[论文解读] When Everyday Devices Become Weapons: A Closer Look at the Pager and Walkie-talkie Attacks

Pantha Protim Sarker, Upoma Das+5 more|ArXiv.org|Jan 29, 2025

Information and Cyber Security被引用 4

一句话总结

本论文分析黎巴嫩的寻呼机与对讲机攻击，详细描述硬件篡改、供应链脆弱性、远程触发以及对 CPS 与网络物理安全的广泛影响。

ABSTRACT

Battery-powered technologies like pagers and walkie-talkies have long been integral to civilian and military operations. However, the potential for such everyday devices to be weaponized has largely been underestimated in the realm of cybersecurity. In September 2024, Lebanon experienced a series of unprecedented, coordinated explosions triggered through compromised pagers and walkie-talkies, creating a new category of attack in the domain of cyber-physical warfare. This attack not only disrupted critical communication networks but also resulted in injuries, loss of life, and exposed significant national security vulnerabilities, prompting governments and organizations worldwide to reevaluate their cybersecurity frameworks. This article provides an in-depth investigation into the infamous Pager and Walkie-Talkie attacks, analyzing both technical and non-technical dimensions. Furthermore, the study extends its scope to explore vulnerabilities in other battery-powered infrastructures, such as battery management systems, highlighting their potential exploitation. Existing prevention and detection techniques are reviewed, with an emphasis on their limitations and the challenges they face in addressing emerging threats. Finally, the article discusses emerging methodologies, particularly focusing on the role of physical inspection, as a critical component of future security measures. This research aims to provide actionable insights to bolster the resilience of cyber-physical systems in an increasingly interconnected world.

研究动机与目标

• 调查日常电池供电设备在2024年黎巴嫩攻击中的武器化方式。
• 检查实现篡改与 covert 武器化的硬件层面脆弱性及供应链因素。
• 评估对更广泛的电池供电基础设施与网络物理安全防御的影响。
• 回顾现有的防护/检测方法并识别其在应对此类硬件威胁方面的局限性。
• 提出未来安全措施应强调物理检查与安全采购。

提出的方法

• 提供对寻呼机与对讲机体系结构及其在历史协议（POCSAG、FLEX；VHF/UHF 频段）中的运作的技术性概览。
• 使用空壳公司、许可计划与伪造 PCB 的供应链篡改过程进行分析，以实现设备修改。
• 解释可行的攻击方式，包括嵌入式爆炸物以及通过现有信令通道（CTCSS/DTMF）实现的远程触发。
• 综合证据以论证最可行的攻击情景并概述从修改到引爆的步骤。
• 从硬件安全的角度讨论供应链脆弱性、篡改与反向工程洞察。

Figure 1 : A brief overview of the pager and walkie-talkie attacks

实验结果

研究问题

• RQ1 哪些硬件和供应链脆弱性使寻呼机与对讲机攻击成为武器化的可能？
• RQ2 设备如何被修改，以及哪些机制实现了远程触发和爆炸物的部署？
• RQ3 对电池供电设备和网络物理系统安全的更广泛影响是什么？
• RQ4 在当前针对此类硬件攻击的防护与检测方法中存在哪些局限性？
• RQ5 未来防御策略中物理检查与安全采购应扮演何种角色？

主要发现

• 攻击利用隐藏在电池组中的爆炸物以及通过现有寻呼与信令通道实现的远程触发。
• 一个复杂的、由空壳公司与品牌许可构成的伪造供应链促进了篡改设备的分发。
• 远程触发很可能通过寻呼系统中的编码信号（或 CTSS/DTMF）来启动引爆，同时保持设备作为通信工具的外观与功能。
• 对讲机由于更大外形和电池数量，提供了比寻呼机更高的爆炸能力。
• 篡改包括对反向工程的利用与 Trojan 式能力的插入，同时保持对外功能以规避检测。
• 事件暴露了全球供应链的脆弱性，并引发对增强可追溯性与安全硬件实践的考量。

Figure 2 : Timeline of planning and execution of the walkie-talkie attacks in Lebanon