Garmin Messenger Vulnerability: Your Conversations at Risk of Being Seen by Strangers
Kaitlyn Cimino / Android Authority
Add Android Authority on Google:
Summary
- A Garmin Messenger user shared their experience of recovering an entire chat history on a different device using just SMS verification, bypassing the need for a password.
- This issue raises alarms that reused phone numbers could grant access to prior communications, potentially containing sensitive information.
- Garmin has been made aware of the situation but has yet to announce a solution.
Transitioning to a new phone number shouldn’t come with the risk of exposing private conversations. However, a revelation by a Garmin Messenger user suggests that the next person to receive your former number may unintentionally gain access to your messages.
A user on Reddit recounted their experience of installing Garmin Messenger on a new phone. After entering their phone number and verifying it via SMS, they found that their previous conversations reappeared without needing a Garmin account password. The new device could send and receive messages without any apparent method to disconnect it from prior sessions.
This may seem convenient for users migrating to new devices, but the potential issues become apparent when the number is reassigned to a different owner.
Telecom companies often recycle unused phone numbers. If Garmin Messenger fails to properly identify a new user from the previous one, it could allow someone who legitimately acquires that number to access prior messages. It’s crucial to note that the Reddit user carried out the test on their own devices, and there has been no demonstration of a recycled number being exploited without the previous owner’s cooperation, as the SMS verification code is still necessary.
The potential implications of this are quite concerning, as Garmin Messenger is designed to keep adventurers connected, often through messages that share travel plans, check-ins, and locations. If this information gets into the wrong hands, it could lead to tracking of past, current, or future positions, raising significant safety concerns.
Garmin has stated that the app operates as intended without a password, as it allows users to log in only with their phone number and an SMS verification code. While this enhances ease of use, it prompts questions about the security measures for those who may receive the old number.
According to Garmin support, this behavior is part of the design, although they have promised to further investigate the findings. Sports technology reviewer Ray Maker, known as DC Rainmaker, has also reached out to Garmin regarding this issue, and the company indicated they would forward the information to the relevant department. However, no official statement has confirmed a security vulnerability or remedy.
Importantly, uninstalling Garmin Messenger does not break the link to your phone number. To terminate this connection, users must access Messenger, then navigate to Accounts > Manage Garmin Messenger Account > Delete Garmin Messenger Account, allowing Garmin to dissociate the number, while retaining any related subscriptions.
Until Garmin provides clarity on how they handle the ownership transfer of phone numbers, it is advisable to discuss the potential ramifications before parting ways with a number.
Inquiries have been sent to Garmin seeking further details about this behavior, particularly regarding the risks posed by recycled phone numbers and the existing protections. Updates will be provided upon receiving a response.
