Possible to trigger at battery explosions in pagers ?

[Bud]

And the pagers blew up around the country, so they must have found a way to send the trigger message using Hezbollah's transmitters infrastructure.  Or how could they transmit the trigger message over such a large area?

By using a programmed timer. No need to hack the infrastructure. The ICOM radios did not have a transmitting infrastructure, yet still blew up.

The ICOM radios had a receiver.  They could receive a broadcast transmission to detonate.  This broadcast signal could potentially be transmitted from an overhead Israeli drone.

This is a fantasy. Radios would need to be turned on and tuned to a specific frequency and specific operating mode. No reasonable attacker would rely on such vage conditions for a success.

[Andy Chee]

And the pagers blew up around the country, so they must have found a way to send the trigger message using Hezbollah's transmitters infrastructure.  Or how could they transmit the trigger message over such a large area?

By using a programmed timer. No need to hack the infrastructure. The ICOM radios did not have a transmitting infrastructure, yet still blew up.

The ICOM radios had a receiver.  They could receive a broadcast transmission to detonate.  This broadcast signal could potentially be transmitted from an overhead Israeli drone.

This is a fantasy. Radios would need to be turned on and tuned to a specific frequency and specific operating mode. No reasonable attacker would rely on such vage conditions for a success.

You want fantasy? How about simultaneous detonations of pagers across a city!

In practice, the rigged explosive batteries in the ICOM radios could have their own Israeli made decoders incorporated into their detonators.  Only the antenna and receiver front-end (prior to any tuning circuitry) is re-purposed from the radio.

[Bud]

You want fantasy? How about simultaneous detonations of pagers across a city!

I already told you - a timer activator circuit placed at the same time with the explosive charge.

In practice, the rigged explosive batteries in the ICOM radios could have their own Israeli made decoders incorporated into their detonators.  Only the antenna and receiver front-end (prior to any tuning circuitry) is re-purposed from the radio.

Too complicated and costly. Guess what, intelligence agencies also have limited budgets.

[radiolistener]

You can readily receive and collect all the messages. Even exploded pager would have a serial number, you can go back to the saved messages and retrieve the full history.

This way you don't need to know who owns individual ones before the capture, since that's harder logistically, assuming no supply chain attack.

yes, remote explode by device serial number looks like most easy way to control which one should explode.

It opens up some very interesting possibilities. Since everyone uses their phone to register accounts on the internet, the mafia could buy the iPhone serial number of anyone from tracking agencies and remotely cause it to explode. The news would report it as a random battery explosion, with no evidence that it was an intentional act.

This can work with any gadget...

The same is possible with modern electronically controlled cars. The mafia could remotely activate malicious code in the car's electronics, leading to a car accident and death, with no way to determine who caused it. The malicious code could erase all traces of its presence from the system's memory milliseconds before the car and its passengers are destroyed.

Too complicated and costly. Guess what, intelligence agencies also have limited budgets.

It's not complicated if such a circuit is added during the chip manufacturing process. However, the question is about adding explosives to the battery. If they were to include it in every device, it could be discovered by disassembling the battery of any given device. This could lead to serious reputational damage for the manufacturing company.

[Stray Electron]

will never again trust a cell phone, pager, walkie talkie or any other electronics device from now

Why? You just place in place screening procedures and may be proactively replace the batteries before use.

It would be really stupid to limit your communication options because of one incident. Imagine if US banned airplanes after 9/11.

   You seem to forget that that's exactly what the US did after 911. Every aircraft in the US was grounded for a number of days until the USG understood what had happened and found ways to (more or less) guarantee flying safety.

   Or do you really think that Hezbollah has the technical expertise and resources be able to figure out exactly how this was done and to find a way to guarantee that it or something very similar to it can never be done again?   

   And you are still ASSUMING that the explosives were a part of the batteries.  They may or may not have been but the next time, it's likely that they will be better incorporated.  Hell, there are moldable hard plastic explosives and if I were behind this operation I would make the entire case from an explosive material. And no, Hezbollah does not have bomb sniffing dogs!

