On Thursday, July 23, Garmin started sending out a notice to its users, stating that the company was experiencing an outage. While occasional outages are fairly common in the tech space, what was happening at Garmin was hardly everyday business. ZDNet promptly reported that the company has been hit by a rather extensive ransomware attack, one which appeared to take down the companys websites, apps, internal communications, customer support services, and critically, Garmin hardware, software and databases that are used actively for aerospace and even maritime navigation. Earlier yesterday, Garmin partially confirmed the same via a global media statement.
While Garmin has seemingly played down the severity of the hack, the cyber attack is actually of massive, massive consequence. The ransomware-led outage at Garmin came on the same day as CISA-NSAs joint advisory on serious cyber attacks threatening some of the most critical, industrial IoT deployments. Almost as a show of their might and abilities, a part of Garmins affected services included their aerospace and even maritime navigation technologies. In essence, the attack could actually have been exponentially more impactful particularly if commercial aerospace was operating as per its pre-Covid-19 usual.
It also sheds light on how ransomware and related cyber crime techniques have advanced significantly, and also, how the data-led world poses a great amount of risk all summing up to suggest that Garmin was a very meticulously chosen prey, one that may have been a precursor to an impending wave of cyber attacks.
The ransomware that toyed with Garmins systems is alleged to be WastedLocker the nomenclature assigned to the malware by UK-based security firm, NCC Group. As Stefano Antenucci, cyber threat analyst at Fox-IT, a division of NCC, says, WastedLocker was discovered by cyber security professionals as recently as May this year, and is masterminded by Maksim Viktorovich Yakubets the alleged leader of notorious cyber criminal group, Evil Corp. Unlike general ransomware attacks, WastedLocker deploys a far deeper technique that capitalises on cyber security lapses to ensure that the ransom encryption takes longer, and at times also becomes impossible, for companies to fight against.
Garmin has not officially used the term ransomware as part of its statement, but its wording fairly indicates so. The company stated yesterday that it was the victim of a cyber attack that encrypted some of its systems on July 23. Perhaps more important, on this note, is this passage: We have no indication that any customer data, including payment information from Garmin Pay, was accessed, lost or stolen. Additionally, the functionality of Garmin products was not affected, other than the ability to access online services. Affected systems are being restored and we expect to return to normal operation over the next few days. We do not expect any material impact to our operations or financial results because of this outage. In other words all of the classic indicators of a ransomware attack.
A Garmin India spokesperson declined News18s request for an interaction on the topic.
So, why is this attack on Garmin so significant? The answer lies in Yakubets activities, Evil Corps activities of late, and how WastedLocker works.
One example of just how widespread and impactful WastedLocker can be is given by Symantecs spokesperson for its Critical Attack Discovery and Intelligence Team. According to the team, Evil Corp recently targeted a series of cyber attacks that infected the websites of a number of USA-based publications with malware. This malware then injected a further malware payload into selected visitors of the websites, which then enabled them to install WastedLocker on strategic systems. Symantec has claimed that Evil Corps series of cyber attacks have hit at least 31 organisations already, with eight of them being Fortune 500 companies. There has so far been no disclosure on which companies may have been compromised.
NCC-Fox-ITs Antenucci further states that Evil Corps modus operandi also involves affecting the backup infrastructure of companies. This increases the time for recovery for the victim, or in some cases due to unavailability of offline or offsite backups, prevents the ability to recover at all, he says. To an extent, this would explain why it has been taking Garmin long to restore its services. Garmin Connect, the user dashboard, is seemingly coming back online for users now.
flyGarmin and Garmin Pilot, which are critical commercial aviation services that require regular database updates as per USAs Federal Aviation Administration (FAA) regulation, were down for four full days, before coming back online yesterday. At a normal time in a pandemic-free world, this could have caused significant mayhem. Thankfully, FAA database data says that the airspace database update was delivered to requisite systems a week prior to the ransomware attack, although Garmin aviation hardware still went offline. A Wired report on the matter says Garmins Active Captain app, used for maritime navigation, may have also suffered from the attack.
More than just being an isolated attack, the Garmin hack shows the severity and extent to which a sophisticated malware can impact critical industrial IoT systems. Alarmingly, on July 23, the same day of the Garmin attack, the United States Cybersecurity & Infrastructure Security Agency (CISA) and NSA issued industry-wide advisories to be extra vigilant about cyber attacks on industrial IoT deployments, in the coming weeks. The attack on Garmin, hence, could have just been the tip of the proverbial iceberg.
Garmin has further claimed that it has received no indication of its user data being compromised, which also falls in line with how Evil Corp and WastedLocker work. As Antenucci says, The group has not appeared to have engaged in extensive information stealing or threatened to publish information about victims in the way that the DoppelPaymer and many other targeted ransomware operations have. We assess that the probable reason for not leaking victim information is the unwanted attention this would draw from law enforcement and the public.
While reports remain disputed as to whether Evil Corp demanded a $10 million ransom from Garmin, and if the latter paid the same, whats more alarming to note is the extent of severe risk that many of the worlds biggest companies are at. On the scale of sophistication, WastedLocker is far more impactful than the likes of WannaCry and NotPetya, which have so far been some of the worlds largest coordinated cyber attacks. The new wave, which has apparently only just begun, looks set to transcend it all.
