Remotely Exploding Pagers

Wow.

It seems they all exploded simultaneously, which means they were triggered.

Were they each tampered with physically, or did someone figure out how to trigger a thermal runaway remotely? Supply chain attack? Malicious code update, or natural vulnerability?

I have no idea, but I expect we will all learn over the next few days.

EDITED TO ADD: I’m reading nine killed and 2,800 injured. That’s a lot of collateral damage. (I haven’t seen a good number as to the number of pagers yet.)

EDITED TO ADD: Reuters writes: “The pagers that detonated were the latest model brought in by Hezbollah in recent months, three security sources said.” That implies supply chain attack. And it seems to be a large detonation for an overloaded battery.

This reminds me of the 1996 assassination of Yahya Ayyash using a booby-trapped cell phone.

EDITED TO ADD: I am deleting political comments. On this blog, let’s stick to the tech and the security ramifications of the threat.

EDITED TO ADD (9/18): More explosions today, this time radios. Good New York Times explainer. And a Wall Street Journal article. Clearly a physical supply chain attack.

EDITED TO ADD (9/18): Four more good articles.

Tags: , ,

Posted on September 17, 2024 at 11:54 AM • 102 Comments

Comments

Tom • September 17, 2024 12:06 PM

Supply chain attack, surely?

Who on earth still uses pagers for comms today? Even the NHS has moved on. Maybe Hezbollah were sold special “secure” pagers because they didn’t have all the tracking that modern smartphones have?

Samuel • September 17, 2024 12:07 PM

The fact that they all exploded simultaneously makes unlikely the thermal runaway hack hypothesis. I also doubt a pager very small battery would be enough to actually kill the wearer…

Paul • September 17, 2024 12:10 PM

Whatever one thinks of Israel in general, one cannot but stand in awe sometimes at the works of their military/intelligence/cyberwarfare people.

JPA • September 17, 2024 12:33 PM

@Paul,

I can’t help thinking that if both sides put as much time, effort, and money into working toward peaceful solutions rather than trying to kill each other things would be so much better for the people on both sides.

I have no idea how that could come about though with the constant justification for violence used by both sides.

Sigh

Frankly • September 17, 2024 12:37 PM

Now that the world knows this technology exists, many nation states are going to be trying to develop or steal this tech. The risk of using this against Hezbollah is that it will later be used against one’s own nations or allies’ nations.

Who still uses pagers in developed nations? Doctors.

Eric • September 17, 2024 12:48 PM

Thermal runaway would not produce explosions I think. Because of the large scale it almost has to be explosives inserted in the pagers in a supply chain attack.

Frankly • September 17, 2024 12:58 PM

The American University of Beirut Medical Center, Office of Communications, posted a message about the pager attacks, saying that their pager system was updated August 29, 2024 and implying that none of the hospital’s pagers exploded. They also stated they have over 160 seriously injured victims of the pager attack.

hot pockets • September 17, 2024 1:15 PM

What are these pagers used for? What is one supposed to do when paged?

Can one bootstrap a membership roster with a list of the injured?

Who else uses these pagers? Just the HzbA or another group?

Part of their comms system is down…unless these pagers work after exploding. In what scenario might that be useful?

Mr Pager • September 17, 2024 1:19 PM

“That’s a lot of collateral damage” – quite the contrary. This seems to be targeted specifically at operatives holding those pagers, and the videos show that even people standing within a couple of feet of the devices aren’t hurt. This is as surgical as you can get at this scale.

Ray Dillinger • September 17, 2024 1:21 PM

Definitely a supply chain attack; there’s not enough power in a pager battery, and what there is can’t be released by a thermal runaway fast enough, to account for the energy of these detonations. The videos show explosions I’d consider consistent with a C4 charge about the size of a AA battery.

People using pagers to communicate today are motivated by security. They’re deliberately keeping their business off of (insecure) cell-phone networks and using land lines for sensitive stuff. For the most part that means clandestine operations.

Hezbollah in particular had land lines that they’ve run themselves, through tunnels under Gaza, which they used to keep their incursion plans off Israel’s radar. They likely still have a few of them that Israel hasn’t tapped yet. It makes sense that they’d be using pagers to prompt people to call on a secure line from wherever they are.

So I’m just speculating here, but it looks like Israel said, “Hezbollah is using pagers. Very few other people are using pagers, so let’s inject explosive pagers into the market, wait for them to be purchased, and then blow them up, on the assumption that this will catch every Hezbollah member who’s replaced their pagers in the previous few months.” And like most of the stuff they’ve done, it also does “collateral damage” to some civilians uninvolved in the conflict.

Arnold Boer • September 17, 2024 1:38 PM

Well, that sure makes you wonder what might be inside that device that you’re holding right now, don’t you? This one came straigth out of a movie, or a supply chain attack cookbook. Scarry how good this attack was performed. This will have a world wide impact, both on supply chains as on security and warefare. Are we still allowed to bring pagers or phones in a plane next year?

Winter • September 17, 2024 2:06 PM

@Ray Dillinger

Very few other people are using pagers, so let’s inject explosive pagers into the market, wait for them to be purchased, and then blow them up, on the assumption that this will catch every Hezbollah member who’s replaced their pagers in the previous few months.”

It looks to me like someone at Hezbollah decided, or was sold the idea, to protect against the all-seeing eyes and ears of the MOSSAD, by using portable pagers in combination with a secure, non-portable communication channel, eg, a secured landline network. This in preparation for the upcoming land war with Israël.

A good idea in itself.

However, they required a lot of pagers in the run-up, all becoming available in a very short time for the switch. And they could not all buy them in random shops in Libanon. So they shipped a container full of pagers into Libanon.

And their enemies got wind of these plans, or might even instilled the very idea into their organization, and prepared the pagers with explosives and a trigger mechanism. Just a coded message would be enough, I think.

Stuff for a movie script that would be dismissed as too phantastic.

lurker • September 17, 2024 2:32 PM

BBC is reporting that the devices that exploded were Motorola, a post-Oct 7 bulk resupply to replace mobile phones(q.v. Yahya Ayyash). They suggest that such a shipment would be easier for an adversary to tamper with. I heard this on a radio broadcast, BBC have not (yet?) put this wording on their website, although they are reporting that some of the devices also exploded in Syria.

Vesselin Bontchev • September 17, 2024 2:40 PM

Another unconfirmed but plausible report:

GoaChronicle through its intelligence network has learned that Israeli intelligence successfully intercepted a shipment of pager batteries that had been ordered from B&H Photo. The order was placed from Lebanon. Acting on a confirmed tip, the intelligence agency seized the shipment and covertly modified the batteries. Small, undetectable explosives known as Kiska 3 were inserted into the battery casings and connected to the battery wires via a discreet chip. The pager model was Rugged Pager AR924 IP67. The operation code word was ‘Below the Belt’.

https://goachronicle.com/hezbollah-members-pagers-exploded-in-coordinated-attack-israel-suspected-of-hacking/

SteveB • September 17, 2024 2:48 PM

It occurs to me that dirty tricks encourage more dirty tricks. It’s worrying what kind of retaliation the injured parties might now feel justified in using.

Also, across a group 3000 devices, it seems likely that at least a small number will have been faulty, or not charged, or whatever, so the detail of what’s really happened here might become known at some stage.

Michel • September 17, 2024 2:53 PM

“Were they each tampered with physically, or did someone figure out how to trigger a thermal runaway remotely?”

@Bruce:

“The affected pagers were from a new shipment that the group received in recent days, people familiar with the matter said. A Hezbollah official said many fighters had such devices, speculating that malware might have caused the devices to explode. The official said some people felt the pagers heat up and disposed of them before they burst.”

https://www.wsj.com/world/middle-east/hundreds-of-hezbollah-operatives-pagers-explode-in-apparent-attack-across-lebanon-cf31cad4.

Bcs • September 17, 2024 3:11 PM

I wonder if the direct losses or the “oh **** now we need to worry about that” effects will have more long term impact?

Bcs • September 17, 2024 3:19 PM

Does anyone have data on what is counting as wounded? Depending on what you want to claim, that could be anything from ringing ears to a stay in an ICU.

From a international reaction over collateral damage standpoint, I’d say anything that wouldn’t cause significant long term disability if totally untreated should be ignored and I’d expect that to be the majority of injuries. Are those included in the reports?

Tatütata • September 17, 2024 3:19 PM

Lebanon is mountainous (Mont Liban is 3000m high!), and a single VHF transmitter on a mountaintop would already cover a sizable portion of the country, or probably the entire area under your control.

It would therefore seem to make sense to build your own network without having to rely on a public telco, which could be cut off by opposing factions or whatever is left of central government.

Using obsolete/mature technology wouldn’t matter. There aren’t that many suppliers left, and the remaining markets are specialized, such as hospital beepers, or poorer countries.

I suppose that the buyers shopped around some E-commerce website and requested quotes for a batch of receivers built to a certain specification, and this would be how the fix got in. Alibaba lists quite a few results by entering “POCSAG”, which is/was one of the dominant standards back in the 1990s. My idea is that security breach occurred while the system was still in the design phase, i.e., through Trojan horses or wiretapping. The fish was probably hooked and reeled in by an unbeatable price or specs.