[linux-works]

I've seen a pen-tester team get root access to a car just via wifi and bluetooth (it really blew us away when we got this info that someone who did not have source code access still got in).

but it takes extreme skill.  like, very extreme.  a small group of people who can do such things.  but still, we had some vulnerabilities and that's why we hired a pen test group.

[ataradov]

You seem to forget that that's exactly what the US did after 911.

I'm not forgetting that. I don't suggest they go to the same supplier to get more pagers immediately.

Or do you really think that Hezbollah has the technical expertise and resources be able to figure out exactly how this was done and to find a way to guarantee that it or something very similar to it can never be done again?

I don't know, but I would expect them to know enough. I'd expect them to be more familiar with explosives and ways to use them than an average person on this forum.

it's likely that they will be better incorporated.

This is why you need better screening procedures. It is a battle, you do your best and at some point the other side will run out of places to place the explosives.

I would not say "they should have seen this coming". Half the world got halted by the CrowdStrike screw up, and arguably they should have seen this coming as well. It is not always possible to see everything, but it is possible to improve your operating procedures based on the events that actually happened.

[radiolistener]

I've seen a pen-tester team get root access to a car just via wifi and bluetooth (it really blew us away when we got this info that someone who did not have source code access still got in).

Now think about what would happen if someone, remotely watching you through cameras via the internet, connects to your electric vehicle and unexpectedly issues a command to disable the brakes, accelerate to full speed, and turn the steering wheel toward an oncoming truck...

And even more, since the electric vehicle is equipped with cameras and radar systems scanning the surroundings, attackers could, during a regular software update via the internet, upload a small piece of malware to your car's computer. This malware could automatically activate and execute the specified actions upon detecting a dangerous situation on the road. As the driver, you would likely be unable to do anything to stop it.

We can go even further and imagine a situation where all the electric vehicles around you could receive malicious code that instructs them to automatically search for you through their cameras with face recognition and launch a hunt...

[Bud]

Too complicated and costly. Guess what, intelligence agencies also have limited budgets.

It's not complicated if such a circuit is added during the chip manufacturing process. However, the question is about adding explosives to the battery. If they were to include it in every device, it could be discovered by disassembling the battery of any given device. This could lead to serious reputational damage for the manufacturing company.

What chip manufacturing process you are talking about?! Production of that model of the handheld was terminated 10 years ago, including the batteries for it. Do you follow the story at all, Dude?

[SiliconWizard]

Now think about what would happen if someone, remotely watching you through cameras via the internet, connects to your electric vehicle and unexpectedly issues a command to disable the brakes, accelerate to full speed, and turn the steering wheel toward an oncoming truck...

And even more, since the electric vehicle is equipped with cameras and radar systems scanning the surroundings, attackers could, during a regular software update via the internet, upload a small piece of malware to your car's computer. This malware could automatically activate and execute the specified actions upon detecting a dangerous situation on the road. As the driver, you would likely be unable to do anything to stop it.

We can go even further and imagine a situation where all the electric vehicles around you could receive malicious code that instructs them to automatically search for you through their cameras with face recognition and launch a hunt...

As long as a vehicle contains the features that allow this, and is connected to some network, it's not a if, it's a when.

[vad]

The theory that small explosive charges were set off by a coded pager message has some major problems, in my opinion:

1) Explosives are easy to detect at airports with dogs and chemical analyzers. Why would Israeli security forces take such a big risk? The chances of one of thousands of pagers being caught over six months are just too high to gamble with.

2) If Hezbollah militants were the target, the plan simply didn’t work. Most victims only had minor burns and soft tissue injuries, with only a few fatalities reported out of thousands of pager users.

3) The explosions all happened within 10 minutes, but not at the same time. If the detonations were triggered by a coded pager message, why didn’t they go off simultaneously?

Using Occam’s razor, a simpler explanation makes more sense to me - thermal runaway of lithium batteries.

