Garmin has started to bring its Garmin Connect software back online after a ransomware attack shelved the system since late Wednesday, July 22. The company also said that customer data hasn’t been impacted and that its cyberattack occurred July 23. 

In a statement Monday, July 27, Garmin said: “We have no indication that any customer data, including payment information from Garmin Pay, was accessed, lost or stolen.” Garmin did say that its systems were encrypted, which indicates a ransomware attack. 
As of Monday morning, Garmin said that Garmin Connect has returned with limited functionality. Simply put, Garmin has had a rough week. Here’s the timeline:
Specifically, Garmin Connect can now display activity details and uploads, register devices, show the dashboard, and produce reports and segments. The company noted on its status page:

We are happy to report that Garmin Connect recovery is underway. We’d like to thank you for your understanding and patience as we restore normal operations.  

Garmin has also starting sketching out its FAQ. Regarding customer data, Garmin said:

Garmin Ltd. was the victim of a cyber attack that encrypted some of our systems on July 23, 2020. As a result, many of our online services were interrupted including website functions, customer support, customer facing applications, and company communications. We immediately began to assess the nature of the attack and started remediation.
We have no indication that any customer data, including payment information from Garmin Pay, was accessed, lost or stolen. Additionally, the functionality of Garmin products was not affected, other than the ability to access online services. Affected systems are being restored and we expect to return to normal operation over the next few days.

Limited functionality remains for daily summaries, courses, Garmin Coach, third party sync, and Strava. On Strava, Strava Beacon integration is working, but segments, routes, and uploaded activities are being queued to sync.
Garmin also said Garmin Golf and Garmin Dive are online with LiveTrack. Vivofit Jr. is limited with delayed stats.
There are still a few unknowns about the Garmin incident and the FAQ provided doesn’t add much detail about the attack or processes to prevent another one in the future. With any luck, Garmin will have a detailed post mortem at a later date. Garmin reports earnings on Wednesday.  More

Cybersecurity researchers have detailed a ransomware campaign that clearly borrows attack techniques used by nation-state-backed hacking and cyber-espionage operations.  The campaign came to light when cyber criminals attempted to launch a ransomware attack against an unspecified product safety testing organisation. The attack was detected and stopped before it was successful, but provided cybersecurity researchers at eSentire with enough information to analyse the tactics, techniques and procedures being used.

ZDNet Recommends

The best cyber insurance

The cyber insurance industry is likely to go mainstream and is a simple cost of doing business. Here are a few options to consider.

Read More

As eSentire’s security research team began to investigate the incident, they said they “discovered some very curious findings, relating to both the threat group behind the attack, as well as the tools and techniques used in the attack”.  SEE: A winning strategy for cybersecurity (ZDNet special report) The attack methods used in attempted ransomware campaign resembled techniques previously attributed to state-backed Chinese hacking operations including APT27 – also known as Emissary Panda.  eSentire said the low quality of the ransomware and the lack of any known ransomware breaches by this ‘Hello Ransomware’, along with the attackers’ use of intrusion and reconnaissance methods that are typically associated with sophisticated groups, raises the question of whether the ransomware is the primary goal of the operators.  “Or are the cyber criminals dropping ransomware into their target victims’ IT environment to simply distract from their real motive – cyber espionage?” eSentire said.

