing. The latter could be interesting for someone who wanted to learn more about you so that they could exploit you in some way.

Oh, it actually gets worse than that.

People have been saying why haven’t Garmin gotten things online yet. Those people would include me:

Then they put out a FAQ on Saturday that you can find here. My thoughts on that were as follows:

Now Garmin’s response to this from a PR perspective has been in a word, shambolic. They have done a horrible job of reassuring users and giving said users an incentive to stick with the brand and not defect to a competitor. But here’s the reality that even I need to remember. They likely could not share a whole lot with Garmin users in terms of detail. Possibly because they don’t know how bad this is. Possibly because law enforcement is involved and they told Garmin to keep quiet. Or possibly because lawyers are involved and they told Garmin to keep quiet. But let’s say that they don’t know how bad this is. That would mean that Garmin was and still is auditing the hell out of their systems to figure out if they can carve out and isolate the sections that have been affected by the ransomware, and checking over everything else to make sure that nothing is lying in wait to encrypt everything in sight. On top of that, they would need to audit their backups and make sure that they don’t have anything lying in wait by doing a test backup and looking for anything bad. That’s important because as I said earlier, if the bad actors were in the Garmin network for weeks, months, or years, those backups would be worthless. Which means that this outage will drag on for a very long time. As in weeks or perhaps longer. Unless of course Garmin pays the $10 million that the bad actors behind this want. Which they likely won’t. Or at least they shouldn’t.

At least Garmin is looking for a Cyber Security Engineer to make sure that this doesn’t happen again. Though that’s cold comfort to Garmin users at the moment.

One final point, if you read their FAQ which you can find here, it says this among other things:

Was my data impacted as a result of the outage?

Garmin has no indication that this outage has affected your data, including activity, payment or other personal information.

Having “no indication” that users data was affected is not a definitive statement. That seems to indicate to me that Garmin must think that user data might have been affected in some way. That’s not good if you’re a Garmin user. And it may be enough to send you to a competitive product.

So this is a very bad situation for Garmin and for their customers. But as I type this, Garmin appears to be starting to get their Garmin Connect infrastructure online. So there may be light at the end of the tunnel for those who use Garmin products. But still, there’s a lot of questions that will need to be answered about this incident. And since Garmin is scheduled to report their quarterly results on Wednesday, and that reporting is usually accompanied with a Q&A session with key executives, I for one will be interested in what they have to say about this incident.

Garmin has had an outage for the last few days that has taken down its call centers and more importantly has taken down the Garmin Connect service that allows their athletes to sync and analyze their efforts. Reportedly the cause of this outage is a ransomware attack. Specifically the “WastedLocker” ransomware. While Garmin has unsurprisingly not confirmed this, many people who are in a position to know have. And those same sources have told Forbes that the price to end this nightmare is $10 million:

The ransom note tells the recipient to email one of two email addresses to “get a price for your data”. That price, Garmin’s sources have told BleepingComputer, is $10 million.

Now I am not an advocate of paying ransoms as the best way to protect yourself is to back up regularly and use those backups to rescue you from a situation like this. But it’s more complicated for Garmin. If they don’t pay the ransom, they will end up facing more and more anger from their user base made up of athletes, drivers, and pilots. The latter could be serious as pilots need to download maps to allow them to fly safely. And they can’t at the moment. But it’s all bad for Garmin the longer this goes on.

Conversely, if they do pay the ransom…. Well….. That’s complicated because of who’s behind this ransomware attack. Here’s what Bleeping Computer had to say:

Evil Corp (aka the Dridex gang) is a Russian-based cybercriminal group active since at least 2007 known to be the ones behind Dridex malware and for using ransomware as part of their attacks including Locky ransomware and their own ransomware strain known as BitPaymer.

The U.S. Treasury Department sanctioned evil Corp gang in December 2019 after being charged for using Dridex to cause more than $100 million in financial damages.

Due to this, it is a tricky situation for Garmin if they want to pay the ransom as they would potentially be violating United States sanctions.

So you have to wonder what Garmin is going to do as the clock is ticking, the money they are losing is growing, and the anger from their user base is growing. That’s not a great place to be if you’re Garmin.