A 5.56 or 7.62mm bullet has enough energy to be lethal, and is comparable in size to an AA battery. Engineering an drop-in piece of ordnance that looks like a legit electronics component is probably possible, but how do you get a production line in China or Vietnam to include this “special” part in the BOM?

ramir • September 17, 2024 3:25 PM

People using pagers to communicate today are motivated by security. They’re deliberately keeping their business off of (insecure) cell-phone networks

Are pagers secure, these days?

They have the advantage that—assuming an adversary hasn’t modified them—they can’t be tracked. They also have good battery life, and can work when the cellular networks aren’t fully available. But, historically, they’ve used insecure radio broadcasts. Remember the Wikileaks pager dump from 2001-09-11? Presumably, it wouldn’t be much harder to spoof a message to such pagers.

Has any operator added proper modern cryptography to these devices? Not that it would help if your enemy has modified them.

Axel • September 17, 2024 4:16 PM

What type of pager was it? Was it just the bad guys who got it/them? Or some uninvolved as well? If the former then they got them shipped to them with explosives, I would assume. It has been reported, while i was writing this that it was 20gr of PETN and shipped 5 months ago. Triggered by battery heat up or so reported. Maybe they were up to something in the next few weeks, so someone decided to act up now preemptively.

AlexT • September 17, 2024 4:23 PM

Given the number of devices implicated there muss be some duds.

The teardown will be most instructive.

James Pike • September 17, 2024 4:39 PM

Based on the damage they must have been enhanced with explosives, I can’t see this be thermal runaway.

I’m very curious as to the triggering mechanism to launch this attack! I assume they would have purchased the hardware… and then used their own sims. So the attack, if triggered remotely, would have had to be based on the IMEI? unless it also had a call home feature… Regardless I can’t wait to hear more about this!

This also had to be a last resort thing kinda thing, I wonder what event precipitated the trigger being pulled.

Alexander Heidenreich • September 17, 2024 4:57 PM

I have other concerns about implementation. If you place explosives in such a device, which thousands of people then carry around with them, then sooner or later one of them will get on the plane and then it will light up nice and red in the scanners or be discovered by the snooping machines. So they must have used something that can’t be discovered. Of course, this is also exciting information that there is something that these scanners do not discover. Explosives leave traces and I think this is now being analyzed in some laboratory so that this information is available and even if it is not published, those who are interested have the information.

Ola • September 17, 2024 5:36 PM

Norwegian battery expert says cylindrical cell lithium batteries build up a lot more pressure that could potentially lead to an explosion – in contrast to pouch cell lithium batteries that will inflate, burst and start to burn.

Clive Robinson • September 17, 2024 5:53 PM

@ Folks,

The pager system is a simple broadcast system in the VHF or UHF band and it has no security in general.

That means anyone who knows the base station broadcast frequency and a pager group or individual ID can listen into broadcasts or send out a message to any or all of them.

You can look up the “Post Office Code Standardization Advisory Group”(POCSAG) standards quite easily and confirm this. Or you can follow somebody elses experiments,

https://www.rfcandy.biz/communication/pocsag.html

As I’ve mentioned on this blog in the past the “pager in your pocket” is a receiver only thus not designed to be trackable at any range[1] unlike mobile phones or most other modern communications devices.

The important point to note is that as there is no security, then “the broadcast” may not come from any “network transmitter”. In fact you can create your own POCSAG transmitter with very easily available parts for “pocket change” and you will find web pages of Ham/Amateur Radio Operators telling you exactly how to do this.

The range of the transmitter has little to do with it’s radiated power, what counts is the “radio horizon” as I’ve mentioned before a hand held radio pushing out less than 1watt can easily be heard not just in “low earth orbit” but at the hight of the ISS. In terestrial terms a transmitter at 300m above the terain, suspended under a cheap DJI type drone would reach out to give a 60kM radius coverage area.

So anyone with a little knowledge could have set up a system to send out the signal that caused the pagers to do what they did.

[1] Nearly all receivers work on the heterodyne principle, thus contain an EM oscillator at a known “offset frequency” from the broadcast frequency. These tend to have standard offsets at the “Intermediary frequency” that last century would have been around 10.7MHz or 455kHz. These oscillators do leak back through the mixer circuit and radiate from inexpensive receivers. During WWII the German Radio Service used this to quickly triangulate and track down SOE and similar radio operators in what we would now call a “Find, Fix, and Finish”(FFF) operation. I’ll leave it to peoples imagination as to what the final F stood for, or you can look it up.

Clive Robinson • September 17, 2024 7:20 PM

@ Alexander Heidenreich, ALL,

Re : Scanners are nowhere near effective at detecting things.

You say,

“Of course, this is also exciting information that there is something that these scanners do not discover.”

The ability to “beat the scanners” does not require much more than a few undergrad science books and a little thought.

Look at it this way you scan a household eating fork, you see metal in a fork shape and a shadow or similar for the plastic handle.

Does the scanner tell you the metal or the plastic, mostly no.

You can look up how conductive anodised aluminium is and find it has properties not to disimilar to a diamond. That is it conducts heat we but not electricity. Over this you could place a layer of magnesium that will if you make it thin enough, not just conduct electricity but burst into fairly intense burning. Would this show up on an average scanner? Probably not. Would a low pay guard labour operative be suspicious if they did see something very slightly odd?

We know TSA operatives that have received significant training routienly miss things way more obvious like hand guns during tests…

So my guess is it would be fairly easy to get past the guard labour that is bored out of their mind and looking toward their next smoke/coffee break.

As for the “plastic” used for the handle, for very many years they were made out of “Nitro Cellulose” that you might call celluloid. The thing is it is highly inflammable, worse with age it can become unstable and work it’s way up to being “Tri-Nitro-cellulose” which is a high explosive…

Most baggage scanners would be hard pressed to tell them apart.

There really is “nothing new” here and it’s been well known since before the 1980’s.

In fact the “recipe” for turning ping-pong balls and sulfur foot powder into an explosive more powerful than gun powder can be found in books written by prisoners of war in WWII and seen demonstrated on TV programs in the 1980’s about “Colditz” and similar. The only question is was the Red Cross that shipped the foot powder, ping-pong balls and other celluloid items ‘in on it’ or not (personally I suspect not).

But you don’t need celluloid, sugar and a common household cleaning product will make “flash powder” amongst many other highly exothermic things. In fact a well known chemist once joked the average house had sufficient chemicals under the kitchen sink or in the pantry to blow the house up, or burn it down.

If you want to know just how dangerous things can be look up fuel air explosives made with “coffee creamer” or “Chapatti flour” the well known TV program Mythbusters demonstrated these rather dramatically.

Also look up coal dust and washed pink pickling salt and many many other fine powders. The trick is getting the energy out of the chemical bonds very fast, there are “look-up tables” of such information you will find in any College or University library. But “the mechanics” to do it you will generally not find in such libraries.

Oh and don’t use “on-line” documents/guides, the chances are they’ve been written by people that have more luck than useful knowledge and will probably go the way of the dodo or collect a Darwin Award in passing… Because the thing about chemical reactions is they tend not to scale well without considerable precautions.

ramir • September 17, 2024 8:16 PM

So anyone with a little knowledge could have set up a system to send out the signal that caused the pagers to do what they did.

Well, maybe, if they knew how to create such a signal. It seems that regular pagers still have no security; as for these modified ones, who knows? It’s possible that the detonation signal doesn’t use the normal paging protocols or radios at all. It could be more secure—or less, cf. those “blasting in progress; turn off radios and phones” signs.

Do we even know that they were remotely triggered? A time-based trigger would be the other obvious possibility. With proper calibration, even a wristwatch quartz oscillator can be accurate within a few seconds a month. (Watch companies don’t do it, because it takes days or weeks to do; which means assigning unique serial numbers, having someone re-connect each after the calibration period, etc. But it’s a mystery to me why they don’t expose a way for customers to do it.)

Were I planning like this, I’d be inclined to make them remotely controllable via a secure protocol. “Receiver only”? No microphones or tracking? That’s what they’ll think.

ramir • September 17, 2024 8:57 PM

Regarding explosives scanners, I think it’s much simpler than what Clive wrote. The people to whom this attack is attributed have access to such scanners, and can experiment until they get something that avoids an alarm.

Some detectors are “sniffers”, which I think have only ever caught farmers and gardeners (due to fertilizer residue). An air-tight package cleaned of exterior residue will beat those. Apparently, other detectors use CT scanning and computer vision, but metal tends to block the X-rays used in CT scans. One or two unscannable battery-shaped areas might just be normal for such a device.

The scanners that produce images for humans to look at are, at best, gonna show a pager-shaped device, maybe with some circuit parts visible. What are the employees gonna do, reverse-engineer it from the scan? There’s basically no chance of any well-disguised thing being caught this way. Historically, even obvious stuff, like guns, have gone un-detected about 95% of the time.

Howard • September 17, 2024 9:31 PM

That’s a lot of collateral damage.

How do you know?

How many pagers went off? How many targeted pagers didn’t belong to a member of Hezbollah?

Unless and until we answer these questions, claims to collateral damage will be he-said-she-said. Hez will maximize the # and probably lie, while the IDF will minimize the # and also incentivized to lie.

This attack is about as surgical as it gets, at scale.

