13 ms·
Turning Everyday Gadgets into Bombs Is a Bad Idea
- deleted 2y ago[deleted]
- exe34 2y agoit's too late for that. once an idea is born, it will be used.
- squillion 2y agoTrue, but condemning it as a war crime would do a lot to limit its use. Poison gas is also cheap and easy to deploy, but it’s rarely used because of the stigma.
- secstate 2y agoThis, and I wish the warnings in the article were the chief takeaway for the general public. These attacks have to be condemned internationally NOW. The use of the new weapons for the first time is a perfect time to discuss universal condemnation and agreements amongst at least state actors to never do it again.
- exe34 2y ago[flagged]
- 8note 2y agoThat and the condemnation and attacks to destroy said plants and such by the international community. These battery attacks are so easy that a disgruntled employee in China could kill thousands in the US though
- tmnvix 2y agoWe do have some success in regulating abhorrent uses of technology. See mustard gas and chemical weapons in general. Sure, some will persist, but it is preferable to not attempting to restrict such uses.
- exe34 2y agothese are quite unfocussed weapons though, and cause mass civilian casualties. blowing up pagers bought by terrorists to avoid using the cell network is the opposite of abhorrent use of technology. it's the use of technology to minimise civilian casualties. there's no other way ever devised that would drop 4000 terrorists in an urban environment with barely a handful of collateral damage.
- tmnvix 2y agoObviously, my use of the word 'abhorrent' is a subjective judgement, but ask yourself honestly, if Hezbollah had carried out exactly this type of attack on Israeli defence force personal and their associates, would this not be almost universally accepted as evidence that Hezbollah is a terrorist organisation?
- exe34 2y agoit's almost as if "terrorism" has a specific definition. a group trying to change a legitimate government's policy through violent means that inspire fear in the general population. if heznobollas had done it, yes, it would have been terrorism. they are a non-state actor that's been constantly firing rockets into a legitimate state for a year, and are using violence against a general population to attempt to change the policy of their legitimately elected government. it's precisely because it was done by a legitimate state defending its population, and in this case inflicting the damage on the very terrorists that sought the communication technology with minimal collateral damage that it's a legitimate weapon of war. words matter.
- 8note 2y agoState actor is an arbitrary definition, based on what states your own government recognizes. Hezbollah within Lebanon is the state, with more power than the recognized government. If they're using terrorist actions, those should also be considered legitimate
- 2y ago
- skylurk 2y agoSoon they'll have us dumping out water in the security lines.
- 01HNNWZ0MV43FF 2y agoSoon cars will be reporting their location to the manufacturers without consent
- htrp 2y ago> Our militaries wear uniforms, and our weapons of war are clearly marked as such because our societies operate on trust. As long as we don’t see uniformed soldiers marching through our streets, we can assume that the front lines of armed conflict are far from home. When enemies violate that trust, we call it terrorism, because we no longer feel safe around everyday people and objects.
- morkalork 2y agoToo bad militants don't really follow those same rules regarding uniforms etc. Trust was lost long ago, before even the first suicide bomber wearing civilian clothes set themselves off in a crowded market.
- r00fus 2y agoI think we could all agree that we shouldn't be sending billions of dollars to a country that uses the same tactics or worse than a militia. Of course, unless you think state-sponsored terrorism is a good thing, or that it actually works to "fight fire with fire" (hint: fighting fire with water is far more effective).
- loumaciel 2y agoIn this analogy, what is water in the real world?
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- waynecochran 2y agoSocial media is far more effective than a bomb. "tik-tok" ... "boom"
- deleted 2y ago[deleted]
- jdjfkrkcogk 2y agoI don't really get the premise, as if we didn't have suicide bombers in public places/transportation - we already live in a reality where stuff can just explode. Not to mention that it's a state of war, it's not some random attack, don't see why it's any scarier than getting hit by some random rocket.
- duncancarroll 2y agoYeah but this would be more widespread and harder to counter; imagine a major phone vendor is a victim of the supply-chain attack he's describing. Even if only say, a thousand people buy Android phones with bombs in them, if suddenly no one can trust anything with a battery in it, that is going to have a major impact on society. You don't even have to be proximal to the target, you can just swap a box of batteries at the factory a thousand miles away. Genuinely frightening if you ask me.