Here’s how it could have happened: the batteries had rigged BMS that caused a short circuit, and the batteries’ safety valves were probably disabled or clogged too. Also there wasn’t a trigger message - these explosions were on a timer. A variation of +/- 5 minutes over six months would approximately match the 20 ppm tolerance of a typical 32,768 Hz crystal. And the goal wasn’t to target users but to disrupt enemy communications by destroying their devices (pagers and later radios).

[NiHaoMike]

   What this really means is that ANY electronic device that is capable or receiving a signal in any form can now potentially be used to create a remote control bomb.  Think of all of your wi-fi, internet or radio connected devices such as your Atomic Clocks, routers, computers, solar system micro inverters, wi-fi connected refrigerators, GPSs, laptops, security cameras, etc etc etc and then think of the potential for any of them to be made into a bomb. Even large devices such as your automobile computers could potentially made into a remote control bomb and potentially very massive ones. The implications of these attacks are HUGE and not just for the Palestinians.  Just imagine that the Palestinian terrorists decide to convert a bunch of Wi-Fi routers into bombs and to sell to households in say France and then simultaneously detonate 10,000 of them at some point to make a political statement.

Just having the device "quietly" catch fire would do more damage than a little pop in most instances, without any explosive residue that could get detected. (See the Mythbusters where they set off a bullet outside of a gun.) And that has already happened many times in the past, as a result of defects and/or overzealous cost cutting.

[Buriedcode]

I'm frankly surprised that an organisation like that wouldn't check the supply chain - it seems to avoid the problems with cell phones, they opted for the old school pagers, but just bought them "bulk buy" and didn't do any background checking.  Thats a pretty careless move for an organisation that is worried about security enough to not use cell phones.

[SiliconWizard]

Not using cell phones if you want any kind of confidentiality is an obvious move that even a kid could figure out these days.
Conducting a thorough check of your supply chain is another thing. And maybe they had. There was probably no sign of anything doubtful.
The only thing odd in itself is that the alleged company behind this is "B.A.C.", based in Hungary. Buying anything critical from a company based in the EU and member of NATO, for these guys, was probably not the smartest move. It boggles the mind, even.

[EEVblog]

The theory that small explosive charges were set off by a coded pager message has some major problems, in my opinion:

1) Explosives are easy to detect at airports with dogs and chemical analyzers. Why would Israeli security forces take such a big risk? The chances of one of thousands of pagers being caught over six months are just too high to gamble with.

2) If Hezbollah militants were the target, the plan simply didn’t work. Most victims only had minor burns and soft tissue injuries, with only a few fatalities reported out of thousands of pager users.

3) The explosions all happened within 10 minutes, but not at the same time. If the detonations were triggered by a coded pager message, why didn’t they go off simultaneously?

Using Occam’s razor, a simpler explanation makes more sense to me - thermal runaway of lithium batteries.

Here’s how it could have happened: the batteries had rigged BMS that caused a short circuit, and the batteries’ safety valves were probably disabled or clogged too. Also there wasn’t a trigger message - these explosions were on a timer. A variation of +/- 5 minutes over six months would approximately match the 20 ppm tolerance of a typical 32,768 Hz crystal. And the goal wasn’t to target users but to disrupt enemy communications by destroying their devices (pagers and later radios).

No, it's all widely reported now exactly how it happened:

https://archive.md/kKDVy

[mikeselectricstuff]

The theory that small explosive charges were set off by a coded pager message has some major problems, in my opinion:

1) Explosives are easy to detect at airports with dogs and chemical analyzers. Why would Israeli security forces take such a big risk? The chances of one of thousands of pagers being caught over six months are just too high to gamble with.

Not if hermeticallly sealed in the way that, say, batteries are.

3) The explosions all happened within 10 minutes, but not at the same time. If the detonations were triggered by a coded pager message, why didn’t they go off simultaneously?

Network latency

Using Occam’s razor, a simpler explanation makes more sense to me - thermal runaway of lithium batteries.

