Lebanon pager attack: Can your technology be hacked remotely to cause physical harm?


  • English
  • Arabic

Live updates: Follow the latest on Israel-Gaza

Lebanon is reeling from deadly attacks that saw handheld communication devices detonate on Wednesday and thousands of pagers simultaneously explode to kill 12 people, including two children, and injure nearly 3,000 the day before.

Afterwards, concern grows over whether consumer electronics can be used to inflict physical harm on unsuspecting people. The short answer is, yes, it can be done – but the methods to actually do this are complex.

Without physical contact with the device, it is difficult to access the firmware – the software that manages the hardware – needed to manipulate physical parts such as a battery to make it overheat and possibly ignite.

Pagers, devices that can receive alphanumeric messages, were popular in the 1990s. While official verification of whether Israeli officials accessed Hezbollah pagers physically or accessed them en masse remotely is yet to be confirmed, Tuesday's attack shows that perpetrators are skilled enough to tap into older technology. This also raises questions about how much more damage can be done, particularly with higher-powered modern equipment.

Today, devices ranging from laptops to thermostats can be hacked remotely. Printers, for example, can have their ink heated enough to burn the paper inside them, or vehicle systems could be compromised to disable parts such as brakes. US consultancy Gartner in 2021 warned that cyber criminals would use operational technology environments to harm or kill humans in the next four years.

“In all these devices, there's a tiny, little computer there … [pagers] are kind of slow, but they're still computers,” Robert Graham, chief executive of Atlanta-based cyber security company Errata Security, told The National. “So whoever intercepted these would likely write their own software, change the software and put that on the devices, so that they would operate the same."

It is very difficult to remotely reprogramme the physical hardware of a battery to overheat to cause an explosion, Mr Graham said, and a phone battery would need to be fully charged to cause damage if triggered.

Picking targets

Smartphones, the most popular consumer electronic devices, are obvious candidates for an attack, but they are a costly option for potential attackers due to stringent measures taken by their makers.

Advanced technology has also contributed to preventing remote access, particularly within the top tier of smartphones from Apple and Google. Apps on devices from Samsung Electronics and Huawei Technologies “are known to often have a lot more bugs” than those from Apple and Google, Mr Graham said.

Mohamed Belarbi, chief executive of Abu Dhabi-based cyber security firm Cypherleak, agrees: the cost of hacking a well-made and secured device could be astronomical.

“When it comes to firmware, you need a lot of technical background and skills,” he told The National. You would have to be “able to bypass the security safeguards that are built in by the manufacturers.

"We've seen this before where the cost of hacking into an Apple iPhone could cost millions of dollars – now imagine multiplying that to access something as critical and as dangerous as blowing up a pager or blowing up a turbine.”

Yet for less protected or more flawed systems, everyday items can be used to hack into your devices. There is the humble data and power cable that can be bought on any e-commerce site such as Amazon, the most popular of which today is the USB-C. This simple connection has the ability to severely compromise a device.

“These things are becoming so sophisticated that today you can buy on the internet a USB-C cable that has a little computer embedded in the head of the cable,” Mr Belarbi said. This device can manipulate the physical components of technology to a desired, and in many cases malicious, effect.

Taking precautions

In the US, the FBI last year warned against using public charging points for electronic devices, saying they can be a gateway for cyber criminals. Charging stations in public spaces, including malls, hotels, restaurants and parks, have paved the way for “juice jacking”, which simply means using a USB connection to compromise a device.

“The moment you start using it to charge, the hacker is able to access your phone and to gather data. And this is quite common,” Mr Belarbi added.

Where technology is manufactured and who is involved in the supply chain can be risk factors, particularly in today's more globalised environment. For example, a lot of devices and their parts are sourced from China, which means there is a chance that the state or its actors might intervene, similar to the US government's backdoor access to online platforms, he said.

“I think it's just an inherent risk that we have to live with and [have to] determine what are we comfortable with and what are we not comfortable with.”

Another question that has been asked is why attacks using technology have not been seen in Gaza. One answer is that because a lot of the technology in Gaza is locally made, it is less accessible.

“They're able to communicate without interference from outside operators or actors,” Mr Belarbi said, unlike in the case of Israel's attack on Hezbollah, where radio waves could have been used to cause temporary interference.

“So you always see … the benefit, pros and cons of having your own technology. Yes, in terms of maturity and advancement, it might not catch up with whatever is out there commercially, but it definitely allows you to avoid a lot of the issues associated with technology tampering,” he added.

Manufacturers must adapt

“There's nothing you can do if a phone or device has been tampered with at the manufacturer or supply chain level before it reaches you,” Mr Belarbi said. “Because even if you open an iPhone or a Samsung, you wouldn't be able to tell.”