- dotancohen 2y agoThis was a shipment of pagers used on Hezbollah's private communications network - they have a parallel cellular network. And many videos show that civilians standing right next to the targets suffered no more than ringing ears. That said, there was an 8 year old girl killed in one of the explosions. That is a tragedy. But if this attack - that killed over a dozen militants (and in some Arabic telegram channels, possibly over 40 militants are being said) and injured 3000 more - prevents even one more attack like that which Hezbollah killed 12 Israeli children two months ago, then it was an astounding success.
- secstate 2y agoRead the article. Success by disrupting Hezbollah for a month or a year means nothing if you've effectively demonstrated to the world that ubiquitous technology can be weponized by robust non-state actors and triggered at random. Apart from the very well articulated point in the article, is the fact that they crippled Hezbollah, but everyone proximate to these attacks are much more likely to be polarized against Israel. Weponized batteries are not the answer to how to stop Hezbollah.
- runamuck 2y agoI feared a simple, pontificating thought piece from the title. The author, in fact, provides a technical deep dive onto how the engineers fabricated a battery bomb and discusses easy supply chain attacks. A fascinating and well researched blog post.
- jauntywundrkind 2y agoThis highlights the malicious, but most of the tech described is the far more mundane everyday aspect of what modern batteries are and how they work. Of the technical theory, like 5% or less is about "fabricat[ing] a battery bomb". Shading this as being a blog post about weapons is a deep misservice & actively deeply harmful to the author & discussion. It is about this weapons topic, I cannot deny, but 95% of the technical content is providing background contexts on what batteries are, how they are made: knowledgeable depth which again shows who Bunnie is & what Bunnie does. There's only a tiny semi-obvious bit of conjecture & malevolent device creation attached. 'Just point this transistor that way'. People who know their shit & can share are amazing, but I want to stress a care in emphasizing what is known & talked about here, because most of it is mundane as hell (we just didn't know it), and knowing it ought not be a risk or questionable in terms of motives. Focusing on the weapons part seems not the point of the article to me & shades a bad light/gives the wrong impression.
- edanm 2y agoI mean, the author of the piece gets to decide what to call it and what they believe it to be about. I don't think there's anything wrong with them deciding to frame this piece around that concept. This isn't some random submitter changing the title or something like that.
- simoncion 2y ago> Focusing on the weapons part seems not the point of the article to me & shades a bad light/gives the wrong impression. I'm not sure how you came to that conclusion if you carefully read the article. Here are the third and fourth paragraphs of the article, reproduced verbatim: > The reason we don’t see exploding battery attacks more often is not because it’s technically hard, it’s because the erosion of public trust in everyday things isn’t worth it. The current discourse around the potential reach of such explosive devices is clouded by the assumption that it’s technically difficult to implement and thus unlikely to find its way to our front door. > That assumption is wrong. It is both surprisingly easy to do, and could be nearly impossible to detect. After I read about the attack, it took half an hour to combine fairly common supply chain knowledge with Wikipedia queries to propose the mechanism detailed below. These two paragraphs explain that the article will seek to dispel the misconception that it would be difficult to create a fully-functional but booby-trapped lithium ion battery pack. The last sentence of the last paragraph explicitly states that the article will go on to describe a plausible mechanism for manufacturing a battery that is a functional battery and also a bomb. I get that some folks have a very strong opinion that talking about weapons of destruction is bad, bad, bad. But to shame folks for talking about the production of weapons of destruction when the stated goal of the article is to _talk about weapons of destruction_ is just plain fucked up.
- llsf 2y agoThis is concerning. As I am typing on a laptop with fingerprint reader, one could make that battery explode after successful identification. What a world...
- aaomidi 2y agoOne of the points I tried to make with this: https://news.ycombinator.com/item?id=41568670 https://news.ycombinator.com/item?id=41568670 The issue is that once you have a "democracy" doing this, and the world's largest military saying "yes, good, this was the right move". Then you've welcomed this new model of warfare. This is different from suicide bombings, which have been effectively universally condemned and are not an active strategy of any real military.
- giraffe_lady 2y agoWhen you started posting here did you ever think you'd see HN form a strong consensus in favor of terrorism tactics? I'm pretty harsh on the place but this caught even me by surprise.