Steve • September 18, 2024 1:23 AM

Remote detonation of explosives is very common. IEDs killed most of our KIA troops lately. Phones and pagers are ideal for the task. A little unstable TATP to avoid nitrogen explosives detection and any physical or electronic trick to command it to fire could do this. The event is hardly startling. If mere defective batteries could have this result, no such battey would be available.

whatdoiknow • September 18, 2024 1:27 AM

What I can’t understand is the timing.

As a prelude to, say, a ground offensive in Lebanon, this makes perfect sense: Disrupting a key communication channel and spreading panic effectively incapacitates the Hezbollah, at least for a few crucial hours.

As a standalone action, in the middle and long term, this will have little to no effect.

One can’t help but suspect that internal Israeli politics were the motive behind pulling the trigger at this specific time.

Another alternative: Hezbollah started suspecting something, and it was a choice between using and losing the capability.

lurker • September 18, 2024 1:46 AM

BBC is now reporting that at least some of the devices made a sound shortly before exploding. I presume this would be the normal “Incoming Message” warning sound, then about a 5 second delay on the charge would ensure the victim was reading the screen for the message, which would account for the high number of facial injuries. Fiendish.

Isac Rabin • September 18, 2024 2:42 AM

Hmmm, this is something which one would expect as being used just prior to major Israeli ground invasion and none has eventuated yet – so was it a test run gone wrong or …?

lurker • September 18, 2024 2:57 AM

Devices carrying the Gold Apollo brand were reportedly made under licence by BAC (Consulting KFT) in Hungary. Gold Apollo’s boss in Taiwan says they are also a victim and will sue BAC.

“We may not be a large company but we are a responsible one,” he said. “This is very embarrassing.”

‘https://www.reuters.com/world/middle-east/gold-apollo-says-it-did-not-make-pagers-used-lebanon-explosion-2024-09-18/

Winter • September 18, 2024 4:31 AM

It was today in the news that the pagers were produced in Budapest under license of Taiwanese Gold Apollo:
‘https://apnews.com/article/lebanon-israel-exploding-pagers-hezbollah-syria-ce6af3c2e6de0a0dddfae48634278288

The AR-924 pagers were manufactured by BAC Consulting KFT, based in Hungary’s capital, according to a statement released Wednesday by Gold Apollo.

Hljeb • September 18, 2024 4:52 AM

On a positive side for Hizbollah they should be able to have the pagers replaced under the replacement warranty

Clive Robinson • September 18, 2024 4:59 AM

@ Ranir,

Re : Occam had a razor for reason.

You are needlessly multiplying hypotheses when you say,

“It’s possible that the detonation signal doesn’t use the normal paging protocols or radios at all. It could be more secure—or less”

Yes it could but it is unnecessary, and currently there is no evidence to that effect.

Not only is POCSAG an open standard there are thousands of Ham/Amateur Radio operators using it to set up their own pager networks for fun and more serious Emcomm reasons. This is from more than a couple of years back,

https://emergencyham.net/blog/dapnet-decentralized-amateur-paging-network

Also have a look at someone using simple procedures to set up such a “home system” four years or so ago,

https://m.youtube.com/watch?v=XnyxwmMPX_g

Just typing in “Amateur radio paging” into YouTube will bring up enough videos to give you sufficient ability to bring up your own “city wide” system.

As I’ve noted that part of the world has had much of it’s civilian infrastructure deliberately destroyed by another nation intent on genocide (see legal and UN definitions). Thus those who are the elected Government are having to find much less expensive and way more robust systems to do civilian management/support as is the duty of all governments.

I suspect that a lot of those carrying those pagers were “civil servants” carrying out such services to the civilian population in a time of crisis.

After “stuxnet” and how it was investigated and eventually unmasked and finally admitted to, I suspect those involved in this “war crime” will have gone for the least technically sophisticated method for “deniability” purposes.

Why do I say “war crime” because by definition outlined in treaties and international law it is.

There was no reason to intercept these pagers and put lethal devices in them except for the purposes of genocide to kill emergency workers and the like. The way POCSAG pagers work is very simple and low tech going back to the 1970’s if not earlier. Thus is very vulnerable to the simplest of Electronic Warfare which would stop them working.

I can give a step by step procedure not just for setting up a city wide pager system, but how to simply jam it. I can further point to areas within the POCSAG standards that could be used to make them into simple remote controlled bomb detonators, but I won’t for two reasons,

1, The information is freely available with a few minutes searching and a few days reading.
2, Giving a step by step guide would not be seen favourably at this time.

The point is I’ve given sufficient information for people to weed out the “fake news” being pushed from certain quarters into the Main Stream News.

Why because people should follow “evidence based reasoning” not “hyperbolic speculation”.

I’ve given sufficient base information as a foundation for people to build solid further information on.

As for access to “scanners” I highly doubt that any of these pagers were “scanned” by those who received them, remember most of their civilian infrastructure including hospitals and dentists has been quite deliberately destroyed by others with significant political intent and criminal activity.

Thus the people who “intercepted and implanted” these bomb devices inside the pagers would most likely know they would only have to pass,

1, Simple visual inspection
2, Basic “goods inwards” functional test.

Oh and remember that this sort of “supply chain attack” is far from new there was a case in the UK where tiny mobile radio devices were installed in those supposedly secure “Electronic Point of Payment”(ePOS) systems of a major UK supermarket chain by we assume criminals in China as a link can be demonstrated to Chinese based criminal gangs using the data skimmed for boosting income via a “pay for Porn” US Gateway.

The supermarket, could not tell the hacked and non hacked ePOS terminals apart by visual or other scanning techniques, and it looked like they were going to have to destroy all of them. Then one person discovered that the criminals had not taken weight into account. The hacked terminals were just a few grams heavier than the unhacked ones.

I suspect that if it was a non state level organisation did this attack, then they would probably miss something like weight or center of gravity.

But probably we will never get told this by Main Stream News if this is discovered.

ATN • September 18, 2024 5:00 AM

With the improvement of battery technology, it is now easy to replace two old 1.2V cadmium battery with one 3.6V Lithium battery (with a possible diode to reduce by 0.6Volt) without loss of performance. Leaves plenty of space for explosive…

Lorenzo Gatti • September 18, 2024 6:25 AM

Now that it has been done and pager use has been discouraged, let’s worry about the next attack. How much explosive can be realistically planted in a smartphone motherboard, screen, battery, or other large parts that can be outsourced?

The software and triggering side of remotely detonating phones can be assumed (a bit pessimistically) to be “solved”, but hopefully there is not enough room in the device, or tampering is easy to notice.

wiredog • September 18, 2024 6:34 AM

Where I work no two way wireless devices are allowed, so anyone who needs to be reachable on short notice uses a one way pager. If you keep your eyes open you see a lot of them in the DC area.

Back in the 90’s a business associate of mine in the recreational pharmaceuticals business carried one and we had a set of codes we could send him to tell him what we had found or were looking to purchase. No reason you couldn’t have a pager rewired so that if it received a particular code it would set a certain output.

Andreas Neubert • September 18, 2024 7:30 AM

Regarding often mentioned “supply-chain-attack” – has anyone thought about the possibility that they were built-to-order with explosives as “remote wiping”, potentially including the person who’s wearing it, in case of rogue agents, and that “feature” was either misused by a hacker, or triggered accidentally?

Someone would have checked the shipment on arrival…

Spencer • September 18, 2024 8:11 AM

One interesting take (from Al Jazeera) is that the explosions would be not only valuable for their immediate damage but as a form of intelligence gathering:

[Data analyst Ralph Baydoun] also suggested that Israel would not need to know the names of whoever received the corrupted signal but it could gather valuable intelligence after the detonations.

“If they had the satellites on, … they would know the names and locations of all operatives who were attacked … immediately when [they asked] for help. They would disclose [their] locations,” he speculated.

Picking out thousands of personal explosions from satellite footage seems challenging, but if anyone has the tools it would be Israel.

Sean • September 18, 2024 8:34 AM

Yes very likely the pagers were rigged up with explosives, added into the small amount of free space, or replacing an existing thermal transfer compound with it, and embedding a small detonator in there. Then took the microcontroller in it, and made up some new firmware, which used one of the spare IO pins on the controller, they come with a few IO ports, as a general purpose microcontroller, and thus typically you have a few spare unused ports, as almost no application ever fully uses all the functions and pins, as designers either go to a bigger pin count when they run low on pins, or put in port expanders to handle slow data rate like displays, leaving spare pins. Then used one not used, added in a simple SMD transistor, possibly 2 in series, so you need to set one pin high, and the other low, to trigger, as the microcontroller typically will have all pins in high impedance state, or with a weak pull up, on power up, to get a known input state on power up. So 2 SMD transistors, and 2 0105 resistors, likely on a very small flex PCB, so that it looks like a production line modification.

Firmware then modified to look through incoming messages for a specific code, either a first message sent to arm the routine, then a second different message sent within 30 seconds that enables the explosive. Either case the code sent is not displayed, and then the unit detonates.