Here is the original post:
- WikiLeaks' Julian Assange: NSA critics got lucky because agency had no PR strategy - April 26th, 2014 [April 26th, 2014]
- National Speakers Association New Jersey Chapter NSA - April 26th, 2014 [April 26th, 2014]
- National Security Agency - Wikipedia, the free encyclopedia - April 26th, 2014 [April 26th, 2014]
- NSA - Satu Hari Di Bulan Juni (TULUS) (COVER) - Video - April 26th, 2014 [April 26th, 2014]
- Hong Kong: Protesters blow whistles for NSA whistle blower - Video - April 26th, 2014 [April 26th, 2014]
- An Inside Look at the NSA With Whistleblower William Binney (Part 2 of 2) - Video - April 26th, 2014 [April 26th, 2014]
- UK: China will offer fig leaves to US exposed by NSA leaker - Assange - Video - April 26th, 2014 [April 26th, 2014]
- NSA ~ (Autodidactism) Whistleblowing - Video - April 27th, 2014 [April 27th, 2014]
- Dropping #NSA Knowledge Like a Clumsy Librarian - Video - April 27th, 2014 [April 27th, 2014]
- Full Show: Disband The NSA or; Corruption in the Capitol FO SHIZZLE {aTV002} - Video - April 27th, 2014 [April 27th, 2014]
- NSA DOCUMENTARY SIX YEARS BEFORE SNOWDEN - Video - April 27th, 2014 [April 27th, 2014]
- ShmooCon 2014: The NSA: Capabilities and Countermeasures - Video - April 27th, 2014 [April 27th, 2014]
- NSA Knew Of Heartbleed Bug, Refused To Protect Americans - Video - April 27th, 2014 [April 27th, 2014]
- Former NSA Head To Become Columnist For Conservative Paper To Discuss Intelligence - Video - April 27th, 2014 [April 27th, 2014]
- An Inside Look at the NSA With Whistleblower William Binney (Part 1 of 2) - Video - April 27th, 2014 [April 27th, 2014]
- Keynote Address by Shri Shivshankar Menon, NSA at International Seminar on Kautilya - Video - April 27th, 2014 [April 27th, 2014]
- NSA Wiretapping: A 4th Amendment Violation?: Blake Norvell at TEDxSMU - Video - April 27th, 2014 [April 27th, 2014]
- Hang with Rand: Email Privacy, NSA Spying, and Defending Our Civil Liberties - Video - April 27th, 2014 [April 27th, 2014]
- NSA Surveillance and What To Do About It - Bruce Schneier - Video - April 27th, 2014 [April 27th, 2014]
- READER SUBMITTED: NSA CT April 2014 Meeting - April 28th, 2014 [April 28th, 2014]
- MVI 1847 Obama's NSA Denies FOIA About MH 370! - Video - April 28th, 2014 [April 28th, 2014]
- George Galloway's Sputnik: Ewen MacAskill on Guardian / Edward Snowden NSA leaks (26Apr14) - Video - April 28th, 2014 [April 28th, 2014]
- CIA & NSA DIRECTED ENERGY WEAPON ATTACK ON WHISTLE BLOWER - Video - April 28th, 2014 [April 28th, 2014]
- Book TV - 2014 San Antonio Book Festival: Panel on the NSA, Big Brother, and Democracy - Video - April 28th, 2014 [April 28th, 2014]
- NSA Throwdown: John Oliver v. 60 Minutes - April 29th, 2014 [April 29th, 2014]
- NSA will sit on security vulnerabilities because of terrorism - April 29th, 2014 [April 29th, 2014]
- New water records show NSA Utah Data Center likely behind schedule - April 29th, 2014 [April 29th, 2014]
- MVI 1871 NSA Might Be OnTo Me! - Video - April 29th, 2014 [April 29th, 2014]
- ZyXEL NSA 325 v2 Hands On - Deutsch / German notebooksbilliger.de - Video - April 29th, 2014 [April 29th, 2014]
- German opposition says US should destroy Merkel's NSA file - Video - April 29th, 2014 [April 29th, 2014]
- Germany: NSA spying "unacceptable" says SPD - Video - April 29th, 2014 [April 29th, 2014]
- NSA Surveillance 2 - Video - April 29th, 2014 [April 29th, 2014]
- NSA Surveillance Panel 1 - Video - April 29th, 2014 [April 29th, 2014]
- Chalk Talk How Snowden Breached NSA Security - Video - April 29th, 2014 [April 29th, 2014]
- NSA reveals some cyber security flaws are left secret - April 30th, 2014 [April 30th, 2014]
- NSA data center uses less water than expected - April 30th, 2014 [April 30th, 2014]
- April 2014 Breaking News Do you use Google or Yahoo? NSA Intercepts Google And Yahoo Traffic - Video - April 30th, 2014 [April 30th, 2014]
- Supreme Court could weigh in on NSA case, justice says - May 1st, 2014 [May 1st, 2014]