Manufacturers, especially the biggest ones, ensure a strict ecosystem in the components of their devices – but not all firms are built equally.

“We have companies that are ahead of the curve – Apple and Google ,” Mr Graham said. “Most electronic devices are behind the curve, and we can probably find the bug pretty easily, whereas Apple and Android are very, very tough.”

But the Lebanon incident also goes beyond being a wake-up call – it's a “stark reminder that our approach to supply-chain security needs a complete overhaul”, Andreas Hassellof, chief executive of Dubai-based technology company Ombori, told The National.

“We're facing a new breed of threats that blur the lines between digital and physical vulnerabilities,” he said, noting the previous advanced supply chain attacks on SolarWinds, NotPetya and SuperMicro. “The message is clear: adapt or become a target. Organisations clinging to outdated security models aren't just falling behind – they're inviting disaster.”

Global state-owned investor ranking by size

1.

United States

2.

China

3.

UAE

4.

Japan

5

Norway

6.

Canada

7.

Singapore

8.

Australia

9.

Saudi Arabia

10.

South Korea

RESULT

Bayer Leverkusen 2 Bayern Munich 4
Leverkusen:
 Alario (9'), Wirtz (89')
Bayern: Coman (27'), Goretzka (42'), Gnabry (45'), Lewandowski (66')

Tips for job-seekers
  • Do not submit your application through the Easy Apply button on LinkedIn. Employers receive between 600 and 800 replies for each job advert on the platform. If you are the right fit for a job, connect to a relevant person in the company on LinkedIn and send them a direct message.
  • Make sure you are an exact fit for the job advertised. If you are an HR manager with five years’ experience in retail and the job requires a similar candidate with five years’ experience in consumer, you should apply. But if you have no experience in HR, do not apply for the job.

David Mackenzie, founder of recruitment agency Mackenzie Jones Middle East

The National's picks

4.35pm: Tilal Al Khalediah
5.10pm: Continous
5.45pm: Raging Torrent
6.20pm: West Acre
7pm: Flood Zone
7.40pm: Straight No Chaser
8.15pm: Romantic Warrior
8.50pm: Calandogan
9.30pm: Forever Young

Sole survivors
  • Cecelia Crocker was on board Northwest Airlines Flight 255 in 1987 when it crashed in Detroit, killing 154 people, including her parents and brother. The plane had hit a light pole on take off
  • George Lamson Jr, from Minnesota, was on a Galaxy Airlines flight that crashed in Reno in 1985, killing 68 people. His entire seat was launched out of the plane
  • Bahia Bakari, then 12, survived when a Yemenia Airways flight crashed near the Comoros in 2009, killing 152. She was found clinging to wreckage after floating in the ocean for 13 hours.
  • Jim Polehinke was the co-pilot and sole survivor of a 2006 Comair flight that crashed in Lexington, Kentucky, killing 49.
The smuggler

Eldarir had arrived at JFK in January 2020 with three suitcases, containing goods he valued at $300, when he was directed to a search area.
Officers found 41 gold artefacts among the bags, including amulets from a funerary set which prepared the deceased for the afterlife.
Also found was a cartouche of a Ptolemaic king on a relief that was originally part of a royal building or temple. 
The largest single group of items found in Eldarir’s cases were 400 shabtis, or figurines.

Khouli conviction

Khouli smuggled items into the US by making false declarations to customs about the country of origin and value of the items.
According to Immigration and Customs Enforcement, he provided “false provenances which stated that [two] Egyptian antiquities were part of a collection assembled by Khouli's father in Israel in the 1960s” when in fact “Khouli acquired the Egyptian antiquities from other dealers”.
He was sentenced to one year of probation, six months of home confinement and 200 hours of community service in 2012 after admitting buying and smuggling Egyptian antiquities, including coffins, funerary boats and limestone figures.

For sale

A number of other items said to come from the collection of Ezeldeen Taha Eldarir are currently or recently for sale.
Their provenance is described in near identical terms as the British Museum shabti: bought from Salahaddin Sirmali, "authenticated and appraised" by Hossen Rashed, then imported to the US in 1948.

- An Egyptian Mummy mask dating from 700BC-30BC, is on offer for £11,807 ($15,275) online by a seller in Mexico

- A coffin lid dating back to 664BC-332BC was offered for sale by a Colorado-based art dealer, with a starting price of $65,000

- A shabti that was on sale through a Chicago-based coin dealer, dating from 1567BC-1085BC, is up for $1,950

What can victims do?

