Possible to trigger at battery explosions in pagers ?

[linux-works]

I had a 9volt ('transistor radio') battery blow up while sitting on my night table, once.  if I can find the photo I took of it, I'll post, but I heard it pop from the other room (so lucky I was not there in that room) and the part that was blown off was an electrode looking a LOT like a nail!

low current 9v battery.  not liion or anything.  just SITTING there.  I cant remember what the situation was.  I must have used it 'hard' but I dont know what that could have been.  they have a large-ish internal R so you cant use them 'hard'.  and yet, that thing literally blew and popped so loud I could hear it from 2 or 3 rooms away.

only once in my life did I ever see or have that happen.  so its clearly not frequent but its non-zero, also.

edit: found the photo.  that nail thing and the top were on the floor and it took me a while to find them.  the gold battery thing was still sitting on my night table, pointing up, iirc.  this was 2008 (as per the date on the photo)

[linux-works]

in terms of a modification of the units while they were en-route, the more I think about it, the more I now believe that a whole batch of units were 'manufactured' with the explosive and circuit already in it and when a shipment was to be made, a whole swap was made.

you cant just 'mod' 3000+ units on the fly.  that cant be done in scale even with state resources.

so you prepare identical ones that have your stuff in it and swap palettes at some ship point.

[tom66]

I like Mike's suggestion.

Create a contact in the device and set up a specific 'ring tone' - I assume the device has some way to associate different tones with different contacts or message priorities.   Perhaps name the contact something like " " (ASCII space character) so it is not visible in the normal system menus unless you are paying attention.

Then build some kind of device attached to either the piezo or within the battery that recognises this current pattern.

Clever, nearly impossible to detect, and easy to trigger all the devices at once, and it would require limited modification.

As for it being a war crime, yeah, probably because civilians are directly impacted by this.   So perhaps we should not be that impressed.   Still, pontificating on here will change anything about the conflicts in the middle east.  I'm reminded of the Onion's article from the future - "year 2200, the last remaining Israeli and the last remaining Palestinian are fighting to the death over one square kilometer in the nuclear wasteland that remains."

[mikeselectricstuff]

in terms of a modification of the units while they were en-route, the more I think about it, the more I now believe that a whole batch of units were 'manufactured' with the explosive and circuit already in it and when a shipment was to be made, a whole swap was made.

you cant just 'mod' 3000+ units on the fly.  that cant be done in scale even with state resources.

Unless all you need to do is swap the battery & update firmware, but yeah, with state resources, buying a duplicate batch isn't a big deal, though leaves some risk of traceability.

[tom66]

There are now reports that walkie-talkies have been exploding too - so whatever the IDF/Mossad have done is quite wide ranging.  Major supply chain attack, what else will they not be able to trust?

[ataradov]

It would be so interesting to get the hands on some unexploded samples.

It is also worth noting that this is essentially one time attack. Once it is used, the cover is blown. The decision to activate it must not be an easy one.

[MT]

In german news, there was a pretty detailed report on operations.
The pager in question (AR-924) were manufactured in Hungary (by company BAC) under the brand of a Taiwanese Company (Gold Apollo). They contained approximate 25-50grams of explosives.
It seems Israeli agents were able to intercept delivery from factory to Hizbollah and modify the pagers. This - of course - has not been officially confirmed.

A serious question is why is a factory in Europe manufacturing pagers for a proscribed terrorist organisation?
I suppose it could be a case of not knowing, but clearly the Israelis were aware.

its now said it was Israeli military front company, they have traced very strange and high money transfers to and from the Hungarian company (follow the money).

[nctnico]

I'm reminded of the Onion's article from the future - "year 2200, the last remaining Israeli and the last remaining Palestinian are fighting to the death over one square kilometer in the nuclear wasteland that remains."

Probably. And once they are done, there will be other people wanting to fight for that piece of land as has been the case for the last 5000 years.   

[madires]

There are now reports that walkie-talkies have been exploding too - so whatever the IDF/Mossad have done is quite wide ranging.  Major supply chain attack, what else will they not be able to trust?

First reports claim that the walkie-talkies were bought around the same time as the new pagers (five months ago).

[nctnico]

It would be so interesting to get the hands on some unexploded samples.

You rather than me. You know they are meant to blow up in your face? Better stay safe & clear unless you are an explosives expert with 10 complete fingers.

[Simon]

Oh well, I guess the next time we sign up for a download of a micro controller IDE we will find a declaration to fill out about dual use that include pagers

[Karel]

"Our hands-free pagers give you more bang for your buck."

[linux-works]

it could be that they were on to the trick and so the trick had limited lifetime.

that's actually plausible.

[linux-works]

how deep does this rabbit hole go?

ping address?

wake on lan?

date trigger?

anything electronic can probably hide custom 'chips' that do the dirtywork.

a few years ago, supermicro was suspected of creating a spy smd chip that looks like something innocent.

could it be that some state has developed explosives that sit in 14 pin dips (etc etc) and since they have access to the power rail.....  kaboom!

[linux-works]

and if you do use stock electronics and just insert your own firmware, you'd have to make it impervious to future firmware 'updates'.

just take the update, say 'thanks, user' and then dont apply it.  but store the version string.

a lot of effort.  but again, state resources.  and who knows how long it was in devel and planning.

[reboots]

I still think that replacing just the batteries with some battery and mostly explosive - and then a power rail watcher that looks for a signature power draw to trigger it was what they did.

it was funny that initial reports blamed the batteries and a pure software bug.  in 10 seconds of thought, that would not make sense at all, yet it was being said many times for the first few hours of the report.

