4 ms·

These pagers were 100% a supply chain attack. Intercepted and modified with small explosives embedded in them or swapped the entire shipment out with ones with

by edm0nd 2y ago

These pagers were 100% a supply chain attack. Intercepted and modified with small explosives embedded in them or swapped the entire shipment out with ones with a small explosives in them. There is no possibility these explosions are from battery overloads via an exploit or firmware hack.

sroussey 2y ago
Likely, there are many many more of them out there, just did not fall into the dragnet of phone numbers that were set to activate.
- meaydinli 2y ago
  I'd guess anybody with a pager in that part of the world dumped theirs as soon as they heard what happened.
- s1artibartfast 2y ago
  How do you judge that likely? It seems just as possible if not more that it was a single lot purchased by Hezbollah for Hezbollah.
- londons_explore 2y ago
  I bet lots of people with that model of pager are now ripping them open to check for explosives. If we don't see pictures of unexploded ones, then I'd guess they were all triggered, and the only ones we might see are devices that were turned off at the time.
  - sroussey 2y ago
    Agreed. Will be interesting if there is a teardown or not.
barbazoo 2y ago
> These pagers were 100% a supply chain attack. What did you base that on though, 100% is pretty confident
- rdtsc 2y ago
  Batteries are not magic unknown technology. People who understand their chemistry can confidently say things like that.
  - barbazoo 2y ago
    Dunning-Kruger effect comes to mind again.
    - rdtsc 2y ago
      How do you mean? I am trying to understand what you're saying, it seems you mean that people on HN only _think_ they understand how battery technology works saying this is impossible, but in reality they have no idea, and it's trivial to make an explosive device like out of pager batteries?
    - deleted 2y ago
      [deleted]
- edm0nd 2y ago
  Simple logic and science. Batteries do not cause forceful explosions like we've seen today. These pagers were intercepted and implanted with explosives (or entire load swapped with pre-made malicious ones) and then allowed to continue on to their destination. Thus I can say with 100% confidence that this was a supply chain attack.
- efitz 2y ago
  Reuters is quoting experts, including lithium battery experts, saying that the explosions were inconsistent with an exploding battery: https://www.reuters.com/world/middle-east/what-we-know-so-far-about-deadly-pager-blasts-lebanon-2024-09-17 https://www.reuters.com/world/middle-east/what-we-know-so-fa...
- edm0nd 2y ago
  https://www.nytimes.com/2024/09/17/world/middleeast/israel-hezbollah-pagers-explosives.html https://www.nytimes.com/2024/09/17/world/middleeast/israel-h... In a surprise to no one except you
deleted 2y ago
[deleted]
spidersenses 2y ago
>or firmware hack. There's still the question of how the explosive capsule would have been triggered. It couldn't just explode at the first incoming call. There must be more to that.
- ajsnigrutin 2y ago
  The microcontrollers inside the pagers probably have a spare GPIO pin, so they'd just have to modify the software and attach the detonating electronics to that gpio pin. Since i'm supposedly "posting too fast", to answer the post below: > Just curious, is it possible to program the pins so that it triggers by wireless or satellite command? With that scale I don't think wireless is possible though. Technically it is, but requires additional electronics and antennas. It's much easier to just use the existing pager network and trigger when some specific message (or pager code) is detected. Paging networks are simple to implement.
  - tptacek 2y ago
    It seems pretty plausible that the actual supply chain attack here would have been Israel subbing out whole shipping crates of pagers for sabotaged devices Israel manufactured itself, which would allow for arbitrary complex designs.
    - markus_zhang 2y ago
      Maybe they bought a large quantity of pagers from the same supplier and modified beforehand? I think a few grams of high explosives is good enough.
  - markus_zhang 2y ago
    Just curious, is it possible to program the pins so that it triggers by wireless or satellite command? With that scale I don't think wireless is possible though.
    - londons_explore 2y ago

by edm0nd 2y ago

sroussey 2y ago

Likely, there are many many more of them out there, just did not fall into the dragnet of phone numbers that were set to activate.

meaydinli 2y ago
I'd guess anybody with a pager in that part of the world dumped theirs as soon as they heard what happened.
s1artibartfast 2y ago
How do you judge that likely? It seems just as possible if not more that it was a single lot purchased by Hezbollah for Hezbollah.
londons_explore 2y ago
I bet lots of people with that model of pager are now ripping them open to check for explosives. If we don't see pictures of unexploded ones, then I'd guess they were all triggered, and the only ones we might see are devices that were turned off at the time.
- sroussey 2y ago
  Agreed. Will be interesting if there is a teardown or not.

barbazoo 2y ago

> These pagers were 100% a supply chain attack. What did you base that on though, 100% is pretty confident

rdtsc 2y ago
Batteries are not magic unknown technology. People who understand their chemistry can confidently say things like that.
- barbazoo 2y ago
  Dunning-Kruger effect comes to mind again.
  - rdtsc 2y ago
    How do you mean? I am trying to understand what you're saying, it seems you mean that people on HN only _think_ they understand how battery technology works saying this is impossible, but in reality they have no idea, and it's trivial to make an explosive device like out of pager batteries?
  - deleted 2y ago
    [deleted]
edm0nd 2y ago
Simple logic and science. Batteries do not cause forceful explosions like we've seen today. These pagers were intercepted and implanted with explosives (or entire load swapped with pre-made malicious ones) and then allowed to continue on to their destination. Thus I can say with 100% confidence that this was a supply chain attack.
efitz 2y ago
Reuters is quoting experts, including lithium battery experts, saying that the explosions were inconsistent with an exploding battery: https://www.reuters.com/world/middle-east/what-we-know-so-far-about-deadly-pager-blasts-lebanon-2024-09-17 https://www.reuters.com/world/middle-east/what-we-know-so-fa...
edm0nd 2y ago
https://www.nytimes.com/2024/09/17/world/middleeast/israel-hezbollah-pagers-explosives.html https://www.nytimes.com/2024/09/17/world/middleeast/israel-h... In a surprise to no one except you

deleted 2y ago

[deleted]

spidersenses 2y ago

>or firmware hack. There's still the question of how the explosive capsule would have been triggered. It couldn't just explode at the first incoming call. There must be more to that.

ajsnigrutin 2y ago
The microcontrollers inside the pagers probably have a spare GPIO pin, so they'd just have to modify the software and attach the detonating electronics to that gpio pin. Since i'm supposedly "posting too fast", to answer the post below: > Just curious, is it possible to program the pins so that it triggers by wireless or satellite command? With that scale I don't think wireless is possible though. Technically it is, but requires additional electronics and antennas. It's much easier to just use the existing pager network and trigger when some specific message (or pager code) is detected. Paging networks are simple to implement.
- tptacek 2y ago
  It seems pretty plausible that the actual supply chain attack here would have been Israel subbing out whole shipping crates of pagers for sabotaged devices Israel manufactured itself, which would allow for arbitrary complex designs.
  - markus_zhang 2y ago
    Maybe they bought a large quantity of pagers from the same supplier and modified beforehand? I think a few grams of high explosives is good enough.
- markus_zhang 2y ago
  Just curious, is it possible to program the pins so that it triggers by wireless or satellite command? With that scale I don't think wireless is possible though.
  - londons_explore 2y ago