- dotancohen 2y agoHow is this terror, when it very precisely targeted militants. These devices were for use by Hezbollah on their private communications network. One civilian (an 8 year old girl) dead is a tragedy, but considering that over a dozen militants (and maybe up to 40) have been eliminated, that is a civilian:militant ratio unrivaled in history. Note that these Hezbollah militants killed 12 Israeli children two months ago. So if one really cares about civilians, eliminated Hezbollah is probably in their interest.
- sifar 2y agoIf you gaze long into the abyss ....
- aaomidi 2y agoBecause, surprisingly, terrorists are also people who live around others who aren’t terrorists. A kid died in these attacks and hundreds of other random civilians have had life altering injuries because of it.
- dotancohen 2y ago
- TLRTLR 2y agoSomebody delete this if it’s inappropriate to ask, but if you had a software exploit where you could put the processor into a full power draw loop on the battery (so called halt and catch fire in the vernacular) the circuitry Buddy suggests could be significantly simplified?
- gmuslera 2y agoFrom there to cell/smartphones there is a (very) short step. Would you be forced to not have with you your cellphone in plane trips if just one event of that happens? Put them in a strong/safe box on trip? What about notebooks? What about only letting "approved" manufacturers with zero maintainability? What about places or events where you use some of those devices? Once you cross one line, a lot of them may follow.
- dave333 2y agoYou will rent a phone at the destination just like you rent a car. It will download your esim from the cloud based on your face.
- kkfx 2y agoThe real point are not "batteries transformed in bombs" but black boxes on sale. Hw must be open, sw must be public for public safety interests. Not only: visibility/accessibility must be a surveilled parameter, of course, we can't really see what's inside a CPU, if it respect or not the public open hw design, but any device clearly designed against visibility and repairability must be sanctioned.
- monkeyfun 2y agoExcellent point that strikes at the essence of this. Already there were valid concerns about hardware backdoors and tampering, and now with such a dramatic event... well I can't exactly say I expect any change, but I do greatly hope this could motivate more such hardware transparency. However, a counter-thought: When a shipment can simply be intercepted and parts quickly swapped out, and when the batteries are difficult to casually detect alteration-of, how far do we take transparency to feel safe-enough? Footage inside every cargo container? Even more aggressive anti-tampering packaging with hard to replicate seals? (Meant to be a very genuine question, if it sounds silly I'm just not very informed as to what good solutions would be.)
- kkfx 2y agoIt's not sufficient, of course, but it's still the best we can do now, not only for mere safety but also for innovation, interoperability. In such an open world there is little room to purposefully sell crap to sell after fixes for instance, and that's very bad for some business but very good for the society and for nature, much reducing waste. After a certain amount of evolution even swapping component became harder, because anything is really transparent enough you still have margins, but with higher risks than now and more important much bigger reputation damage, which hurt much in such society (remember the Internet Manifesto for reference). Beside that the guarantee does not exists in nature, but the likeliness of an event have a really big impact on our life.
- dredmorbius 2y agoEven open HW/SW requirements / standards don't protect against this. See Thompson's "Reflections on Trusting Trust": <https://dl.acm.org/doi/10.1145/358198.358210 https://dl.acm.org/doi/10.1145/358198.358210>. More recently, and very much part of the extant cybersecurity landscape are zero-day and backdoor vulnerabilities which are prevalent in both closed and open-source software.[1] And the typical end-use buyer is not equipped to audit code or even interpret audit assurances (e.g., some level of certification on a device). That might work for large-scale organisational buyers (corporations, national governments, major NGOs, militaries), but would challenge even many of these. TFA goes into depth on how HW characteristics already vary tremendously even within product lines and production runs, and firmware modifications could weaponise otherwise benign-seeming hardware. Open SW/HW might help, somewhat, but not against a motivated state-level or other advanced actor (e.g., major narco syndicate, independent militant organisations, and the like). The requirement is far from sufficient however. ________________________________ Notes: 1. I'm trying hard to not open that particular religious war, though my bias is that evidence tends to suggest F/OSS is more secure than closed source in general.
- PreInternet01 2y agoVery well-written analysis with factual support for three main points about this kind of attack: it's entirely feasible, it's cheap, and it's virtually undetectable. And the devastating effectiveness has just been live-demonstrated to an audience very interested in that kind of stuff. So, yeah, air travel is going to become, eh, a bit different, soon. Get those cellphones and laptops with removable batteries while they're still available (and ensure the packs are models you can easily buy at your destination), as anything battery-powered is going to be off-limits in both the cabin and the cargo hold as soon as the now-extremely-motivated international terrorist community gets around to downing the first, oh, three airliners or so?