I have to say this was genius. 

(and yes, it was well deserved and I'm happy it happened.  but that's all I'll say on that)

Agree that battery is a good place to put the explosive, and would make modification quick & easy.
Except batteries get replaced ( though,not very often), and it's hard to get a specific trigger signal to them.
There is a mention of them beeping several times first, so maybe they can do different beep/vibrate patterns in response to transmitted data, which the "battery" could recognise by pattern of current draw.
Maybe they had hacked firmware to do a specific current draw pattern on receipt of a particular message.

This would be an ingenious way of doing things. The vibrating motor would have a distinctive and relatively high current draw. But would these pagers have been shipped with the modified battery installed? Was it simply provided in the packaging, with the expectation that the user would install it? And what's the lifetime of a cut-down AAA cell in this application? Certainly not indefinite. I remember Motorola pagers would work for a long time on a single AAA, but five months seems like a gamble. Perhaps Israel was already under time pressure to use it or lose it.

[Bryn]

Honestly, the subject of exploding pagers sounds like a concept straight from a cheesy spy movie...

I also can't figure out how someone would be able to turn them all into bombs but with the latest technology, anything's possible...

My condolences to those that lost their lives to this incident, however

[mikeselectricstuff]

Another interesting thing is the large number of simultaneous activations - is the pager network even capable of broadcast/multicast?
AIUI the way these usually do power management is they synchronise with a fairly slow timebase from the infrastructure, so they know when to wake up to check for transmissions - maybe once per minute or so. I don't know if this is typically synced over the whole network, but seems likely to avoid pagers having to track changes  of local base-station. Pagers are usually receive-only, so all messages are broadcast to all locations.
I wonder if there maybe was also a compromise of the infrastructure to send a broadcast message, or possibly even a fake radio transmission spoofing the actual network - is there any report of how wide the affected area was ?

[linux-works]

text cant be slow to send, even if its direct and not multicast.

btw, since the pagers were 'messed with' there's no saying that it didn't have gps and a transmitter (lora?) inside, too.

thus, giving away a lot more.

maybe a mic, too.

when you control the supply chain, you win, it seems!

[madires]

Update on the walkie-talkies: Explosions linked to walkie-talkies kill at least 14 in fresh Lebanon attack (https://www.theguardian.com/world/2024/sep/18/explosions-linked-to-walkie-talkies-deaths-lebanon)

Supposedly the handhelds are ICOM IC-V82 (2m band). However, the IC-V82 is out of production for 15 years (https://rigpix.com/icom/icv82.htm).

Update: ICOM says that production ended in October 2014.

[Simon]

Another interesting thing is the large number of simultaneous activations

Hang on, where they simultaneous? I keep hawing this problem at work, we are a mechanical company and when they use words like instantaneous they are talking seconds, I think imperceptible to human perception. Same words mean different things to different people.

[tom66]

Another interesting thing is the large number of simultaneous activations - is the pager network even capable of broadcast/multicast?
AIUI the way these usually do power management is they synchronise with a fairly slow timebase from the infrastructure, so they know when to wake up to check for transmissions - maybe once per minute or so. I don't know if this is typically synced over the whole network, but seems likely to avoid pagers having to track changes  of local base-station. Pagers are usually receive-only, so all messages are broadcast to all locations.
I wonder if there maybe was also a compromise of the infrastructure to send a broadcast message, or possibly even a fake radio transmission spoofing the actual network - is there any report of how wide the affected area was ?

Realistically even if it was bulk SMS (or whatever equivalent is used) to all the pagers, the messages would arrive within around a minute of each other - the only exception might be for devices out of range of signal.  With the commotion in an attack like this, I doubt you need true synchronicity, a few minutes is fine, no one will put the puzzle pieces together until later.

An attack like this is worth more than the injuries and deaths caused to their enemy (and of course the collateral damage) - they've made it so the enemy can't trust their supply chain.  It'll disrupt their equipment availability for months.  Everything will be suspect, every laptop, drone, phone, pager etc. will need to be disassembled to check for tampering.

[linux-works]

remember the old screen saver about flying toasters?

well, dont plug in your toaster, either.

[mikeselectricstuff]

Another interesting thing is the large number of simultaneous activations

Hang on, where they simultaneous? I keep hawing this problem at work, we are a mechanical company and when they use words like instantaneous they are talking seconds, I think imperceptible to human perception. Same words mean different things to different people.

My point was not so much about how simultaneous, just the ability to send messages to thousands of pagers. Is this something that pager networks can typically do at all without inside access? AIUI  all messages are sent to all devices, so I'd think it would need some kind of broadcast capability to do this without overloading the network, or maybe some kind of out-of-band signal perhaps.

Or maybe they were just set to go off at a specific time & date, using the network as a source of long-term timekeeping

[nctnico]

Another interesting thing is the large number of simultaneous activations

Hang on, where they simultaneous? I keep hawing this problem at work, we are a mechanical company and when they use words like instantaneous they are talking seconds, I think imperceptible to human perception. Same words mean different things to different people.

My point was not so much about how simultaneous, just the ability to send messages to thousands of pagers. Is this something that pager networks can typically do at all without inside access? AIUI  all messages are sent to all devices, so I'd think it would need some kind of broadcast capability to do this without overloading the network, or maybe some kind of out-of-band signal perhaps.

As pagers are typically used to alert groups of people (like fire people), I would guess there is a way to send a broadcasted alert to many pagers. In the Netherlands the fire brigade is using the same make & model of the exploding pagers BTW.