Risks beyond pagers: Do Hezbollah explosions reveal flaws in modern gadgets like phones, smartwatches, medical devices?

The recent explosions in Lebanon, allegedly triggered by explosive-laden pagers used by Hezbollah, have raised concerns about the broader security risks in everyday devices like smartwatches, earbuds, and medical devices such as pacemakers. According to reports by Reuters, Israel’s Mossad is believed to have planted explosives inside pagers ordered by Hezbollah, which resulted in nine deaths and thousands of injuries. These revelations have sparked a deeper conversation about how vulnerable other modern gadgets could be to tampering. Here’s what cybersecurity experts have to say.

Saket Modi, Co-Founder and CEO of Safe Security, explained that while pagers were a target in this case, other devices like smartwatches, earbuds, and medical equipment could be susceptible to similar vulnerabilities. However, the scale of such attacks would likely be limited due to the nature of the technology.

“Yes, pacemakers and insulin pumps have been identified to be vulnerable, not to explosion, but by attacking the Bluetooth Low Energy (BLE) telemetry services to disrupt the normal operation of these medical devices,” said Modi. “But most of these devices have short-range connectivity—with smartwatches as an exception—and therefore are highly likely to be exploited from close proximity and cannot be done at scale. A targeted attack, yes, but large-scale, no.”

This raises concerns about devices that rely on wireless connectivity, especially as the Internet of Things (IoT) expands to include more consumer and medical devices.

Vineet Kumar, Founder and Global President of CyberPeace Foundation, elaborated on the broader risks posed by the increasing prevalence of IoT devices. He noted that these devices, from smartphones and earbuds to medical devices like pacemakers, are becoming integral to daily life but come with significant security risks if tampered with.

“Variables and medical devices are also vulnerable. In fact, the Internet of Things (IoT) surrounds us, with IoT devices everywhere,” Kumar said. “Devices like smartphones, earbuds, and even healthcare devices like pacemakers use batteries and other electronic components that could be modified to contain malicious payloads.”

Kumar highlighted how pacemakers are especially high-stakes targets due to their vital role in controlling essential bodily functions. He cited a notable case from 2012, when the U.S. Vice President was reportedly targeted via his pacemaker, underscoring the potential for remote hacks on life-saving devices.

“There have already been warnings about the potential to remotely hack pacemakers,” he said. “While this is typically associated with data or performance manipulation, the inclusion of physical threats, such as explosive tampering, is possible if the supply chain is infiltrated.”

Nandakishore Harikumar, CEO and Founder of Technisanct, also stressed the importance of supply chain security, particularly when it comes to medical devices. He noted that while vulnerabilities similar to those found in pagers could exist in wearables and pacemakers, stricter scrutiny of medical devices may reduce the likelihood of such tampering going unnoticed.

“Similar vulnerabilities could exist in wearables and pacemakers, especially if sourced through unregulated supply chains,” Harikumar said. “However, due to their life-critical nature, medical devices like pacemakers undergo stricter scrutiny, which reduces the chances of such tampering going unnoticed.”

The emphasis on secure supply chains is crucial, given the growing complexity of connected devices and the increasing number of components that could potentially be modified or tampered with.

One question that arises is how tamper detection works in more advanced devices like smartphones, which could be equally vulnerable to similar attacks. According to Saket Modi, some smartphone manufacturers have implemented tamper detection mechanisms to safeguard against unauthorised modifications.

“Some smartphone manufacturers have tamper detection in place wherein if a counterfeit component is placed within the device, it shows a warning message,” Modi explained. “For example, if a counterfeit battery is used in an iPhone, it gives a notification for a few days and then shows the warning under the battery health page.”

He also pointed out that more advanced measures, like secure boot checks found in devices like Apple iPhones and Google Pixels, prevent the phone from loading its operating system if the firmware has been tampered with. “This could explain why the explosive inside the pager got detonated when a specific message was received,” Modi added.

However, Modi cautioned that not all manufacturers have such robust tamper detection in place. “Not all manufacturers have adequate tamper detection checks in place, so the risk is still there,” he warned.

The Hezbollah pager explosions have brought to light the importance of securing supply chains, especially for devices that play a critical role in personal health and safety. If tampering can occur at the manufacturing level, as it likely did with Hezbollah’s pagers, the consequences could be catastrophic for other high-risk devices, including medical implants and wearable technology.

“The inclusion of physical threats, like explosives, is possible if the supply chain is compromised,” Vineet Kumar reiterated. Experts agree that as IoT devices continue to proliferate, ensuring the security of these supply chains is becoming more critical than ever.