- kjdkjdsfdsj 2y agoHave you never travelled before? Batteries have been subjected to different security measures forever.
- fsflover 2y ago> Thus, one could conceivably create a supply chain attack to put exploding batteries into everyday devices that is undetectable: the main control board is entirely unmodified; only a firmware change is needed to incorporate the trigger. It would pass every visual and electrical inspection. I've never encountered a more effective way to articulate the significance of FLOSS.
- Kirby64 2y agoOr - better firmware attestation. You don’t need open source implementations, and in fact that wouldn’t help you if anyone can replace the firmware. You need cryptographically signed firmware that cannot be changed without a root of trust signing it.
- fsflover 2y agoI trust the community verification of a signed firmware distributed over the Internet much more than a sealed box that nobody can change. Who knows if it's compromised? Truly independent parties may not be able to access the later for attestation.
- Kirby64 2y agoWho verifies the firmware? Consumers can't be expected to do this. But, having a centralized firmware verification that is checked is necessary to prevent modification. Private keys for signing must, necessarily, be closed source otherwise anyone could just sign firmware that can do... who knows what.
- secstate 2y agoGoddamn, that is a hideously well-reasoned article. Don't even worry about your phone. What about all the little things that have batteries in it. What's to stop a state actor from embedding minor explosives in our TV remotes, kitchen appliances, our goddamn inexpensive bluetooth headphones (ugh). Hell, any rechargeable cell on Amazon could be tampered with. I suspect there are technical issues with some of those applications, but I feel like I woke up in a different world after reading this article.
- kjdkjdsfdsj 2y agoWhat prevents a state actor to launch hundreds of ballistic missiles at you? Is this a threat? Sure, but I don't see how it's that different from other more direct explosive threats.
- dredmorbius 2y agoSeveral generations ago I saw a teardown of a then-current smartphone and marvelled that very little of the available space was electronics: most was battery. There's been a similar trend in laptops. More recent phones have switched this around somewhat, largely on account of the multi-component cameras which actually occupy much of the available space. But other than that, you could characterise the guts of a smartphone as largely being a battery with some electronics attached. And they're hardly the limit for miniturisation. An HN submission last week featured the world's smallest computer ... as of 2015, which is roughly the size of a grain of rice: <https://news.ycombinator.com/item?id=41547378 https://news.ycombinator.com/item?id=41547378> <https://ece.engin.umich.edu/stories/michigan-micro-mote-m3-makes-history-as-the-worlds-smallest-computer https://ece.engin.umich.edu/stories/michigan-micro-mote-m3-m...> The principle challenges with electronics this small is finding ways to power and interconnect them. The power problem largely solves itself if what you're distributing calls itself a battery. Heck, plenty of batteries already have management systems on them to deal with charging and thermal management, so an additional chip (perhaps concealed as a capacitor or resistor) isn't going to draw much attention. TFA mentions this: It turns out that almost every lithium polymer pack has a small circuit board embedded in it called the PCM or “protection circuit module”. It contains a microcontroller, often in a “TSSOP-8” package, and at least one or more large transistors capable of handling the current capacity of the battery. So now you have to distinguish benign vs. malignant circuits. Any explosive / weapons payload is probably a larger concern. That might be explosive as used recently, or potentially a chemical, biological, or radiation mechanism. Again, TFA details how that could be incorporated into the battery layers themselves, alternatively they might be an additional package within a battery. Cylindrical cells in particular could conceal shaped charges. And those batteries could go into anything. Phones, walkie-talkies, baby monitors, electric toothbrushes (shaped charge, consider the possibilities), flashlights (handheld or strapped to a head, either would cause considerable or lethal harm). Or all manner of technical, professional, and/or military hardware, some of which might have far larger batteries as part of various components, which of co-opted could have significant effects. I'm pretty sure that RU and UA are taking copious notes presently, if not other parties.
- Ekaros 2y agoTime to ban all gadgets from airplanes and public places. Transporting them should be only allowed in enclosed explosion proof containers that are welded shut.
- lintkw 2y ago[dead]