This takes time, likely the organisation that did this ordered the pagers a year ago, got a big batch, and spent a few months taking each one, carefully stripping them, then adding the explosive and trigger, and packaging them up again to look legitimate and undamaged. While this was going on another group was looking for the order for them, and either posed as a legitimate seller, or had set up a false storefront, selling off a few other items, while waiting for this to come in, and giving a price that was guaranteed to get the order, but not too low as to raise suspicion, and a delivery time consistent with international shipping, while having the order ready to slip into a legitimate cargo delivery.

Expensive to do, but with the right motivated agencies, doable, and likely was done with spreading that pagers are not detectable, as they do not transmit at all.

Another thing likely also done has been to put as well into this some pagers with a different payload, instead of explosives, they instead incorporate a low power spread spectrum transmitter, triggered via the same spare pins on the microcontroller, and transmitted as a 5 second burst of spread spectrum “noise” using the receive antenna. not very long range, but very hard to detect without stripping the unit apart, and good enough to allow good location, simply send the correct trigger code to the pager number, and use RF detectors to follow the spread spectrum and decode it, and use 3 or more receivers to triangulate position, with only a few 5 second bursts locating the pager accurately. Modern electronically steerable antennas, and the associated receivers, can easily get direction within 10 degrees for a single burst, and thus allow triangulation with great accuracy. Or both were applied, and only a certain number of “high value” targets were hit this time.

Bob Paddock • September 18, 2024 10:38 AM

I have no knowledge that this technology was used. Simply pointing out that it has been available for over a decade. These alone do not have the energy to do what was done.

Almost lost in the mists of time is that in the past manufactures made military specific parts, before someone thought that Commercial Off The Shelf technology (COTS) was a good idea (it wasn’t). National Semiconductor’s, now part of TI, Application Note “#761:Electronic Fuzing” covers the basic terminology of Fuzing and application.

‘https://www.ti.com/lit/an/snoa217/snoa217.pdf

The Massive Electro-Pyrotechnic Initiator Chip Resistor (MEPIC) from Vishay is hard for the untrained eye to tell from any other SMT resistor, in 0805 package. This is an upgrade of the older EPIC.

The Vishay “resistor is optimized for electronic igniter applications in automotive safety systems for the deployment of airbags and other safety devices; digital blasting in mining applications; and in fireworks applications for better synchronization of fireworks, music, and special effects”.

The device is RoHS-compliant and conforms to Vishay “Green” standards. [Is it not great that Fuzes are ‘Green’?]

Sadly even tho I’m it good standing with my Vishay Rep. Firm, samples of (M)EPIC parts are restricted to people that can show good cause for getting them, so Homeland Security can relax. To bad, think of the fun the people at Hack A Day or Make Magazine could have with some these…as well as those great hands-on educational experiences that are being lost…

‘https://www.vishay.com/en/product/53058/

Winter • September 18, 2024 10:39 AM

@Sean

simply send the correct trigger code to the pager number, and use RF detectors to follow the spread spectrum and decode it, and use 3 or more receivers to triangulate position, with only a few 5 second bursts locating the pager accurately.

I would be concerned about personal security having to do such involved operations in Hezbollah territory in Lebanon. Visiting their territories seems to be not without hurdles.

Tatütata • September 18, 2024 10:48 AM

Nearly all receivers work on the heterodyne principle,

Nit picking mode… Homodyne (aka zero-IF) designs have multiplied in the last decades, including in SDRs and cellphones. But in pagers the name of the game is power saving, and you don’t really have the resources for an I/Q LO+mixer, a dual ADC and DSP.

Using a battery’s thermal runaway doesn’t seem a good option, as it would need to fully charged to cause effective damage, so only a random fraction of the fleet would potentially inflict harm. Even then, looking at videos of 18650 cell getting shorted out seems a nasty event, but a bit short of “explosive”. I would expect the damage to be generally limited to bad burns. Sorry, no links, to prevent getting flushed to /dev/null.

A 18650 cell is the ubiquitous type found in just about anything from toys and power tools to electric cars. I calculate its volume at 16540 mm3. An AA cell has less than
half of the volume, at ~7700 mm3.

US TSA states: “With airline approval, passengers may also carry up to two spare larger lithium ion batteries (101–160 Wh) or lithium metal batteries (2-8 grams).“. A single 18650 can store about 10 Wh. So the runaway of a single cell seems to be considered a well manageable event.

Inducing thermal runaway would require some sort of crowbar device to short out the battery. I would rule out BJTs and SCRs, because of their large voltage drop relative to a single-cell voltage, and a BJT would require a large bias power. A power MOSFET would be IMO the device of choice. (One caveat: MOSFETs have an increasing voltage drop with temperature, whereas bipolars have the opposite characteristics). The best devices have RDS_on better than 1 milliohm, but you would still need something beefy enough to sustain, say, 50+ amperes long enough to induce runaway. However a MOSFET needs much more than 3 volts to switch on fully, and pagers are probably designed to work on less than 3 volts. The driver would need to have some sort of voltage multiplier, charging a capacitor large enough to drive the gate for the duration of the event, and a switching device to connect said capacitor to said gate. Someone with a good knowledge of electronics might notice something fishy.

Getting the trigger message into the system is probably not a huge feat. I wonder whether the pagers could be used privately, or only service messages could be delivered through them.

Unlike many exploits with symbol tables left behind, and comments in Chinese, Russian or Korean, I wouldn’t expect to see any such telltale marks in the firmware.

scot • September 18, 2024 11:18 AM

There is a part you’re missing; Hezbollah recently stopped using cellphones for communication due to a security breach that was allowing tracking of members. When they stopped using cellphones, they handed out pagers to their membership, and would page members so they could call in via the (presumably) more secure landline. The pagers had to have been prepped and ready before the cellphone breach. By ensuring a quick and complete deployment of the compromised pagers, there wasn’t time for any to be returned for repairs, and thus a low risk that the compromise would be discovered. It also limited collateral damage, by largely limiting the pager distribution to just Hezbollah members in need of secure communication because, as has been mentioned many times, who uses pagers anymore?

ramir • September 18, 2024 11:40 AM

Clive, I don’t think those hypotheses are “needless”. Anyway, I’m not saying they’re likely in this case; just that we don’t really know, and this case raises certain possibilities for future attack and defense scenarios. I believe that’s all within the reasonable scope of this discussion.

A more secure form of radio-triggering could be done over POCSAG by using a different “arm” message for each device. That would allow for a targeted attack, which could still trigger all armed devices simultaneously. But the amount of collateral damage seen here, plus the history of Casio F-91W wristwatches being used to trigger explosives, does raise the possibility of a time-based trigger.

The reason to consider other protocols is because of how useful they’d be to the attackers. People are buying such devices to avoid being monitored by their adversaries, who’d want to do exactly that. An additional spread-spectrum radio could perhaps let them track the devices, and even send back microphone audio (pagers already have speakers, which are basically microphones). They could also just stick something like an AirTag in there. Significant modifications might be noticed if someone opened the device, but we don’t know whether the attackers considered that a serious risk.

The recipients of these devices would not be expected to scan them for explosives, but the whole plan would likely fall apart if someone were arrested for smuggling concealed explosives into an airport. Those installing the explosives would therefore have reason to make them undetectable by scanners.

Ray Dillinger • September 18, 2024 12:06 PM

So there is more to this story now.

This morning BBC is reporting that a fresh round of explosions has occurred. The first round hit pagers that had been ordered and imported by Hezbollah; the current round hit walkie-talkies.

At least nine more killed and 300 more injured at the current time.

Walkie-talkies, like pagers, are capable of passively receiving without transmitting anything, and when in such use they cannot be easily located or remotely tracked. When used to transmit, they create local radio signals that can be tracked, monitored, or located. But the local radio signals don’t include GPS coordinates that locate the device to within a couple of meters the way cell phones do, and they don’t have to clearly identify the recipient with a network ID and/or routing information the way cell phones do. So, yes the enemy may be listening, but they are still a big security win over cell phones for local use.

Once again, the explosions were not immediately followed by any attempt to militarily exploit a disoriented enemy, which reduces their apparent tactical value.

Tatütata • September 18, 2024 12:11 PM

A boost, buck, or combined boost-buck switching regulator can put the switching transistor through the inductor in parallel with the battery, so you’d only need to diddle about the regulator IC, but I still think that you’d need a much larger device than typically used to provoke thermal runaway.

In the breaking news, there was a second attack today, this time involving two-way radios.

In other news, a Taiwanese manufacturer claims that it has nothing to do with the attack, but appears to say that production was delegated to a consulting company in Hungary, without any single part being sourced from the island. Not even the plastic casing? The denial sounds a bit weird.

I located several more patents related to POCSAG encryption, eg, by Motorola circa 1990.

scot • September 18, 2024 12:13 PM

…and now that the pagers are compromised, they hand out the exploding radios. Without checking for explosives.

Ray Dillinger • September 18, 2024 12:16 PM

The Talkies, like the pagers, appear to be very much in the possession of Hezbollah members. No news yet of how they acquired them or where the supply chain was breached, but it looks like very few have been in the hands of anyone else.

A single supply-chain attack such as what happened with the pagers is quite an intelligence/covert ops flex. Two in quick succession or simultaneously would indicate that the Israelis have regular access to very sensitive inside information about how Hezbollah is planning and coordinating its communications.