While all of this doesn’t necessarily mean that those behind the ransomware are working out of or on behalf of China, it demonstrates how cyber criminals can mimic the tactics used by advanced government-backed hacking groups in an effort to deliver malware.  Techniques deployed in the attempted attack in July include the use of SharePoint exploits and China Chopper, a stealthy remote access tool that provides a backdoor onto compromised systems, often distributed onto web servers. While commonly used by Chinese APT groups, China Chopper web shell is widely available and is popular with a variety of attackers, both state-backed and cyber criminal.  But the use of these exploits and China Chopper aren’t the only techniques the attackers behind ransomware use alongside APT groups, such as using Mimikatz for password scraping and privilege escalation, attempts to disable security monitoring, as well as dropping PowerShell command executions via masquerading as a legitimate anti-virus provider – in this case, mimicking Kaspersky.   There are also time delays between different steps of the attack in an effort to avoid detection. These time delays also suggest a hands-on human touch when carrying out the attacks, something that’s common with APT groups.  While the methodology is the same as that used by nation-state hacking groups, it would be unusual for a state-sponsored group to directly engage in ransomware attacks. Wannacry ransomware, deployed by North Korea, is an infamous example of an attempted ransomware attack by a state, but on the whole, ransomware is the domain of cyber criminals.  There’s the possibility that those behind ransomware are performing a false flag operation, deploying tactics known to be used by a particular operation because it leads any investigation away from them. It’s also well-known that the tactics are an effective means of compromising networks – meaning they’re perfect for ransomware attacks.  Like other forms of ransomware, Hello encrypts files – in this case with a .hello extension – and demands a ransom from victims in exchange for the decryption key. The ransom note is fairly basic, using Notepad to present a ransom note telling the victim to email the attackers to negotiate a deal.   Hello ransomware is also quite basic by the standards of top ransomware in 2021 because there’s no threat to leak stolen data and no leak site for publishing stolen data on. It also isn’t run on a ransomware-as-a-service model, like many of the most prolific ransomware variants today, meaning that it stands out.  Despite all this, the hands-on nature of attacks indicates that whoever is behind Hello ransomware knows what they’re doing.  “Hello ransomware is an exception of ransomware evolution. There’s nothing particularly sophisticated about the ransomware itself, or even the initial access vector, a two-year-old SharePoint vulnerability,” Keegan Keplinger, research and reporting lead at eSentire, told ZDNet.  “It is the post-compromise actions which can really be considered sophisticated,” he added. 

Researchers even suggest the possibility that the ransomware could be laid down as a distraction while laying the foundations for something else.   SEE: Four months on from a sophisticated cyberattack, Alaska’s health department is still recovering “There is a stark difference between the sophisticated intrusion capabilities, used in conjunction with the seemingly simplistic Hello Ransomware. This, in addition to the little-publicised success of the Hello ransomware campaigns, also bring the actors’ motivations into question,” said Keplinger.  The campaign remains mysterious, but while the attack targeting the safety testing organisation was stopped before it was able to encrypt the network, others might not be so lucky.  Steps that businesses can take to help avoid falling victim to ransomware – and many other forms of cyberattacks – include applying security patches for known vulnerabilities in a timely manner and using multi-factor authentication across the network to make it more difficult for intruders to move around networks.  More

The company also has its sight set on becoming the first 100% Aboriginal-owned IT company to list on the ASX. More

Australian Information and Privacy Commissioner Angelene Falk has agreed with the Parliamentary Joint Committee on Intelligence and Security (PJCIS) that physically seeing the datasets that telecommunications providers are handing over under the country’s data retention regime would enhance her agency’s role. “We have not seen the actual disclosures. We’ve seen the documents that are required […] More

The acronym VPN stands for virtual private network. Those three words tell a lot about how a VPN works.Let’s start with network. VPNs provide network connections, meaning they move data to and from your device. Private means they make that movement private, helping prevent hackers from seeing what you’re sending. And virtual means that you’re doing it all in software. You’re not running a new set of wires. Instead, you’re creating a software-based network connection that then moves data over the physical connection (whether that’s wireless or wired). Also: NordVPN review: A market leader with consistent speed and performance What a VPN actually does is take data that you’re sending out over the Internet and encrypt it before it leaves your machine. That encrypted data is sent to the VPN provider’s servers, where it’s decrypted, and then sent on to, say, Google or Netflix. NordVPN, which is the service we’re talking about today, has more than 5,200 servers across the world. Also: Meet NordSec: The company behind NordVPN wants to be your one-stop privacy suite On the flip side, a VPN takes data from a server on the internet, encrypts it on one of Nord’s servers, sends that encrypted data to your computer, which decrypts it when it arrives. This is what provides protection against, in particular, Wi-Fi snoops at airports, hotels, and schools. By virtue of your data leaving the VPN provider’s server (which, for NordVPN, can be in your choice of 60 countries), your actual location can be hidden, and the final server sees as your location what’s actually the location of your provider’s server.

