A massive wave of pager explosions across Lebanon and Syria beginning at 3:30 pm local time today killed at least 11 people and injured more than 2,700, according to local officials. Many of the injured appear to be Hezbollah members, although a young girl is said to be among the dead.

Anonymous officials briefed on the matter are now describing it as a supply chain attack in which Israel was able to hide small amounts of explosives inside Taiwanese pagers shipped to Lebanon. The explosive was allegedly triggered by a small switch inside the pagers that would be activated upon receiving a specific code. Once that code was received, the pagers beeped for several seconds—and then detonated.

New York Times reporters captured the chaos of the striking scene in two anecdotes:

Ahmad Ayoud, a butcher from the Basta neighborhood in Beirut, said he was in his shop when he heard explosions. Then he saw a man in his 20s fall off a motorbike. He appeared to be bleeding. “We all thought he got wounded from random shooting,” Ayoud said. “Then a few minutes later we started hearing of other cases. All were carrying pagers.”

…

Residents of Beirut’s southern suburbs, where many of the explosions took place, reported seeing smoke coming from people’s pockets followed by a blast like a firework. Mohammed Awada, 52, was driving alongside one of the victims. “My son went crazy and started to scream when he saw the man’s hand flying away from him,” he said.

Video from the region already shows a device exploding in a supermarket checkout line, and pictures show numerous young men lying on the ground with large, bloody wounds on their upper legs and thighs.

The shocking—and novel—attack appears to have relied on a wave of recently imported Hezbollah pagers, according to reporting in The Wall Street Journal. (The group had already warned its members to avoid using cell phones due to both tracking and assassination concerns.)

According to the WSJ, a Hezbollah official speaking shortly after the attack speculated that “malware may have caused the devices to explode. The official said some people felt the pagers heat up and disposed of them before they burst.” The pagers in question allegedly have lithium-ion batteries, which sometimes ignite after first generating significant heat. (An early story from a local media outlet claimed that “the pager server was compromised, leading to the installation of a script that caused an overload. This likely resulted in the overheating of the lithium battery, which then exploded.”)

The WSJ quoted regional security analyst Michael Horowitz as suggesting the attack was likely caused by either 1) malware triggering the batteries to overheat/explode or 2) an actual explosive charge inserted in the devices at some point in the supply chain and then detonated remotely.

“Either way, this is a very sophisticated attack,” Horowitz told the WSJ. “Particularly if this is a physical breach, as this would mean Israel has access to the producer of those devices. This may be part of the message being sent here.”

Late in the day, US and other officials anonymously told the New York Times that the attack was, in fact, caused by explosives. Israel managed to insert “as little as one or two ounces” of explosive material next to the battery inside each pager, officials said. The pagers themselves were said to come from a company called Gold Apollo in Taiwan, though where and how the tampering was done both remain unclear.

Reuters has a similar report, using different sources, but it also notes that the president of Gold Apollo emphatically claimed today that the pagers were not made by his company in Taiwan. Rather, he said, they were made under license by a company called BAC, which then put Gold Apollo’s branding on them.

Hezbollah officials are also publicly blaming Israel, which has not taken responsibility, though it has been able to perform surprising electronic strikes, including the Stuxnet malware that damaged Iran’s nuclear program.

The Associated Press noted that Iran’s ambassador to Lebanon was also injured in the widespread attack.

The attacks follow shortly after an Israeli claim that Hezbollah had targeted one of its former senior defense officials—but that Israel had foiled the plan. According to Reuters, Israel “said it had seized an explosive device attached to a remote detonation system, using a mobile phone and a camera that Hezbollah had planned to operate from Lebanon.”

In today’s US State Department briefing, which you can watch here, spokesperson Matthew Miller was asked about the pager attacks. “The US was not involved in it,” he said. “The US was not aware of this incident in advance.” He said the US government is currently gathering more information on what happened.

This breaking news story has been rewritten to incorporate updates added throughout the day.

https://arstechnica.com/?p=2050337