The thing about that kind of intel, is once Hezbollah looks at what was compromised, they’ll probably be able to narrow it down to just one or two possible informants. Which means, whoever it is will necessarily disappear. They will either be extracted by the Israelis or extirpated by Hezbollah.

Andy • September 18, 2024 12:39 PM

There may have been two supply chains attacked here: one for the pager devices, and a second one for the “activation”. If the attacker did use the paging operator to trigger them (Occam’s razor suggests this) then the attacker had to know how to address and trigger the right ones. This may imply a second supply breech. Or, it may be that the attacker’s primary infiltration was to this operator, who also likely resells the devices. This would let the attacker both select the appropriate devices for the specific customer and also to know how to trigger the right ones.

ratwithahat • September 18, 2024 12:44 PM

@Spencer

Yes, but would probably be easier to see who goes to the hospital/has corresponding wounds. And if hospital visits are recorded (and because healthcare doesn’t have a great record on security), Israel could target hospitals to see who was wounded.

On another topic, since most of us are agreed it’s probably a supply chain attack, do people think the pagers were tampered with after manufacturing, or that possibly the supplier (who seems to be the company BAC) was in partnership with Israel as a sort of long-term con?

Winter • September 18, 2024 12:51 PM

Whoever was behind this, did it again with Walkies-talkies

‘https://www.standard.co.uk/news/world/explosions-beirut-walkie-talkie-radios-hezbollah-pager-blasts-israel-mossad-b1182793.html

At least nine people are dead and over 300 injured after hand-held radios used by Lebanon’s armed group Hezbollah detonated late on Wednesday afternoon, according to reports.

JonKnowsNothing • September 18, 2024 1:17 PM

@Clive, @All

In addition to the pagers, walkie-talkie devices are going off too. Once the exploit has been revealed the maximum use will take place before any mitigations can be enacted.

  • Long ago General Hayden said smartphones were “warheads on foreheads”.

This has not changed. Every electronic device is open to exploit since many of them have “apps for that” which give them 1way or 2way connection to the internet.

The NSA has been intercepting telecom equipment for decades, altering the HW SW and re-flashing the Firmware, then repackaging the components in a way to make them appear “unopened, direct from factory”.

The Mossad can certainly do the same setting up the intercept location. They can also use the same CIA technique of setting up a front organization (polio vaccine).

Previously, the LEAs and 3Ls have been able to deflect attention from their efforts when only a few or few hundred people at a time were exploded. It’s harder to hide 3,000+ people getting exploded. Even overheating e-bikes don’t compare.

Consider:

  • The same technique embedding a tiny amount of explosive in every e-car, e-bike, toaster oven, air fryer, microwave or anything with an app or update pathway.

All these devices contain circuit boards, most have capacitors with enough power to do serious damage even without additional explosives.

  • All the now jettisoned pagers heading for landfills with or without explosives included: a new form of landmine.

If nothing else, the trade-in market has just collapsed.

If it is electronic, it is not safe. It was never safe. Now it is mortally unsafe.

krebsonsecurity has details on how easy it is to make a Debit Card account and password skimmer. Such folks will be taking notice of this new path of opportunity.

On a curious note: Many schools are going to the No Smartphone route and students stuff their devices into an RFID-blocking sock often kept in a common box-drawer. When one of these blows in a classroom …

lurker • September 18, 2024 1:27 PM

Day one: pagers;
day two: walkie-talkies;
day three: bicycles? pigeons?

What do we know abut BAC?
‘https://www.bbc.com/news/articles/cew12r5qe1ro

ramir • September 18, 2024 2:05 PM

Andy, the pager networks are generally broadcast media, with “addressing” a client-side operation. The devices could be configured to watch for the “magic packets” being sent to any address (à la Wake-on-LAN). Then the message just needs to be sent to some arbitrarily-selected subscriber on the target network, even a subscriber with an unmodified pager.

Or as noted, the attackers could use their own transmitters to spoof pager messages (but why? that’s extra work with no obvious advantage), or could use some out-of-band method.

I see only two benefits to compromising pager operators: getting the subscriber lists (which probably contain a lot of bogus data), and selectively blocking transmissions. A simple radio receiver can capture all the data, and the official unauthenticated interfaces can cause transmissions.

Winter • September 18, 2024 2:12 PM

[There seems to be a formatting error in the blog. All text is italic.]

Yes, but would probably be easier to see who goes to the hospital/has corresponding wounds.

News reports that hospitals have been closed for outsiders to protect the identity of the wounded.

To me, the most obvious lesson to learn from this incident is not to source all your stuff from a single supplier, and certainly not in a single shipment.

Monoculture is bad, always.

JonKnowsNothing • September 18, 2024 2:33 PM

@lurker, All

re: What next after pagers, walkie-talkie?

  • Solar panel installations.

Size was not specified.

It would be a system that has an “app” to control the panel or monitor the efficiency. Perhaps a more involved one with Active or Passive Sun Following mechanism.

A stand alone panel would be less vulnerable but if it isn’t connected to something electrical it isn’t doing much good. So perhaps these were connected to a battery system that was recharging a pager or walkie-talkie.

Of interest:

One of the major items given out in refugee camps are solar panels. These enable recharging of cellphones and can run TVs or radios. The exact setup varies by agency.

Either end of the supply chain attack targeting a refugee camp ….

anonymous • September 18, 2024 2:44 PM

@JonKnowsNothing, @Clive
A ceramic capcitor exploding would be much less violent then a li-ion cell. The violence of a electrolytic capacitor would depend on the electrolyte. Dendrites in lithium ion cells is a known drawback of the technology. The energy output of pierced li-ion cells or hot li-ion cells is very sudden and violent. The difference in lethality between a li-ion cell bursting and a capacitor bursting is like the difference between a Elon Musk Tesla car fire and a consumer SoC overheating.

Would it be difficult to transmit enough amplitude at a certain frequency to make them heat up and burst? I’d imagine it would be less difficult then a supply chain attack on two different devices. Is there even a way to secure against faulty cells? I don’t think nickel–metal hydride batteries had this problem.

JonKnowsNothing • September 18, 2024 2:55 PM

@Winter

re: single v multiple suppliers shipments

Multiple supplier does not stop the NSA from intercepting equipment, because their intercept abilities are far far up the supply chain and their execution is coordinated with all mail and package carriers.

Depending on what the NSA and 3Ls want with the intercept, they can do pretty much anything they like. How they get full access to all code and schematics is an unknown-known.

Additionally, they have their own Gadget Unit (Q Division in Bond speak) that manufactures all sorts of interesting stuff that can fit inside electrical plugs and cable jacks. (ANT Catalog).

There is no way to expect 100% safety from the Supply Chain. Up until now, the problems in the supply chain have been Commercial Exchanges, where the public buys a defective device. Now, the supply chain is subject to State Actor level of introduced defects overriding the expected behavior of the device.

The difference being

  • Commercial defects are shoddy programming and design
  • State Actor defects are introduced by highly skilled, extremely knowledgeable people with a low ethical threshold

lurker • September 18, 2024 4:11 PM

@JonKnowsNothing

Exploding pigeons might seem straight out of Monty Python, but is certainly within the capabilities of those whom many suspect to be the present operative.

But it is nigh on impossible to find a plain old mechanical roadster style bike these days. The market is awash with e-bikes which have a huge battery, motor and control electronics in which to conceal lethal kinetics.

Clive Robinson • September 18, 2024 4:32 PM

@ lurker, ALL,

Re : Pager alerts,

You comment that,

“I presume this would be the normal “Incoming Message” warning sound, then about a 5 second delay on the charge…”

You forgot to mention that modern pagers used in hospitals and the like have several “audible, visual and haptic alerts”.

That is one sound or vibration for “administrative”, one for “low level” medical, and “high level” for the likes of a crash cart call out in response to a life threatening incident such as a heart attack.

They come “built in” to the device as standard but do not often get used out of “private service” because the few “public call in centers” left do not usually facilitate such “extras”.

Clive Robinson • September 18, 2024 5:19 PM

@ Bruce, ALL,

Re : How many wires / contacts on a battery.

Back when rechargeable batteries in portable electronics were 1.2V NiCads in the same format as the “standard cells” of AAA, AA, through D and those ~9V PP3 etc they only had two wires / contacts and had really short lives both in self discharge, number of recharge cycles as well as low energy density.

Back in the late 1980’s other battery chemistries started comming along. Early lithium batteries were known to be significant fire hazards. Not just because they could discharge in the “high amp” range but also when being charged at the wrong temperature and other specifics.

This necessitated “Battery Management Systems”(BMSs) with an additional wire per cell.

BMSs are complex circuits made possible by “grain of rice” sized components including surface mount micro controllers with “Flash Storage”. You may remember the stories of the likes of Apple using such systems to “up the after sales margins” as you covered it on this blog some years back.

Well now batteries come with three or more wires / connections, one or two of which in some cases are a serial data bus not unlike I2C or even “Controller Area Network serial communication bus”(CAN-bus).

So visual inspection of a battery will show the two “power wires” and one or more others for the active / intelligent BMS…

Now consider to keep manufacturing expense down round cells or even pouches have a higher content to lower weight / material use case. Which means when you put them in a “consumer” battery there is a lot of volumetric space. In “rugged” systems this is filled with the likes of beeswax equivalent, foam, or hardened plastic. All of which have “filler” of some type blended in.