They don't explode like that though using the batttery as an initiator could be plausible

[radiolistener]

1) Explosives are easy to detect at airports with dogs and chemical analyzers.

Not all explosives are detectable with usual detectors and dogs.

3) The explosions all happened within 10 minutes, but not at the same time. If the detonations were triggered by a coded pager message, why didn’t they go off simultaneously?

Sending a separate message to each pager takes some time, it cannot be done simultaneously because sending one message requires a certain amount of time.

Let's assume sending one message requires 0.2 seconds. Then, sending 5000 messages would take 16 minutes.

[Jeroen3]

The theory that small explosive charges were set off by a coded pager message has some major problems, in my opinion:

1) Explosives are easy to detect at airports with dogs and chemical analyzers. Why would Israeli security forces take such a big risk? The chances of one of thousands of pagers being caught over six months are just too high to gamble with.

2) If Hezbollah militants were the target, the plan simply didn’t work. Most victims only had minor burns and soft tissue injuries, with only a few fatalities reported out of thousands of pager users.

3) The explosions all happened within 10 minutes, but not at the same time. If the detonations were triggered by a coded pager message, why didn’t they go off simultaneously?

Using Occam’s razor, a simpler explanation makes more sense to me - thermal runaway of lithium batteries.

Here’s how it could have happened: the batteries had rigged BMS that caused a short circuit, and the batteries’ safety valves were probably disabled or clogged too. Also there wasn’t a trigger message - these explosions were on a timer. A variation of +/- 5 minutes over six months would approximately match the 20 ppm tolerance of a typical 32,768 Hz crystal. And the goal wasn’t to target users but to disrupt enemy communications by destroying their devices (pagers and later radios).

1) are cargo pallets scanned that thoroughly as well?
2) it did work, it put heavy load on services and exposed lack of trust in supply chain that needs addressing. Plus it disrupted communications for some time. Maybe even days.
3) Here in NL we have a cell broadcast emergency messages and these do not all trigger at the same time. Sometimes minutes later.

I would assume pagers get network time?

[tszaboo]

The theory that small explosive charges were set off by a coded pager message has some major problems, in my opinion:

1) Explosives are easy to detect at airports with dogs and chemical analyzers. Why would Israeli security forces take such a big risk? The chances of one of thousands of pagers being caught over six months are just too high to gamble with.

2) If Hezbollah militants were the target, the plan simply didn’t work. Most victims only had minor burns and soft tissue injuries, with only a few fatalities reported out of thousands of pager users.

3) The explosions all happened within 10 minutes, but not at the same time. If the detonations were triggered by a coded pager message, why didn’t they go off simultaneously?

Using Occam’s razor, a simpler explanation makes more sense to me - thermal runaway of lithium batteries.

Here’s how it could have happened: the batteries had rigged BMS that caused a short circuit, and the batteries’ safety valves were probably disabled or clogged too. Also there wasn’t a trigger message - these explosions were on a timer. A variation of +/- 5 minutes over six months would approximately match the 20 ppm tolerance of a typical 32,768 Hz crystal. And the goal wasn’t to target users but to disrupt enemy communications by destroying their devices (pagers and later radios).

1) are cargo pallets scanned that thoroughly as well?
2) it did work, it put heavy load on services and exposed lack of trust in supply chain that needs addressing. Plus it disrupted communications for some time. Maybe even days.
3) Here in NL we have a cell broadcast emergency messages and these do not all trigger at the same time. Sometimes minutes later.

I would assume pagers get network time?

Pagers work on a radio communication system separate from GSM/3G/4G. These ones are specifically:
https://www.cryptomuseum.com/covert/radio/apollo/ar924/

You normally cannot address them the same way as a phone. It's not as simple as sending an SMS. Or calling an API over the internet. Sending messages is typically you need VPN access, use obscure software on specific computers. Then there is a separate array of transmitters. There are broadcast messages in these systems, but it al depends on the specific settings they used. There is no encryption. The whole system could be guarded, and air gapped. Which would still be possible to access with people in key positions, but let's look further.

