Busting GPS Exercise Data Out Of Its Garmin-controlled IoT Prison

If you take to the outdoors for your exercise, rather than walking the Sisyphusian stair machine, it’s nice to grab some GPS-packed electronics to quantify your workout. [Bunnie Huang] enjoys paddling the outrigger canoe through the Singapore Strait and recently figured out how to unpack and visualize GPS data from his own Garmin watch.

By now you’ve likely heard that Garmin’s systems were down due to a ransomware attack last Thursday, July 23rd. On the one hand, it’s a minor inconvenience to not be able to see your workout visualized because of the system outage. On the other hand, the services have a lot of your personal data: dates, locations, and biometrics like heart rate. [Bunnie] looked around to see if he could unpack the data stored on his Garmin watch without pledging his privacy to computers in the sky.

Obviously this isn’t [Bunnie’s] first rodeo, but in the end you don’t need to be a 1337 haxor to pull this one off. An Open Source program called GPSBabel lets you convert proprietary data formats from a hundred or so different GPS receivers into .GPX files that are then easy to work with. From there he whipped up less than 200 lines of Python to plot the GPS data on a map and display it as a webpage. The key libraries at work here are Folium which provides the pretty browsable map data, and Matplotlib to plot the data.

These IoT devices are by all accounts amazing, listening for satellite pings to show us how far and how fast we’ve gone on web-based interfaces that are sharable, searchable, and any number of other good things ending in “able”. But the flip side is that you may not be the only person seeing the data. Two years ago Strava exposed military locations because of an opt-out policy for public data sharing of exercise trackers. Now Garmin says they don’t have any indications that data was stolen in the ransomware attack, but it’s not a stretch to think there was a potential there for such a data breach. It’s nice to see there are Open Source options for those who want access to exercise analytics and visualizations without being required to first hand over the data.

21 thoughts on “Busting GPS Exercise Data Out Of Its Garmin-controlled IoT Prison

  1. I hate to sound like one of those “not a hack” guys, also as an avid Garmin user myself I am glad to see an article on it, but am I missing something here? Garmin watches use the .FIT file format, which has a completely open specification, and the files are easily accessible through USB as a mass storage or MTP device.
    So the entire point of this article is “Garmin watch owner uses freely available tool to convert file from one format to another”

      1. There are multiple tools to convert FIT files to other formats, visualise files with GPS data (including FIT) and other resource providers, such as Strava, that will sync automatically with Garmin and provide extra functionality – and free options for all of that. Really not seeing this whole “trapped in a data prison” thing at all, e.g. have a look at GPSvisualiser.com for much of what’s discussed here.

  2. Does anyone have any good tips on software mapping I could use to show multiple GPS tracks developing with incrementing time steps? So that I can see the relative positions at a particular point in time? This would be with data downloaded after the event – it doesn’t need to be real-time updated whatsoever.

    1. John7 was that a suggestion for my query? I knew that you could load tracks into Google Earth but I don’t know if it can step through time and only reveal track points that have been created before the selected time stamp. If you know what feature within Google Earth does this, please could you give me a useful search term to find that feature?

        1. Ah, thanks – seems like this feature was there in 2010! All the recent examples I could see were “tours” and I don’t want a first person view of one track – I want a bird’s eye view of all the tracks!

          1. Yes, when I wrote only your query was shown.
            You may want to check Google maps as well, they have some fancy APIs that allow to plot dots, squares, etc onto a map using geographic coordinates (I think it uses Javascript).

  3. I recently changed bonus miles for a small Garmin watch with heartbeat and acceleration sensor. After a lot of manual reading, interpretation, tries and finally a phone call to the hotline, it turned out that you can not even put it in a usable state as clock in setting the right time without first registering an account with Garmin and connecting the watch with their cloud. Turnde out this is true for all of their current products. Finally I went all steps, used it for a week, actually liked the features except for The Big Antifeature.

    I then set it on the shelve, did not use it a single time. My privacy is worth more than a too smarty and chatty health watch. Turns out I was perfectly right.

  4. Neat! I haven’t coded anything with OpenStreatMaps or say Google Maps, though wondering about the most streamlined easiest method to input data into to share. Have to read into OpenStreatMaps as haven’t seen that until now. Looks like this is a way.

    I’m waiting for a custom receiver made from a GPS module and what would be awesome would be hacking to use just the RF Block and not having to translate through the Digital Block.

  5. When I was reading Bunnie’s post the other day I went and made my periodic check on how things were going with gadgetbride https://gadgetbridge.org/ and their ability to do fully cloudless on various devices. It looks like the one generation out of date Huami OEM’d things (Mi Band 3 for basic features, Amazfit Bip for GPS and such) and using them exclusively with Gadgetbridge are pretty good choices if you want to have a fully cloudless fitness tracker right now.

  6. Related – we have a Garmin Striker 4 ‘fishfinder’ as the depth instrument on our sailboat. It’s inexpensive and pretty great. It has a built-in GPS, and although it doesn’t show maps or charts, it does save and display tracks, and is capable of marking locations then providing a bearing back to them. And it’s chock-full of track data from our many trips.

    The fishfinder wiring has serial in and out, as a provision for sharing marks etc between Garmin devices, but I haven’t found a list of commands for that serial interface that I could use in a standard serial terminal to, for example, trigger a dump of all my track data for display in a mapping app.

    Suggestions welcome.

    1. Only garmin device I’ve got has a kind of vulcan nerve pinch interface to USB. (Funky shaped plug to spread out pads) I don’t know if there’s a serial adapter in the official interface cable though, could be in there, the ends are a bit chunky.

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.