Hezbollah pager explosions kill several people in Lebanon • Hacker News Board

Re: Hezbollah pager explosions kill several people in Lebanon

#391

Post by markus_zhang » Tue, Sep 17, 2024, 5:18 PM UTC

einszwei wrote: post #196

From Israel's perspective, this supply chain attack was undoubtedly a clever move, but I can't help but wonder about its long-term consequences. Although it was aimed at harming Israel's adversaries, third-party countries may now hesitate to involve Israel in their supply chains. There's also the risk that other major producers could replicate this tactic, potentially leading to further escalation in the region or be…

IMO, this gives IL's enemies more excuses to execute more horrible attacks. Considering pagers are civilian products and some of them might actually be delivered to non-Hez civilians, the consequence is pretty dire.

it basically says: we can do whatever we want because we can. Now imagine what the other side is going to reply.

Re: Hezbollah pager explosions kill several people in Lebanon

#392

Post by torginus » Tue, Sep 17, 2024, 5:19 PM UTC

some_random wrote: post #185

sbeam wrote: post #179

If we try to do what we are best at here at HN, let’s focus the discussion on the technical aspects of it. It immediately reminded me of Stuxnet, which also from a technical perspective was quite interesting. I already wonder if this was anything that was planted in the devices perviously, or if the ones responsible had similar devices, and managed reverse engineer them and craft a payload to them, that could be sent…

We can't really do much more than speculate right now, but it seems like the most likely answer is that a shipment of pagers was intercepted and implanted with explosives. Israel has done this before to assassinate a prominent bomb maker. https://en.wikipedia.org/wiki/Yahya_Ayyash#Assassination

TIL: pagers still exist.

I wonder, if these devices could be suspect, why don't they order these cheap Chinese GSM modules. You can't hide explosives in those.

Also, afaik all GSM modules broadcast their IMEI numbers over the network. Explosives or not, I'm sure they can all be tracked and triangulated, since they talk to the towers. I don't think these things are secure anyways.

Re: Hezbollah pager explosions kill several people in Lebanon

#393

Post by booleandilemma » Tue, Sep 17, 2024, 5:19 PM UTC

It reminds me of the movie Law Abiding Citizen.

Check it out if you haven't already: https://www.imdb.com/title/tt1197624/

Re: Hezbollah pager explosions kill several people in Lebanon

#394

Post by sandworm101 » Tue, Sep 17, 2024, 5:19 PM UTC

some_random wrote: post #185

sbeam wrote: post #179

If we try to do what we are best at here at HN, let’s focus the discussion on the technical aspects of it. It immediately reminded me of Stuxnet, which also from a technical perspective was quite interesting. I already wonder if this was anything that was planted in the devices perviously, or if the ones responsible had similar devices, and managed reverse engineer them and craft a payload to them, that could be sent…

We can't really do much more than speculate right now, but it seems like the most likely answer is that a shipment of pagers was intercepted and implanted with explosives. Israel has done this before to assassinate a prominent bomb maker. https://en.wikipedia.org/wiki/Yahya_Ayyash#Assassination

If an entire shipment was intercepted and modified, how many other pagers are out there? How many non-targeted persons are walking around with a bomb in their pocket?

Re: Hezbollah pager explosions kill several people in Lebanon

#395

Post by koolba » Tue, Sep 17, 2024, 5:19 PM UTC

mmastrac wrote: post #365

That's an impressive supply-chain hack. Spend years showing how insecure modern telecom devices are and scare your enemy into going old-school, receive-only. Set up a shell company to sell pagers to your enemy's shell company. Give them devices implanted with a small explosive charge pointed inward, knowing they will be worn around the waist most of the time. Hack the backend server, send a coordinated page to all th…

> Hack the backend server, send a coordinated page to all the pagers at the same time.

You likely don’t even need to hack anything if you coordinate based on time. A built in clock would eliminate the need for any external signal and work in a, no pun intended, dead zone.

If the pager itself is hacked, the software could also pretend to receive a page a moment before detonation to maximize the chance the device is held with the receiver in the open.

Re: Hezbollah pager explosions kill several people in Lebanon

#396

Post by ars » Tue, Sep 17, 2024, 5:20 PM UTC

netsharc wrote: post #39

It must be a combination of hardware (put a bomb in it) and software (trigger an explosion when a particular command is received) hack. Triggering an explosion of all devices is needed because if people started hearing about exploding pagers, they'd place their own far away from anything precious to them. Geez, I thought this kind of hack is the stuff of (bad) action movies. I wonder if there's a pager that was power…

I saw some videos of explosions, the pagers received some sort of signal or message that made the holder look at the pager.

Most of the injuries were to the hands or eyes. It was a very very weak explosion - even people right next to the person were not harmed, just the person holding the pager.

Re: Hezbollah pager explosions kill several people in Lebanon

#397

Post by maratumba » Tue, Sep 17, 2024, 5:20 PM UTC

Gives the term "remote code execution" a new meaning.

Re: Hezbollah pager explosions kill several people in Lebanon

#398

Post by kranke155 » Tue, Sep 17, 2024, 5:20 PM UTC

mmastrac wrote: post #365

That's an impressive supply-chain hack. Spend years showing how insecure modern telecom devices are and scare your enemy into going old-school, receive-only. Set up a shell company to sell pagers to your enemy's shell company. Give them devices implanted with a small explosive charge pointed inward, knowing they will be worn around the waist most of the time. Hack the backend server, send a coordinated page to all th…

Someone will eventually spill the beans on how it was done. They always do.

Re: Hezbollah pager explosions kill several people in Lebanon

#399

Post by markus_zhang » Tue, Sep 17, 2024, 5:21 PM UTC

barbazoo wrote: post #354

einszwei wrote: post #196

From Israel's perspective, this supply chain attack was undoubtedly a clever move, but I can't help but wonder about its long-term consequences. Although it was aimed at harming Israel's adversaries, third-party countries may now hesitate to involve Israel in their supply chains. There's also the risk that other major producers could replicate this tactic, potentially leading to further escalation in the region or be…

> From Israel's perspective, this supply chain attack was undoubtedly a clever move From The Guardian [1]: > Eight killed and 2,750 wounded Was that a clever move if you're killing "only" 8 potential adversaries? [1] https://www.theguardian.com/world/live/2024/sep/17/middle-ea...

I think the purpose is to terrorize your opponents. Sometimes getting seriously wounded is even worse than getting killed, from the perspective of Hez. Now they need to handle thousands of wounded members, which is much more expensive than dead ones.

Re: Hezbollah pager explosions kill several people in Lebanon

#400

Post by bawolff » Tue, Sep 17, 2024, 5:21 PM UTC

Cant help but be reminded of that james mickens article about the mossad vs not mossad threat model https://www.usenix.org/system/files/1401_08-12_mickens.pdf where he joking says that mossad will replace your cellphone with a blick of uranium (as a joke to imply you shouldnt worry about nation state actor type threats when building a stupid web app that nobody cares about, because its impossible)