Technical Device Details on the Pager Explosions in Lebanon
@September 17, 2024
As of Sept 17, 2024, over four-thousand pager-bombs have been remotely detonated in Lebanon. Here’s some specs on the Apollo AP-900, the presumably targeted device and its potential modifications.
This article focus solely on technical aspects
- Technical Device Details on the Pager Explosions in Lebanon
- Incorrect Information on Device Type
- Did the Battery Explode?
- Speculations on the Amount of Explosives Added
- Triggering the Explosive
- Hardware Wiring and Software Modifications
- AP-900 Device Information from Vendor
- Alphanumeric Pager (AP-900)– Product Description
- Additional Information
Left vendor picture of AP-900 pager, right unverified pictures of retrieved exploded devices.
Retrieved device pictures match the vendor’s picture on the left.
The AP-900 pager is manufactured by Gold Apollo Co., Ltd. A privately held company based in Taiwan that specializes in paging systems and communication devices.
Incorrect Information on Device Type
Some news media have circulated a Motorola pager model as affected device. However, we have not found pictures of exploded devices looking similar to the one shown below.
Did the Battery Explode?
It’s highly unlikely that the device’s AAA battery is the cause of the explosion
Given that the AP-900 runs on a single AAA battery, it’s highly unlikely that so many explosions could have been caused with such precision and timing. Even if all pagers ran on Lithium batteries, a small fire seems like worst-case scenario.
Thus, some sort of plastic explosive seems more likely to have been used, which required every single device in the delivery chain to be hand-prepped.
Some sort of plastic explosive seems more likely to have been used to achieve the effect seen on security footage
At 61.5g overall weight plus potentially an additional 12g for the AAA battery, an addition of a small amount of plastic explosives, detonator and potentially some more electronics was likely added in the order of around another dozen of grams.
Speculations on the Amount of Explosives Added
A blast of 40g of Semtex (~200kJ of undirected energy) is shown in the video below:
The explosive power of 12g of plastic explosives (RDX, C4, Semtex, …) is roughly 60 kJ.
A standard NATO 5.56x45mm round contains approximately 1.75 kJ of kinetic energy when fired.
Since the blast on the pager is likely much less shaped than that of a bullet, the resulting energy on the target is likely below firing a round at a person.
Triggering the Explosive
There are (at least) two possible scenarios on how the pagers could remotely have been detonated:
- A custom communications channel was added the the device, independent of the main functionality (device in device)
- The device’s native communication channels were used (parasite device)
Given the nature of the pager, it seems reasonable to assume that the pager’s antenna and (modified) firmware/software was used to set off the explosive. This would incur the least amount of hardware modifications needed and also results in lower likelihood of detection in case of a hardware inspection / X-ray.
If the pager’s own coms were indeed used, that would put the effective range to a maximum of approximately 100km (VHF) / 10km (UHF).
The detonation message could have been broadcast from the regular fixed tower network which means that the communications network must also have been compromised.
Alternatively, it could also have been sent by other means within pick-up range of pagers by e.g. planes, drones, satellites, …
It is not known if the devices were normally operated using encrypted or unencrypted communications. Unencrypted means that it’s relatively easy to inject messages regardless of any software modifications on the pager.
Hardware Wiring and Software Modifications
At this point we have no information on what software was used and how the primer required to ignite the charge was wired, but akin to how Stuxnet was reverse-engineered over the years, it seems natural to expect a broader and open engineering community to also attempt this in the pager case.
AP-900 Device Information from Vendor
Since the vendor website is currently rather busy here’s the information contained on
https://www.gapollo.com.tw/product/ap-900/ as retrieved on Sep 17 2024
The model description from the vendor page reads as follows
Alphanumeric Pager (AP-900)– Product Description
Additional Information
Apollo AP-900 User Manual: