6 ms·

What is the "so what" here? Are these internet connected?

usrusr 3y ago
During workouts internet connection is only through bluetooth to the companion app and by this somewhat regulated, but for updates, offline music storage and the like most also have wifi. Tangent: that bluetooth uplink comes with some bewildering differences for those monkeyC apps, e.g. a request started to be consumed as json will happily talk to localhost on the companion app's host. A request started to consume a navigation itinerary will also do, except when the host isn't on the internet, then it fails to read localhost.
iudqnolq 3y ago
There is an appstore with third party apps.
depierre 3y ago
Author here. Fair question! They get access to the internet via the Garmin Connect companion app. But if you're asking to know if they can be exploited from the internet, that's not what we showed yeah. The vulnerabilities we've disclosed require a malicious app to be installed (e.g. from the CIQ app store) so let's not cry wolf. What I think this project highlights and what we should remember is the current level of security of Garmin devices. GarminOS deploys none of the security mitigations one would expect in modern devices (let's exclude crappy IoT devices flooding the market). No stack canaries, no W^X, etc. It does not implement isolation between user-supplied code and the rest of the OS either. And their C code base does not appear to receive much scrutiny in terms of security review. It would be much easier to exploit the watch (e.g. sending a malicious message to the user's phone that sends it to the watch to show the notification) than exploit the user's smartphone. And this could be performed from the internet.
- nradov 3y ago
  Indeed there have been software defects that caused Garmin watches to crash when displaying certain text messages. https://forums.garmin.com/outdoor-recreation/outdoor-recreation/f/fenix-6-series/325519/v25-10---incoming-messages-chinese-japanese-thai---unsupported-languages-cause-a-crash-restart/1589313 https://forums.garmin.com/outdoor-recreation/outdoor-recreat...
- saltcured 3y ago
  Do you have thoughts on the NFC and particularly Garmin Pay features? I wonder if these are secured differently or merely obscured behind the encrypted firmware on newer models.
  - depierre 3y ago
    It's not something I've encountered yet so I don't have any insight to share. I would be surprised if they were secured differently but I'm purely speculating here.

During workouts internet connection is only through bluetooth to the companion app and by this somewhat regulated, but for updates, offline music storage and the like most also have wifi. Tangent: that bluetooth uplink comes with some bewildering differences for those monkeyC apps, e.g. a request started to be consumed as json will happily talk to localhost on the companion app's host. A request started to consume a navigation itinerary will also do, except when the host isn't on the internet, then it fails to read localhost.

iudqnolq 3y ago

There is an appstore with third party apps.

depierre 3y ago

Author here. Fair question! They get access to the internet via the Garmin Connect companion app. But if you're asking to know if they can be exploited from the internet, that's not what we showed yeah. The vulnerabilities we've disclosed require a malicious app to be installed (e.g. from the CIQ app store) so let's not cry wolf. What I think this project highlights and what we should remember is the current level of security of Garmin devices. GarminOS deploys none of the security mitigations one would expect in modern devices (let's exclude crappy IoT devices flooding the market). No stack canaries, no W^X, etc. It does not implement isolation between user-supplied code and the rest of the OS either. And their C code base does not appear to receive much scrutiny in terms of security review. It would be much easier to exploit the watch (e.g. sending a malicious message to the user's phone that sends it to the watch to show the notification) than exploit the user's smartphone. And this could be performed from the internet.

nradov 3y ago
Indeed there have been software defects that caused Garmin watches to crash when displaying certain text messages. https://forums.garmin.com/outdoor-recreation/outdoor-recreation/f/fenix-6-series/325519/v25-10---incoming-messages-chinese-japanese-thai---unsupported-languages-cause-a-crash-restart/1589313 https://forums.garmin.com/outdoor-recreation/outdoor-recreat...
saltcured 3y ago
Do you have thoughts on the NFC and particularly Garmin Pay features? I wonder if these are secured differently or merely obscured behind the encrypted firmware on newer models.
- depierre 3y ago
  It's not something I've encountered yet so I don't have any insight to share. I would be surprised if they were secured differently but I'm purely speculating here.