Thus the question “what is the filler or other materials?

Anyone who has done “demolition” training whilst wearing the green knows that “explosive” can not only be “shaped” it can be moulded and coated even some types with “thermosetting plastics” of the sort used in injection moulding.

But there is a catch with all batteries and explosives, as a general rule the higher the energy density the lower their stability, thus the much increased risk.

As has been mentioned there are very high energy density explosives that do not contain nitrates so do not show up on “Chemical Agent Monitoring”(CAM) scanners (that are exorbantly expensive not just to obtain but use). Such high energy density explosives are highly unstable and will go “high order” on filter paper when drying, some even go that way with the least shock or even sunlight…

But research has come up with even higher energy density. Put simply the energy is stored in the bonds between the atoms in the molecules. Back in the 1980’s and 90’s people were researching “stressed bonding” where such distorted chemical bonds could store a lot more energy thus have a much higher “punch” and much more rapid energy release thus more effective shockwave. As far as I’m aware none had reached the stage where they were not considered “Devil Dust” that would claim your soul more easily than a meer snap of the fingers as they were highly highly unstable.

However as you’ve noted in the past “attacks get better with time” and it’s been three decades since I last had a professional interest in such things…

Clive Robinson • September 18, 2024 5:33 PM

@ Bob Paddock,

The SMD parts you refere to are fairly easily available in “finished items” such as used as precision firework igniters and for those launching multiple motor amateur rockets and the like.

Such things were once easily purchased on e-bay and the like.

But also remember, Bulgaria is a trading place where almost anything can be purchased at a reasonable price.

And it’s not the only ex-soviet influence zone state now in/on European eastern boarders that has such blind eye trading more or less freely happening.

Clive Robinson • September 18, 2024 6:25 PM

@ ALL,

The apparent use of Japanese manufacture Icom two way radios concerns me rather more than pagers.

As some have noted pagers are an old but useful technology. But… They have little or no residual value or worth, so they are unlikely to get passed on to others outside of the Lebanon’s administrative boarders or even outside their government / civil service.

However Icom two way radios have very high residual or second hand value.

Just one could be sold and get upto $500 resale price depending on which model.

Icom make two way radios to cover,

1, All “Private Mobile Radio”(PMR) bands used by all private security and even waitresses in pubs, clubs and eateries.

2, The VHF “air-band” used from para-gliders through to full size international airport staff.

3, VHF marine band equipment, used on just about every size of vessel from canoes up through the largest of oil tankers, platforms etc.

4, Ham / Amateur Radio for all the VHF and UHF bands and what some consider “low microwave”.

5, Guard Labour systems for Police and Military that has certain “communications security” aspects (as discussed in the past on this blog as ETSI backdoored it).

And more specialised uses.

Putting a bomb in those hand held radios is almost guaranteed to get them “circulating” in the hands of ordinary citizens in many countries including the West such as North America and Europe. As well as second and third world NGO’s etc.

In short the implanting is the hight of stupidity beyond any rational or civilised mind.

Even if never actively triggered all bombs are “unstable with time” and although they don’t have a predictable half life they do break down with time at a rate often depending on the environment. The only real question is how they break down…

Remember “blasting oil” was not safe untill “Dynamite” temporarily tamed it with clay. But dynamite “sweats” not just with temperature but other stressors including time. Thus the blasting oil comes out and is highly unstable again, and can easily act as a vibration sensitive detonator to the dynamite it is on plus any other “sticks” in close enough proximity.

Oh and just for fun, look up Victorian “Exploding Billiard Balls” it happens due to instability in nitro cellulose which over time becomes increasingly explosive…

https://www.smithsonianmag.com/smart-news/once-upon-time-exploding-billiard-balls-were-everyday-thing-180962751/

Just remember it was also used for piano keys as well, so a grand crescendo on a historic instrument could have a more explosive finish than either the pianist or audience expect…

Winter • September 19, 2024 1:28 AM

@JonKnowsNothing

Multiple supplier does not stop the NSA from intercepting equipment, because their intercept abilities are far far up the supply chain and their execution is coordinated with all mail and package carriers.

I have heard that trying to outsmart the NSA is futile. However, there are more threat actors with more limited means.

In this specific case, distributing appliances from a single shipment from a single supplier creates a single point of failure, or subversion, for the target.

I understand that to subvert a single shipment of a uniform appliance is already a major technical and logistic undertaking. The threat actors did it twice now. The devastation is maximal as it reached every significant Hezbollah operative in one go (or two).

By sourcing from multiple suppliers in multiple shipments, the costs and risks of discovery increase significantly while the probability that all targets are reached decreases.

MrC • September 19, 2024 3:41 AM

<

blockquote>

That’s a lot of collateral damage.

How do you know?

How many pagers went off?

<

blockquote>

The very small ratio of killed to injured (< 0.3%) suggests either a large number of very underpowered bombs, or a smaller number with a lot of collateral damage. One would assume that the IDF tested this plan on practice dummies and whatnot and would have had a fair idea how much explosive was needed to make the bombs lethal. Ergo, “a small number of bombs, with a lot of collateral damage” seems the most plausible explanation, ahead of “large number of bombs, and IDF was incompetent at making them lethal” and “a large number of bombs, and IDF purposefully made them mostly non-lethal.”

Setting aside the “wow, that was damned clever” aspect of this attack, this strikes me as certain to feed the cycle of blood and revenge.

wiredog • September 19, 2024 6:14 AM

NYT now reporting that BAC Consulting was an Israeli front.
https://www.nytimes.com/2024/09/18/world/middleeast/israel-exploding-pagers-hezbollah.html?unlocked_article_code=1.L04.YPfM.LN1jLI2DabV_&smid=url-share

By all appearances, B.A.C. Consulting was a Hungary-based company that was under contract to produce the devices on behalf of a Taiwanese company, Gold Apollo. In fact, it was part of an Israeli front, according to three intelligence officers briefed on the operation. They said at least two other shell companies were created as well to mask the real identities of the people creating the pagers: Israeli intelligence officers.

And apparently the walkie talkies used were counterfeit, so they were probably also built by the Israelis.

Winter • September 19, 2024 10:13 AM

Probably not really news anymore.

Note that circulating booby-trapped devices that are detonated without knowing who is in the blast area is likely a war-crime. [1]

Israel didn’t tamper with Hezbollah’s exploding pagers, it made them
Israeli spies are behind Hungarian firm BAC Consulting that supplied the devices, NYT reports; other shell companies mask ownership; Bulgaria probing another firm linked to saga
‘https://www.timesofisrael.com/israeli-spies-behind-hungarian-firm-that-was-linked-to-exploding-pagers-report/

A report Thursday alleged that a Hungarian firm that apparently supplied pagers used by Hezbollah was secretly set up by Israeli spies as part of a widescale operation that appeared to culminate this week when the devices exploded, killing several and maiming thousands of Hezbollah operatives and others in Lebanon and Syria.

It is not just Taiwan and Hungary that are involved, Bulgaria has entered too:

Bulgarian media reports alleged that a Sofia-based company called Norta Global Ltd had facilitated the sale of the pagers. Reuters was not immediately able to confirm the link to Norta, and company officials did not immediately respond to requests for comment. A lawyer that registered the company at an apartment block in Sofia did not respond to Reuters questions.

Selecting Hungary as the seat of the firm selling the pagers is an exquisite finishing touch as Hungaria’s strong man Viktor Orbán is not a friend of Israel or of people of the Jewish faith in general.[2]

About the exploding walkie-talkies:

Images of the exploded walkie-talkies showed labels bearing the name of Japanese radio communications and telephone company ICOM 6208.T and resembled the firm’s model IC-V82 device.

The company, which says it manufactures all of its radios in Japan, said Thursday the model was manufactured and shipped to the Middle East from 2004 to 2014, but had not been shipped by the company since then. It said batteries for the devices were also no longer being manufactured.

…

The company has previously warned about counterfeit versions of its devices circulating in the market, especially discontinued models.

[1] ‘https://theintercept.com/2024/09/19/israel-pager-walkie-talkie-attack-lebanon-war-crimes/

[2] ‘https://www.politico.eu/article/viktor-orban-anti-semitism-problem-hungary-jews/

Francis Mayer • September 19, 2024 12:35 PM

There are policy issues and liability risks for all companies involved. Notice how fast the Tiwan based company blamed their Hungarian partner who paid for the rights to use their branding on what they manufactured. LIABILITY for all companies in the supply chain is a serious risk because they failed to secure the supply chain and innocent people were seriously injured and died as a result. Lawyers can sue everyone on behalf of innocent victims. Children were hurt and killed and lawyers can easily sue and use discovery against all companies involved. International laws and local laws in Lebannon and the EU are relevant. Given how serious this is a class action lawsuit with a hefty settlement out of court is likely in my opinion. This event will be a wake up call to tighten up supply chains or face devastating law suits.

Clive Robinson • September 19, 2024 1:13 PM

@ Bruce, ALL,

Based on the limited information I have via MSM photos, all the equipment was designed a decade or so ago and importantly to use “standard” AA etc dry/alkaline cells, not Lithium cells.

That is the explosives were packaged in the devices not in the disposable batteries.

