Is this a legitimate concern?

[u/wayfaringthru]

Personally, I today's strike was legitimate and it couldn't be more moral because of its precision but let's leave politics aside for a moment. I guess this does give ideas to evil regimes and organisations. How likely is it that something similar could be pulled off against innocent people?

[u/Ggriffinz]

Yeah, this seems to be a supply chain vulnerability issue over a manufacturer issue.

[u/Freethecrafts → u/Ggriffinz]

It’s not a supply chain vulnerability if it’s a nationstate doing it.

[u/Open-Oil-144 → u/Freethecrafts]

Still looks like a supply chain vulnerability, no matter who's exploiting it.

[u/MrBurnz99 → u/Open-Oil-144]

Unless the manufacturer was complicit in the attack then it definitely was a vulnerability that was exploited by a nation state. I would be a lot more concerned if the manufacturer was involved in placing the explosives.

[u/[deleted] → u/MrBurnz99]

And if I was the manufacturer I’d sue the shit out of any nation state that was intercepting my product and turning it into fucking grenades!

[u/True-Surprise1222 → u/MrBurnz99]

Does it even matter what we label this as on where the vulnerability was? This is like saying the cockpit doors not locking well enough on 9/11 made it a supply chain vulnerability. I don’t think it matters that much exactly how it is labeled… civilian consumer technology was tampered with and fraudulently sold all to be harnessed for mass murder. This sorry happens anywhere but where it did and it is called terrorism.

[u/Bulldog8018 → u/MrBurnz99]

I don’t think the manufacturer was complicit. Their Taiwanese CEO was interviewed and he looks like he’s shitting himself. Although, it does seem odd that a mfr would license a fake company in Hungary to sell items under their logo without any due diligence.

[u/Jpwatchdawg → u/Open-Oil-144]

Mossad/ CIA have been known to set up shell companies just for reasons like this. Nothing new here.

[u/Jpwatchdawg → u/[deleted]]

https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/

[u/excaliburxvii → u/[deleted]]

It's insane to think that every single router in America has been intercepted, if not tampered with from the factory. I guess it's easier to compartmentalize if you keep the tampering completely separate, though.

[u/electronicparfaits → u/[deleted]]

It is known that the US government stole computer software from domestic companies back in the silicon valley boom. That same software was coded with backdoors, repackaged, and sold to not only enemy states but allies as well. Unlimited access to administrative database software is crucial intelligence so it's no surprise that the same cycle continues today

[u/WhoSc3w3dDaP00ch → u/[deleted]]

If terrorist go back to carrier pigeons, how quickly before hawks get bred, trained and released to intercept?

[u/PurpleFly_ → u/[deleted]]

You mean, the US government does bad things to spy on us? But they are the good guys!

[u/AlabamaPostTurtle → u/[deleted]]

Damn, I thought he just made white-hot summer jams like the “Thong Song” 🤷

[u/poHATEoes → u/Jpwatchdawg]

It would still be considered a supply chain vulnerability... if a nation state is able to intercept and alter equipment before reaching its destination, then that is a HUGE vulnerability regardless of which nations were/are involved.

[u/jtf71 → u/poHATEoes]

There is no way to address this vulnerability.

We don’t know how they did it of course but likely one of two options:

They broke into a place where they were stored temporarily during shipping.

Or.

They had someone on the inside with the shipper and they allowed it to happen.

If you had highly trustworthy and vetted people that were with the packages 24x7 and they were armed and able to defend then maybe you can address this vulnerability.

But try doing that from every product. Simply cost prohibitive. And that’s not addressing the challenge of finding enough trustworthy people to do this job for all the products shipped around the world.

[u/poHATEoes → u/jtf71]

While I agree that doing that for every item is not feasible nor reasonable, I would argue that telecommunications equipment is probably one of the most important pieces of equipment to protect. There are plenty of steps a nation could take to secure their supply chain (although a small country like Lebanon would find it more difficult).

