Garmin Ransomware attack?

[Unpiste]

I've been trying to figure out the security impacts to end users. I should probably change my passwords for fun... I think my Garmin credentials can get people access to various newspapers, the Atlantic, a couple of libraries, and meal kit subscriptions? Lol

It's always a good idea to change any shared passwords.

Hopefully, if Garmin is doing everything right (and the password isn't guessable), no one will be able to figure out your password. Unfortunately we already know Garmin did at least one thing wrong.

 

[scott43]

Who were the dumb-asses that had stored passwords in plain text and didn't notice for like 5 years?

 

[RobSN]

Who were the dumb-asses that had stored passwords in plain text and didn't notice for like 5 years?

Dead right on that. My Garmin Connect password is one that I do use across sites that don't have financial data associated with them, but poo, poo, and thrice poo - now I have to go through all those sites changing the passwords. Bloody nuisance. My bigger worry is whether there are other sites that have damn fool recover your password questions that hackers might guess using information on Garmin Connect ...

 

[scott43]

Oh it was Facebook..man..

Facebook Stored Hundreds of Millions of User Passwords in Plain Text for Years – Krebs on Security

krebsonsecurity.com

 

[Jilly]

I only have a GPS under Garmin. It's out too.

 

[tball]

Yup, just the email address. All the passwords are different. I'm taking small comfort in that.

Any idea of how they got into your Skype account if the passwords were different? Brute force?

Related, has there been confirmation Garmin stored user password in plain text or were easily decrypted?

I just confirmed my Garmin password is a strong computer-generated password. This is a great example of why it's crucial to use a password manager.

You can still upload files to Strava or Training Peaks manually.

DC Rainmaker has a nice post outlining how to upload workouts manually:

How To Upload Your Garmin Workout During the Outage

For the last 18 or so hours, Garmin.com has been unavailable. And, if we know anything about endurance sports – it's that if a workout isn’t uploaded to Strava, it definitely didn’t happen. So, I’m here to help you get

www.dcrainmaker.com

I'm afraid the longer this goes on, the longer it will go on.

 

[Unpiste]

Dead right on that. My Garmin Connect password is one that I do use across sites that don't have financial data associated with them, but poo, poo, and thrice poo - now I have to go through all those sites changing the passwords. Bloody nuisance. My bigger worry is whether there are other sites that have damn fool recover your password questions that hackers might guess using information on Garmin Connect ...

This is why I hate security questions. (Especially United, which literally has about a dozen questions with a dozen or so preselected answers available for each.) Whenever possible, I just turn security questions into additional passwords by making the "answer" something nonsensical and completely unrelated to the question. (Even my United questions and answers are randomly selected.)

Unfortunately this requires near absolute trust in whatever method you use to keep track of passwords.

Related, has there been confirmation Garmin stored user password in plain text or were easily decrypted?

I don't think so. Though I think the more likely scenario, if any, would be that they were using a weak hash.

 

[Pequenita]

I can't even truthfully answer half the security questions usually because they're so culturally skewed.

 

[tball]

Connect is back up for me. Good for them. Hope they didn't pay the ransom.

 

[KevinF]

Connect is back up for me. Good for them. Hope they didn't pay the ransom.

Really? It's still down here.

 

[François Pugh]

Connect is back up for me. Good for them. Hope they didn't pay the ransom.

Doesn't affect me. I still hope they paid the hitman, on principle.

 

[cantunamunch]

Really? It's still down here.

Yup, just a different notice, with no language about help lines and call servers being down.

 

[Ron]

Garmin attacked by WastedLocker ransomware in demand for $10 million

GPS technology giant claims no user data has been impacted

www.cyclingnews.com

very interesting story. Anyone who tried to upload their Garmin over the past few days knows this. As of today, Monday, July 27th, the site is back up but I can't find any info on how this was resolved.

 

[cantunamunch]

Yeh, there's been a chat about it over here.

Garmin Ransomware attack?

I've been trying to figure out the security impacts to end users. :huh: I should probably change my passwords for fun... I think my Garmin credentials can get people access to various newspapers, the Atlantic, a couple of libraries, and meal kit subscriptions? Lol It's always a good idea to...

www.pugski.com

Also, I suspect you all in Colorado are on different servers. Witness:

 

[Ron]

Yup, just the email address. All the passwords are different. I'm taking small comfort in that.

Just changed my password. In CO the servers are back up.

The joy of MAC, generates secure passwords and then stores them for use across all devices.

@Unpiste I started doing the same thing a few years back. my mothers maiden name, first car I owned and dogs name are totally disconnected from any semblance to the question.

 

[Wasatchman]

http://I can't find any info on how this was resolved.

I doubt Garmin is going to announce we are up and running after paying the $10 million [/url]

 

[Ron]

sicne they are public, they will have to divulge at least the important details.

 

[crgildart]

@Unpiste I started doing the same thing a few years back. my mothers maiden name, first car I owned and dogs name are totally disconnected from any semblance to the question.

But using the same nonsense answer across different accounts/places is also not good. Need different answers to the same questions to prevent a hacker from using one to access the others..

 

[Unpiste]

But using the same nonsense answer across different accounts/places is also not good. Need different answers to the same questions to prevent a hacker from using one to access the others..

Unfortunately more so even than with passwords, since security question answers can usually be read, unlike passwords. (Phone support is usually able to see the answer when they ask you one of your security questions.)

 

[Ron]

for sure, We have all of our credit monitoring sources, Transequity, Equifax and TransUnion locked.