Further it is likely the funding for these devices came to Israel from the US. Thus we might expect some rather more “blunt talking” from US diplomats.

But importantly the use of booby-traped civilian objects in civilian areas is strictly prohibited, including objects most likely to be used for civil emergency personnel like doctors, medics, and other “First Responders” is contrary to international legislation the US and other Western states have been signatories to.

“Protocol on Prohibitions or Restrictions on the Use of Mines, Booby-Traps and
Other Devices as amended on 3 May 1996 (Protocol II to the 1980 Convention as
amended on 3 May 1996)
“

https://www.un.org/en/genocideprevention/documents/atrocity-crimes/Doc.40_CCW%20P-II%20as%20amended.pdf

See,

“Article 7 – Prohibitions on the use of booby-traps and other devices”

Subsections 1(a-e), 2 and 3.

All of which are about defining intentional genocide and related crimes against civilian populations.

There is also other international legislation that makes this a fist step “war crime”.

Clive Robinson • September 20, 2024 12:46 AM

@ JohKnowsNothing, Tatütata, and other usuall suspects,

With regards,

“In addition to the pagers, walkie-talkie devices are going off too.”

Whilst both a pager and a walkie-talkie are “receivers” thus can be signaled to.

1, Pagers generally only receive a single frequency or channel, and that is at all times.

2, Walkie-talkies on the other hand are more often than not multi-frequency in design having many frequencies or channels.

For instance the dirt cheap Baofeng UV5r systems that cover 136-174 MHz in the VHF bands and 400-520 MHz in the UHF bands with Frequency / Channel step sizes being 2.5-50kHz with around a 6kHz usable bandwidth. Give you over 20,000 channels any one of which might be used today or in this hour only.

Whilst the old Icoms have way less channels as an attacker you still do not know what channel is actively in use and by whom at any time of the day.

Thus sending a detonate command to pagers is relatively trivial as it’s on a single fixed channel. You can do it with an inexpensive drone a striped down UV5R and a “gum-stick” “Single Board Computer”(SBC) like a Raspberry Pi Zero W etc.

You simply set the TX channel to the standard frequency of the pager, load up one of many Open Source POCSAG programs to repeatedly loop the required FSK data through the UV5R TX audio. Then fly the drone up as high as it can go for just a few minutes at most, and “job done”.

Sending a detonate command to a group of walkie-talkie is a lot more involved however.

Firstly because analogue walkie-talkies unlike pagers generally do not have an “Over The Air”(OTA) digital interface you can send the detonate command to. This means you have to “build it in” to the walkie-talkie hardware and software.

Untill very recently most Walkie-talkies were in effect “Mask Programmed” not “Flash” (this is a new feature on HT’s like the new Quansgeng UV K5). So they could not be “up-graded”, however due to the popularity of Icom HT’s they have a high resale value and that has encouraged “China Knock-Off” fakes to be manufactured in China in large quantities and flash microcontrollers are now less expensive. So getting “the boards” un-programmed or with “added features” would be fairly easy these days and inexpensive if you were doing a reasonable production run of say 1,000 units. Getting the “hardware changes” to get RX audio into a data level for an input pin on the microcontroller chip would be a little harder but possibly not much. It actually might just need a single wire soldered on the PCB or couple of surface mount components “dead bugged, and hot glued down”.

The real problem is how good is the targets OpSec. If it’s fairly bad, or non existent as you might expect with an EmCom setup for “first responders” and other “civil authorities” then simple “scanning” days or weeks in advance will tell you all you need to know. But if your target is a little more switched on with their OpSec procedures you might not get any clue as to what channel frequency the targets walkie-talkie is on.

Clive Robinson • September 20, 2024 6:46 AM

Icom V82 HT Battery tear down

The Icom V82 walkie-talkie uses a couple of different battery packs that clip onto the back of it and also supply an anchor point for the belt clip. One such Icom battery pack was the BP-210, which has not been made in a very long time. As the cells inside only last a year or so changing the cells is more than just common, for some Ham Radio people it’s “just a necessity of the hobby”.

Due to the fact the V82 handset was not popular in Europe for various reasons and the battery packs were for that range of WT only getting images and other info has not been as easy as it might otherwise have been with say an Icom IC2E or similar.

However I’ve found a video of the Icom BP-210 Battery Pack being stripped down and you can see the internal construction around 6min 20sec in,

https://m.youtube.com/watch?v=IIpmKlpA0UQ

(Sorry it’s not in English as I said they were not really sold in English speaking countries).

As you can see when open the BP210 battery pack internally consists of six AA format Ni-MH rechargable cells (briefly visible written on cell at lower left).

So giving the ~7.2 to 7.5 volts that was fairly standard at the time for Icom HT units.

As some will know you can replace these low energy density and fairly short life cells with a couple of more modern Lithium “3 Volt” packs.

When upgrading other Icom Battery Packs in the past I used two of the battery packs from a Nintendo hand held because I had a hundred or so “to hand” as the Nintendo’s they had been shipped with had been “re-purposed” into Linux based Dual screen “front panel” units on 19″ rack audio equipment. It was about 1/15th the cost at the time to buy the Nintendo’s and re purpose them than to design a custom display unit. These days there are Linux based SBC PCB’s and displays that are even less and give “more bang”.

Peter A. • September 20, 2024 9:02 AM

@Clive Robinson: not sure about ICOM(-like?) 2-way radios, but the AR924 pagers were advertised as USB-charged, not using AA or AAA cells. So most likely using a non-replaceable battery.

My guess it the ‘brick’ Lithium batteries might be the way used to put the surprise stuff in, which could be fitted by making a thinner outer shell/lining or even putting a smaller battery inside a larger casing and using the remaining volume for surprise stuff. It is also easier to control it as a data connection to the battery management chip already exists. All it takes is to load crafted software on the device (both main CPU and the battery management chip) that detects a condition or receives a command and sends a signal to the battery chip to initiate stuff. Ignition current is available locally in copious amounts, no need to put extra wires or glue in extra spider circuit on the main PCB. Everything is hidden from sight even if someone opens the case to have a look, and nobody is going to open up the battery, everyone knows it can go highly energetic if one does 🙂

There were rumors, however, that the perpetrators had initiated the havoc earlier than planned, because they got wind of the receivers of the surprise packages discovering the extra stuff. That would force them to act now or never. If it’s true it would rather invalidate the battery hypothesis; it would be more likely that something was attached to the main PCB then.

Glitch • September 20, 2024 1:17 PM

This maybe just a coincidence, or a completely unrelated event but on “2024 16 Sep” one of the C32-B’s used as “covered air” [1] departed from Helsinki and landed on Panichero Airport in Bulgaria around 13:10 EEST [2]. Stayed there until 2024 18 Sep”.

There is a reference in MSM about a Bulgarian Company (Norta Global Ltd.) based in Sofia. Panichero is +-54 minutes from Sofia.

Note that the C-32B Gatekeeper is also used on clandestine operations.

As I said this maybe completely unrelated. Just dropping a datapoint.

[1] https://en.wikipedia.org/wiki/Boeing_C-32
[2] https://www.radarbox.com/data/mode-s/AE0449

RobertT • September 20, 2024 11:57 PM

Wow indeed, this is huge. 
It’s not a TV script; it’s real life, and they (whoever they are) planned and executed it to perfection. 
It wasn’t technically easy, and it certainly wasn’t logistically easy. Think about it; there are a thousand ways for this to go wrong, and probably only one path where you get the intended outcome.

A plot like this takes years to implement, so I think we’re all just seeing the alpha stage role out of a brand-new technology.  It completely changes the technology landscape for asymetric warfare. 

As I said, WOW! This is huge.

Alain • September 21, 2024 10:35 AM

mmmm

The low tech version is dead simple, very cheap and problematic to prevent.

Just send a parcel to a possible target or her/his children. Not for very high targets, but lots of people receive lots of parcels (e-commerce).

Alain

Clive Robinson • September 22, 2024 8:29 AM

@ ratwithahat,

With regards,

‘… the devices were impregnated with “heat-sensitive explosive”’

All chemical explosives are heat sensitive due to the fact they are basically “fuels” with in most cases an oxidizing agent linked at the molecular level.

Which means that they have an ‘igntion point’ but in most commercial and military explosives,

“They just burn and don’t go high order”[1].

[1] C4 and RDX explosives for instance burn with slightly higher energy output than Esbit and similar solid “Hexamine fuel tablets” readily available for pocket stoves and included in MRE style individual rations,

https://en.wikipedia.org/wiki/Hexamine_fuel_tablet

To get them to go “high order” needs a specific energy impulse you need an explosive chain/train for. That is usually found in certain types of detonator. Which usually have enough energy released to take your hand off if you were holding them.

Further consider the explosives that will go high order with just heat, most will detonate in just the heat of sufficiently strong sunlight as idiots making them have found.

So a pager or two way radio in a black plastic case if left on a window ledge would get hot enough…

So I’m thinking the person who wrote the article did not have sufficient knowledge and had been “spoon-fed” a made up story, or did not listen properly when given information.

Because if what is being claimed is true we would have expected some of the pagers or walkie-talkies to have gone off without a triggering signal days if not weeks/months beforehand and there is no sign in the press they did so.