Always use only regulated platforms

Stop all transactions and communication on suspicion

Save all evidence (screenshots, chat logs, transaction IDs)

Report to local authorities

Warn others to prevent further harm

Courtesy: Crystal Intelligence

The%20specs
%3Cp%3E%3Cstrong%3EPowertrain%3A%20%3C%2Fstrong%3ESingle%20electric%20motor%0D%3Cbr%3E%3Cstrong%3EPower%3A%20%3C%2Fstrong%3E201hp%0D%3Cbr%3E%3Cstrong%3ETorque%3A%20%3C%2Fstrong%3E310Nm%0D%3Cbr%3E%3Cstrong%3ETransmission%3A%20%3C%2Fstrong%3ESingle-speed%20auto%0D%3Cbr%3E%3Cstrong%3EBattery%3A%20%3C%2Fstrong%3E53kWh%20lithium-ion%20battery%20pack%20(GS%20base%20model)%3B%2070kWh%20battery%20pack%20(GF)%0D%3Cbr%3E%3Cstrong%3ETouring%20range%3A%20%3C%2Fstrong%3E350km%20(GS)%3B%20480km%20(GF)%0D%3Cbr%3E%3Cstrong%3EPrice%3A%20%3C%2Fstrong%3EFrom%20Dh129%2C900%20(GS)%3B%20Dh149%2C000%20(GF)%0D%3Cbr%3E%3Cstrong%3EOn%20sale%3A%3C%2Fstrong%3E%20Now%3C%2Fp%3E%0A
In numbers: PKK’s money network in Europe

Germany: PKK collectors typically bring in $18 million in cash a year – amount has trebled since 2010

Revolutionary tax: Investigators say about $2 million a year raised from ‘tax collection’ around Marseille

Extortion: Gunman convicted in 2023 of demanding $10,000 from Kurdish businessman in Stockholm

Drug trade: PKK income claimed by Turkish anti-drugs force in 2024 to be as high as $500 million a year

Denmark: PKK one of two terrorist groups along with Iranian separatists ASMLA to raise “two-digit million amounts”

Contributions: Hundreds of euros expected from typical Kurdish families and thousands from business owners

TV channel: Kurdish Roj TV accounts frozen and went bankrupt after Denmark fined it more than $1 million over PKK links in 2013 

F1 The Movie

Starring: Brad Pitt, Damson Idris, Kerry Condon, Javier Bardem

Director: Joseph Kosinski

Rating: 4/5

SERIE A FIXTURES

Friday (UAE kick-off times)

Sassuolo v Bologna (11.45pm)

Saturday

Brescia v Torino (6pm)

Inter Milan v Verona (9pm)

Napoli v Genoa (11.45pm)

Sunday

Cagliari v Verona (3.30pm)

Udinese v SPAL (6pm)

Sampdoria v Atalanta (6pm)

Lazio v Lecce (6pm)

Parma v Roma (9pm)

Juventus v Milan (11.45pm)

 

Bridgerton%20season%20three%20-%20part%20one
%3Cp%3E%3Cstrong%3EDirectors%3A%20%3C%2Fstrong%3EVarious%3C%2Fp%3E%0A%3Cp%3E%3Cstrong%3EStarring%3A%3C%2Fstrong%3E%20Nicola%20Coughlan%2C%20Luke%20Newton%2C%20Jonathan%20Bailey%3C%2Fp%3E%0A%3Cp%3E%3Cstrong%3ERating%3A%20%3C%2Fstrong%3E3%2F5%3C%2Fp%3E%0A
Conflict, drought, famine

Estimates of the number of deaths caused by the famine range from 400,000 to 1 million, according to a document prepared for the UK House of Lords in 2024.
It has been claimed that the policies of the Ethiopian government, which took control after deposing Emperor Haile Selassie in a military-led revolution in 1974, contributed to the scale of the famine.
Dr Miriam Bradley, senior lecturer in humanitarian studies at the University of Manchester, has argued that, by the early 1980s, “several government policies combined to cause, rather than prevent, a famine which lasted from 1983 to 1985. Mengistu’s government imposed Stalinist-model agricultural policies involving forced collectivisation and villagisation [relocation of communities into planned villages].
The West became aware of the catastrophe through a series of BBC News reports by journalist Michael Buerk in October 1984 describing a “biblical famine” and containing graphic images of thousands of people, including children, facing starvation.

Band Aid

Bob Geldof, singer with the Irish rock group The Boomtown Rats, formed Band Aid in response to the horrific images shown in the news broadcasts.
With Midge Ure of the band Ultravox, he wrote the hit charity single Do They Know it’s Christmas in December 1984, featuring a string of high-profile musicians.
Following the single’s success, the idea to stage a rock concert evolved.
Live Aid was a series of simultaneous concerts that took place at Wembley Stadium in London, John F Kennedy Stadium in Philadelphia, the US, and at various other venues across the world.
The combined event was broadcast to an estimated worldwide audience of 1.5 billion.