They also exploded CB radios. Those have limited range, 15-20 Km max. Unless they had many operatives simultaneously doing it in key positions, with tweaked radios, I find that very unlikely to be able to send messages.

So here is how you do it the simple way: You fly an https://en.wikipedia.org/wiki/EL/W-2085 on your border, and transmit whatever you want at whatever distance with phased array.

I find it disturbing that on an electronics forum, people are just guessing without a very basic understanding how these electronics devices are supposed to work, or even spending 5 minutes doing some research. Not you specifically. Occam's razor and such.

And BTW using the pager network for "secure communications" is so foolish. A child with an SDR can decode those messages.

[Xena E]

I find it disturbing that on an electronics forum, people are just guessing without a very basic understanding how these electronics devices are supposed to work,

Just so. Also the acceptance of whatever reports from news media as being facts, when most of it is just propaganda bullshit or fairy stories made up to increase viewers, listeners, or, readership.

[Jeroen3]

That's why it's good to ask questions. I knew they were a completely separate network, I did not know that don't talk back at all.
Apparently some networks do transmit time. I do not know if this is one did. (pages are from before my time)

The radio plane is an interesting possibility, I do know modern phased-array radars are capable of EW, but can they also generate these signals.

In the end it's about facts. And those are difficult on this subject.

[tszaboo]

That's why it's good to ask questions. I knew they were a completely separate network, I did not know that don't talk back at all.
Apparently some networks do transmit time. I do not know if this is one did. (pages are from before my time)

The radio plane is an interesting possibility, I do know modern phased-array radars are capable of EW, but can they also generate these signals.

In the end it's about facts. And those are difficult on this subject.

As I said, I'm not targeting you with that remark, don't take it personally.
I could say the same for the "experts" and "journalists" in general.
They ask the expert if it's possible to blow up a battery, they answer "Yes, but not with this much power and without modifications in a pager such as this." Next day headlines: Battery explosion possible in pagers. Also then they go ahead and publish causality figures coming from known terrorists organizations on face value. And now we started seeing news articles where the source is "Anonymous users on reddit claimed" 

The radio plane is an interesting possibility, I do know modern phased-array radars are capable of EW, but can they also generate these signals.
In the end it's about facts. And those are difficult on this subject.

The EW part on the plane is speculation from my part. I've read some technical report years ago, that some of these newer AWACS type planes didn't have dedicated radio, it was all part of the radar installation with phase arrays, and it makes sense. These planes are going to be able to transmit and receive with any communication protocol on any radio band, and the true capabilities are going to be closely guarded secrets.

[bd139]

1) Explosives are easy to detect at airports with dogs and chemical analyzers. Why would Israeli security forces take such a big risk? The chances of one of thousands of pagers being caught over six months are just too high to gamble with.

Worth noting here that the detection of explosives is quite difficulty for Hezbollah apparently due to the contamination of explosives literally everywhere inside a terrorist organisation. Funny that! 

[bd139]

I find it disturbing that on an electronics forum, people are just guessing without a very basic understanding how these electronics devices are supposed to work,

Just so. Also the acceptance of whatever reports from news media as being facts, when most of it is just propaganda bullshit or fairy stories made up to increase viewers, listeners, or, readership.

It's even worse. It's naive speculation. Someone sees a YouTube video with hackers then one with exploding batteries and extrapolates that to an outcome. The reason they extrapolated that is that level of thinking without any form of criticality or research but wanting to sound authoritative is the default state for 95% of the population. It's not like they don't have a suitable audience.

Fortunately it takes the same level of thinking to flip burgers. Mmmm burgers. I think I'll nip to my local employer of speculative psychics and get one for lunch.

[wn1fju]

Quote from Bud:  Guess what, intelligence agencies also have limited budgets.

If an intelligence agency really, really wants someone or something, money is the last thing they worry about.