Also: Inside a VPN service: How NordVPN conducts the business of Internet privacy That’s how VPNs obfuscate your location. Although it’s sometimes illegal, many people use this capability to change their apparent region to watch blacked-out sports or region-locked TV. Far more important is that activists and those concerned about stalkers use it to hide their location for their personal security. OK, so with that introduction into how VPNs — and, specifically, NordVPN — works, let’s look at how to set up and install NordVPN. We’re going to do this on a Windows machine, but the practice is very similar for Macs, Linux, and mobile devices.

Servers: 5242Countries: 60Simultaneous connections: 6Kill switch: yesLogging: Email address and billing information onlyPrice: $11.95 per monthBest Price: $89 for two years ($3.30/mo)Trial: 30-day refund guaranteeSupported platforms: iOS, Android, MacOS, Windows, Linux, game consoles, smart TVs, more

Installing NordVPN To kick things off, point your browser at the NordVPN website. The company does run promotions from time to time, so the promotion shown here may or may not be on the site when you visit. Once you click in, you’ll need to choose your plan, create an account, and purchase the service. At this point, it’s time to dig into the dashboard to get your download. Once you log into your account, you’ll see the dashboard. Unfortunately, unlike most of the other VPN services we looked at, the most appropriate download isn’t immediately presented. You’ll need to click View Details first. There are some helpful resources shown on this next page, but what you want is the Download link. And now, finally, you can download the Windows client. Once downloaded, go ahead and hit the Open File link. And tell Windows that yes, you did want to do what you just did. And then tell Windows where to put the client program. You can choose to add a desktop icon and a start menu entry. This is a test Windows install that was setup just for this demo, so we’ll drop both the icon on the desktop and into the Start menu. Normally, on my production Windows machines, I don’t let installers put icons on the desktop (if given the option). It’s your machine, so choose as you wish. And just to quench your need to click even more, here’s one more screen before the install actually happens. Nope. I was wrong. This is the last screen you have to click before the install is done. Yes, Virginia, there really is an application at the end of all those clicks. Go ahead and log in using the same account and password you established when purchasing the service. Checking Settings OK, now that we’re finally in the client application, hit the almost hidden gear at the top of the window to get into the settings area. This first page allows you to choose whether the client is always running when you start Windows and whether the screen is minimized. If you want things to happen behind the screen, turn on minimized. If you want a reminder that NordVPN is present, let it show up on you’re your screen at normal size. Let’s move down to the Auto-connect tab. This is pretty powerful. You can decide that your computer is always routing traffic through the VPN or not. You can also turn it on if you’re using Wi-Fi instead of a hard-wired connection. You can also tell that certain Wi-Fi networks (like your home or office network) don’t need to be set up with the VPN service. That way, when you leave home and go to, say, a coffee shop, it will automatically connect via the VPN. Powerful option. The last settings pane we’re going to look at today is the Kill-Switch. This shuts down your Internet connection if the VPN link is severed. This is important because you don’t want data to suddenly go across the network unencrypted and unprotected.  Using NordVPN And, with that, let’s get started using the VPN service. The easiest thing to do is hit Quick Connect. You can also choose the country you want to connect via. I’m in the US Pacific Northwest, so it makes sense that NordVPN connected me to a reasonably close server. When done, you can punch the Disconnect button. Finally, there’s a hidden feature under the Disconnect button. You can disconnect from the VPN for a specified period of time. This is good if you have to access something over a local network, but want to make sure the VPN is turned back on after. So, there you go. That’s how to use NordVPN. Let us know what you think in the comments below. You can follow my day-to-day project updates on social media. Be sure to follow me on Twitter at @DavidGewirtz, on Facebook at Facebook.com/DavidGewirtz, on Instagram at Instagram.com/DavidGewirtz, and on YouTube at YouTube.com/DavidGewirtzTV.

ZDNet Recommends More