Labour dispute

The insured employee may still file an ILOE claim even if a labour dispute is ongoing post termination, but the insurer may suspend or reject payment, until the courts resolve the dispute, especially if the reason for termination is contested. The outcome of the labour court proceedings can directly affect eligibility.


- Abdullah Ishnaneh, Partner, BSA Law 

COMPANY%20PROFILE
%3Cp%3E%3Cstrong%3EName%3A%20%3C%2Fstrong%3ESmartCrowd%0D%3Cbr%3E%3Cstrong%3EStarted%3A%20%3C%2Fstrong%3E2018%0D%3Cbr%3E%3Cstrong%3EFounder%3A%20%3C%2Fstrong%3ESiddiq%20Farid%20and%20Musfique%20Ahmed%0D%3Cbr%3E%3Cstrong%3EBased%3A%20%3C%2Fstrong%3EDubai%0D%3Cbr%3E%3Cstrong%3ESector%3A%20%3C%2Fstrong%3EFinTech%20%2F%20PropTech%0D%3Cbr%3E%3Cstrong%3EInitial%20investment%3A%20%3C%2Fstrong%3E%24650%2C000%0D%3Cbr%3E%3Cstrong%3ECurrent%20number%20of%20staff%3A%3C%2Fstrong%3E%2035%0D%3Cbr%3E%3Cstrong%3EInvestment%20stage%3A%20%3C%2Fstrong%3ESeries%20A%0D%3Cbr%3E%3Cstrong%3EInvestors%3A%20%3C%2Fstrong%3EVarious%20institutional%20investors%20and%20notable%20angel%20investors%20(500%20MENA%2C%20Shurooq%2C%20Mada%2C%20Seedstar%2C%20Tricap)%3C%2Fp%3E%0A
In numbers: China in Dubai

The number of Chinese people living in Dubai: An estimated 200,000

Number of Chinese people in International City: Almost 50,000

Daily visitors to Dragon Mart in 2018/19: 120,000

Daily visitors to Dragon Mart in 2010: 20,000

Percentage increase in visitors in eight years: 500 per cent

360Vuz PROFILE

Date started: January 2017
Founder: Khaled Zaatarah 
Based: Dubai and Los Angeles
Sector: Technology 
Size: 21 employees
Funding: $7 million 
Investors: Shorooq Partners, KBW Ventures, Vision Ventures, Hala Ventures, 500Startups, Plug and Play, Magnus Olsson, Samih Toukan, Jonathan Labin

The%20specs
%3Cp%3E%3Cstrong%3EEngine%3A%3C%2Fstrong%3E%201.8-litre%204-cyl%20turbo%0D%3Cbr%3E%3Cstrong%3EPower%3A%20%3C%2Fstrong%3E190hp%20at%205%2C200rpm%0D%3Cbr%3E%3Cstrong%3ETorque%3A%3C%2Fstrong%3E%20320Nm%20from%201%2C800-5%2C000rpm%0D%3Cbr%3E%3Cstrong%3ETransmission%3A%20%3C%2Fstrong%3ESeven-speed%20dual-clutch%20auto%0D%3Cbr%3E%3Cstrong%3EFuel%20consumption%3A%3C%2Fstrong%3E%206.7L%2F100km%0D%3Cbr%3E%3Cstrong%3EPrice%3A%3C%2Fstrong%3E%20From%20Dh111%2C195%0D%3Cbr%3E%3Cstrong%3EOn%20sale%3A%20%3C%2Fstrong%3ENow%3C%2Fp%3E%0A
The more serious side of specialty coffee

While the taste of beans and freshness of roast is paramount to the specialty coffee scene, so is sustainability and workers’ rights.

The bulk of genuine specialty coffee companies aim to improve on these elements in every stage of production via direct relationships with farmers. For instance, Mokha 1450 on Al Wasl Road strives to work predominantly with women-owned and -operated coffee organisations, including female farmers in the Sabree mountains of Yemen.

Because, as the boutique’s owner, Garfield Kerr, points out: “women represent over 90 per cent of the coffee value chain, but are woefully underrepresented in less than 10 per cent of ownership and management throughout the global coffee industry.”

One of the UAE’s largest suppliers of green (meaning not-yet-roasted) beans, Raw Coffee, is a founding member of the Partnership of Gender Equity, which aims to empower female coffee farmers and harvesters.

Also, globally, many companies have found the perfect way to recycle old coffee grounds: they create the perfect fertile soil in which to grow mushrooms. 

Updated: September 19, 2024, 10:48 AM`