JonKnowsNothing • September 23, 2024 11:06 PM

@ RobertT

re: planned and executed it to perfection

Not so, per some MSM reports.

It was long planned, but they had to Fast Track a number of aspects. Some MSM reports indicated that the target folks got a “hinky” feeling over the devices. Some may have reported up the channels about the “odd stuff”. The explosions were set off early before the word got out to ditch the devices.

Per other MSM reports, the detonate code did not get to all the devices. They maimed and injured a lot of folks, but not as many as originally intended.

An exploit is only good if it can complete the exploit.

Rhetorical Question:

  • Is it really perfection to intentionally maim thousands of people?

Anon Coward • September 24, 2024 8:40 AM

Who uses pagers? For one: defense contractors who work in secure/closed areas. Ask me how I know.

Bill Spurlin • September 24, 2024 10:45 AM

The exploding walky-talkies are supposed to have been the Icom V82 , a device discontinued in 2014 which uses a three-terminal recharging battery pack. What follows is based on the assumption that even if the V82’s are knockoffs, the interface between radio and battery pack (BP209 or BP210) has to be the same: positive, negative and thermistor. This simple interface is one-way: power out, and temperature out. The thermistor has a resistance around 10k ohms and thus requires a current on the order of 100 microamperes from the device.

What I am getting at of course is that there is no way of remotely triggering an explosive concealed in a battery for such a device. Just possible, in a knock-off, might be triggering by a sudden discharge overload. One could imagine other far-fetched triggering scenarios, but I consider the much simpler alternative to be more likely: a timer-based event. And if the radio batteries were set off that way, so were the pagers.

Batteries containing explosives and a timer; from the attacker’s standpoint a timer based event is much simpler and more secure:

  1. Standard devices can be attacked. No modifications required of device hardware or software.
  2. No compromise needed of the target’s pager transmitters.
  3. No need by the attacker to fly drones or create other custom transmitters.
  4. No need to test specially manufactured devices. The testing process is expensive, highly error-prone and, since it has to use simple RF techniques, easily detectable.

A problem with the above theory is that pagers that were turned off supposedly did not explode, requiring the attacker to have created an exploding battery that could sense if its device were turned on or not.

Please let me know if the BP209 or BP210 has a more complex interface than I have postulated.

Victor Serge • September 24, 2024 1:59 PM

@JonKnowsNothingSeptember 18, 2024 1:17 PM

General Hayden said smartphones were “warheads on foreheads”.

Making another reason to use shelf inside of a dish and use wired earbuds? Pinpoint the tower, less radiation, and protection from one of the dozens of implanted exploits.

Clive Robinson • September 25, 2024 3:58 AM

@ Bill Spurlin,

Re : Timers and battery packs

You say,

“No compromise needed of the target’s pager transmitters.”

As I indicated originally this was never an issue, and I guess you’ve not looked up how the pagers work at the “Over The Air”(OTA) interface.

A pager is a very-low power device originally designed back in the 1970’s and 1980’s to last a week or so running on a single dry cell using just transistors. As such they had a single channel usually VHF (upto around 160MHz) and just beeped when a simple signal came in. There was no security and any signal transmitted on the receiver frequency was considered valid by the pager.

Finding the receiver frequency just required a pager an oscilloscope or even just a volt meter and an RF signal generator. You open the pager up (yup they were easy to open for “repair”) then hookup the oscilloscope or volt meter to an appropriate point and then slowly sweep the signal generator untill it reaches the receiver frequency. This is indicated by either “detector output” on the scope, or increase in battery current shown on the voltmeter across a resistor etc.

Confirming this was done by using the sig generator effectively as a jammer. For my sins this is something I was doing with “borrowed” / stolen pagers back in the 1980’s as part of industrial espionage. A marks pager would get borrowed, enumerated, and returned in short order and they might not even realise it had gone missing.

The reason this could be done so easily was because there were no “chips” or “microcontrollers” at the time.

In the UK most people with nationwide pagers got used to the pagers going off twice or sometimes three times for a single page. The reason was the transmitters were arranged in what today we would consider a “cell structure” that was time multiplexed. So depending on where you were your pager might here two or more transmitters.

Even though the standard got augmented with technological improvements in time the “very-low power” device requirement remained the priority, and security did not.

Thus any transmitter on the pagers frequency that contained validy formatted signals would cause the pager to respond at some level.

If you are “shipping the pagers” you are probably the one “setting the receive frequency” so don’t even need to enumerate.

Which brings us to your next point,

“No need by the attacker to fly drones or create other custom transmitters.”

If the attackers are using the OTA interface and they very probably are, as I noted above they do not need very much transmitter power, heck 1watt at VHF is enough to be easily heard in “Low Earth Orbit”[1]. The real issue is coverage area or “radio horizon”. As I’ve pointed out before a drone as low as 300m will get you a coverage area large enough for a North West European nation or four.

But your hypothesis of,

“Batteries containing explosives and a timer; from the attacker’s standpoint a timer based event is much simpler and more secure”

Does not hold up, due to various factors.

The first is “battery chemistry” and “self discharge”. Rechargable batteries have a very bad self discharge rate, in some cases measured by as little as a couple of weeks. As a rough rule of thumb the more energy density you try to squeeze out of a particular battery chemistry the greater the self discharge rate.

So adding a timer in the supply chain will not work, for that reason alone.

But secondly for the attack to be successful the “future time” to have them explode is such an unknown there is no way you would consider it for this sort of operation as you completely loose control thus invite failure if not disaster from the get go[2].

But from the little information we do know based on what has been reported there was a control channel, due to the way the events not just played out but the time issues and not all devices going off.

I suspect that devices that have not exploded are now “rounded up” and being “forensically” investigated, some in other Nations by amongst others NGO’s that will make their information available for criminal proceedings.

Because as I noted this is not just a crime, but a war crime, and is actually considered not just under international genocide legislation but also a first strike of war and an illegal order.

The political fall out from this sort of thing has in the past started not just national wars, but regional and arguably world wars.

Even the maddest of governments are not going to just use “timers” nor are “military planners”. Even terrorists know it’s a bad idea to use a time bomb of more than a handful of hours[2].

[1] Whilst 1watt at VHF will get two way communication to a satellite in Low Earth Orbit reliably, a bit more will get you into one of the repeaters on the International Space Station. An experiment that is fun to show school kids, and depending on their age show them how to measure the doppler and from that work out some of the “Kepler Elements” orbital info,

https://en.m.wikipedia.org/wiki/Orbital_elements

It’s something I’ve been doing with Satellites since the mid 1970’s and wrote software for a mini-computer to track sats and plot their orbits on HP Graphics plotters and terminals in the 1980’s and provide “drive signals” for antenna systems.

If they are of highschool or above age showing them how to do it all with just H^2 = A^2 + B^2 and also work out Newton’s little equation gives some of them an appreciation of STEM that stays with them for life and gives them career opportunities they might not have otherwise had.

[2] Look up the “Brighton Bomb” the 40th anniversary of which is a couple of weeks away (12th Oct). It was where the IRA tried to kill UK Prime Minister Margaret Thatcher with 100lb of gelignite on a “long timer” that had been set 3weeks before in the hotel that She and most of the UK cabinate/ministers were staying for their party conference. And whilst it almost succeed, it was in many respects a failure in that it did not achieve the primary objective. However in other respects it was a turning or tipping point that went beyond politics and could not be ignored. You can read some of what happened in the words of Patrick MaGee who installed the bomb,
https://jacobin.com/2021/03/patrick-magee-brighton-bomber-ira-where-grieving-begins

On the personal side thar bomb in 1984 represented a turning point for me as well. I had reason to attend an electronics manufacturing conference and exhibition in Brighton just a few days later and the security was quite high (stable doors effect). I still remember “the walk” past the “Grand Hotel” and seeing it and smelling it in what was an unnatural erie sound for being on a UK South Coast beach front even in autumn. From that point on for reasons I have no idea as to why, my life was dogged by “the troubles on the mainland” and walking in Mary Axe, or traveling by train from Clapham Junction South East through Balham brings back memories of innocence lost and friends now long remembered.

But less well known is there was also another terrorist bomb that got down played by the MSM at the time. It exploded at the wrong time by 12hours. Such timer based bombs just do not work, for a multitude of reasons they are in effect uncontrollable as we can not see into the future even a very short distance and things change all to easily.

Clive Robinson • September 25, 2024 5:00 PM

@ Bruce, ALL,

Marketing lies to make hay

This “advert” for a “Global Walkie Talkie”,

https://m.youtube.com/shorts/aJqQbvwOFO4

Implies it won’t blow up like one of those devices in Lebanon that killed and maimed so many civilians…

The thing is the so called “global” walkie-talkies or push2tall and similar misleading named devices all need “SIMS” payed for from “traceable payments” because they are really “mobile phones” with “auto-answer” that more accurately report their position to the backbone so that connection appears to be faster.

Carrying one of these is just about the worst privacy and security mistake you can make (except for getting an Apple AI phone that tracks you and monitors you 100% of the time and even when turned off calls the Mothership via a BLE mesh network, yup newer iPhones are worse than iTags for privacy and stalking issues).

Leave a comment

All comments are now being held for moderation. For details, see this blog post.

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.