- New NSA chief: Agency has lost trust - May 1st, 2014 [May 1st, 2014]
- NSA on Heartbleed: 'We're not legally allowed to lie to you' - May 1st, 2014 [May 1st, 2014]
- What's The NSA Doing Now? Training More Cyberwarriors - May 1st, 2014 [May 1st, 2014]
- Anonymous NSA - Video - May 1st, 2014 [May 1st, 2014]
- Cutting off H2O to the NSA - Video - May 1st, 2014 [May 1st, 2014]
- Brazil: Greenwald slams US media, shares tips to avoid NSA - Video - May 1st, 2014 [May 1st, 2014]
- NSA IS TRYINGG 2 KILL ME FAMS - Video - May 1st, 2014 [May 1st, 2014]
- What was more popular on Twitter, NSA, NRA or NBA..today? - Video - May 1st, 2014 [May 1st, 2014]
- CIS111: NSA Uncovered - Video - May 1st, 2014 [May 1st, 2014]
- Views from the Street on NSA Activities and Liberty (6/6) - Video - May 1st, 2014 [May 1st, 2014]
- Views from the Street on NSA Activities and Liberty (4/6) - Video - May 1st, 2014 [May 1st, 2014]
- Views from the Street on NSA Activities and Liberty (3/6) - Video - May 1st, 2014 [May 1st, 2014]
- Views from the Street on NSA Activities and Liberty (2/6) - Video - May 1st, 2014 [May 1st, 2014]
- Views from the Street on NSA Activities and Liberty (1/6) - Video - May 1st, 2014 [May 1st, 2014]
- Germany: NSA may have accidentally outed secret base - Video - May 1st, 2014 [May 1st, 2014]
- ZyXEL NSA 325 v2 Installations-Wizard - Deutsch / German notebooksbilliger.de - Video - May 1st, 2014 [May 1st, 2014]
- Tech firms to increase alerts about police requests for data -- report - May 2nd, 2014 [May 2nd, 2014]
- German Chancellor Angela Merkel visits US, after the NSA eavesdropping scandal - Video - May 2nd, 2014 [May 2nd, 2014]
- NSA spies on more US citizens than Russians Snowden - May 3rd, 2014 [May 3rd, 2014]
- THE NEXT NSA?Police under scrutiny for using spying technology - May 3rd, 2014 [May 3rd, 2014]
- Ukraine and NSA will test Merkel - Video - May 3rd, 2014 [May 3rd, 2014]
- The Latest Attacks On NSA Whistleblower Edward Snowden - Kevin Gosztola Discusses - Video - May 3rd, 2014 [May 3rd, 2014]
- Still Report #246 - NSA Classifies MH370 Material - Video - May 4th, 2014 [May 4th, 2014]
- Code Talker Induction into NSA Hall of Honor - Video - May 4th, 2014 [May 4th, 2014]
- NSA ( National Security Agency ) refusal to release documents on UFO's - Video - May 4th, 2014 [May 4th, 2014]
- Obama & NSA Refuse FOIA Request on Malaysia Flight deemed classified - Video - May 4th, 2014 [May 4th, 2014]
- Kafkawinstons World`s Channel Terminated NSA is replacing Channel`s with Sockpuppet Channel`s - Video - May 4th, 2014 [May 4th, 2014]
- NSA Volunteer Justin Hall at the NSA Comedy Tour February 2014 - Video - May 4th, 2014 [May 4th, 2014]
- Barack Obama on NSA Surveillance I'd Be Concerned Too If I Wasn't in Government - Video - May 4th, 2014 [May 4th, 2014]
- GBPPR Vision #26: Overview of the NSA's TAWDRYYARD Radar Retro-Reflector - Video - May 4th, 2014 [May 4th, 2014]
- NSA proof phone Case - Video - May 5th, 2014 [May 5th, 2014]
- 2014 NSA 2014 Million Dollar Publisher's Lab - Video - May 5th, 2014 [May 5th, 2014]
- Gen. Michael Hayden - the Former Director of NSA and the CIA - Video - May 5th, 2014 [May 5th, 2014]
- REVEALED: Here's The Solution To That Encoded NSA Puzzle Tweet - May 5th, 2014 [May 5th, 2014]
- Michael Hayden's Unwitting Case Against Secret Surveillance - May 5th, 2014 [May 5th, 2014]
- NSA's Encrypted Tweet: We're Hiring Code Breakers - May 5th, 2014 [May 5th, 2014]
- Russ Tice: Life as a NSA Whistleblower - Video - May 5th, 2014 [May 5th, 2014]
- What Is Going on at NSA These Days - Video - May 5th, 2014 [May 5th, 2014]
- What is the Role of the NSA? AFF Dallas Debates - Video - May 5th, 2014 [May 5th, 2014]
- Edward Snowden said CIA , and NSA had 52. 6 Billion for black budget - Video - May 5th, 2014 [May 5th, 2014]
- NSA looks to appeal to young cryptographers through coded ads - May 6th, 2014 [May 6th, 2014]
- Code Cracked: Mysterious NSA Tweet Is Decrypted in Seconds - May 6th, 2014 [May 6th, 2014]