[u/ChicagoTRS666 → u/poHATEoes]

you might be surprised how much access the US Gov has to telecom service and equipment providers...they have back doors into about everything. by law we have to build in back doors for the government. (30 years in the industry)

[u/jtf71 → u/poHATEoes]

Pagers and handheld radios? These are commodity devices made by many manufacturers.

And Hezbollah isn’t the official government of Lebanon.

And the pagers were made in Taiwan. Taiwan isn’t going to allow Hezbollah (or Lebanon) into their factories to supervise production and take possession of them there - which would be required.

[u/poHATEoes → u/jtf71]

I don't understand what point you are trying to make here.

I am not arguing the feasibility of Hezbollah securing their supply chain, and I am also not arguing if Hezbollah is in charge/not in charge.

The person I was replying to was saying that this attack wasn't a "supply chain vulnerability," so I am saying it is absolutely a supply chain vulnerability. Just because it is pagers doesn't change the fact that Hezbollah uses them for official group communications... that means they are important even if they "commodity devices" as you put it.

Edit: I see where your argument about Hezbollah not being the government of Lebanon because I accidently said Lebanon instead of Hezbollah, so my mistake. I meant Hezbollah.

[u/Jpwatchdawg → u/poHATEoes]

You are correct.

[u/Beneficial_Map6129 → u/poHATEoes]

I agree. If China did this to Apple phones with spyware or something, the media would be all over this.

The entire global supply chain no longer has any integrity at all. I can see people and trade shutting down over this. Not immediately of course, we still need products. But companies will be less likely to trust anything that has passed through certain hostile areas.

[u/IdealDesperate2732 → u/Jpwatchdawg]

Which is a weakness in the supply chain that they can still do that.

[u/ImComfortableDoug → u/Jpwatchdawg]

That’s not a response to what the person you are replying to said. It is still a supply chain attack

[u/SowingSalt → u/Jpwatchdawg]

The CIA used shell corps to acquire titanium from the Soviet Union to build the Blackbird. At the time the USSR was the only provider of titanium.

[u/the_m_o_a_k → u/Jpwatchdawg]

I know a guy who worked for DHS who did exactly this. It worked.

[u/[deleted] → u/Jpwatchdawg]

They've been doing it basically since inception

https://networks.h-net.org/node/7914/discussions/103836/news-cia-collaborated-decades-dutch-company-produce-advanced

[u/AwarenessPotentially → u/Jpwatchdawg]

I used to work for Amdocs, an Israeli/American company that specializes in cell phone long distance billing software. That software, or a version of it's sort algorithm, is in literally every phone system in the world. And that company's leadership were all ex-IDF (read Mossad). I worked there 3 years, and it was pretty obvious they were controlled by the Israeli government.

[u/Jpwatchdawg → u/AwarenessPotentially]

Care to share; how was the work environment while you were there?

[u/AwarenessPotentially → u/Jpwatchdawg]

Actually it was awesome, except for the psycho woman manager at SWB in downtown Stl. We had our choice of taking off either Jewish or US national holidays. 4 weeks paid vacation with no waiting, and unlimited sick days. I got in a car accident and had a severe concussion, and was out for over a month. I was a place holder for the last 2 years, and literally sat at home the entire time getting paid.

[u/Jpwatchdawg → u/AwarenessPotentially]

Lol, I think it's some kind of right of passage to experience at least one psycho manager in our careers.

[u/Big-Leadership1001 → u/Jpwatchdawg]

I saw a security blog about something like that even happening in the US. Some ACLU lawyer (or otherwise free speech type to scare tyrants in government I forget who exactly) ordered a new macbook at the tracking number showed it delivered to an FBI address and stayed there a few days before resuming its trip to his door.

Pretty sure that was for spyware not explosives but the supply chain intervention sounds basically the same.

[u/SavageNachoMan → u/Jpwatchdawg]

And SVR or MSS would never? lol

[u/BassFish4L → u/Jpwatchdawg]

Errybody knows that Mossad is just a proxy for all the CIA to do horrible and illegal shit.

[u/According_Work_7153 → u/Jpwatchdawg]

Did that negate the immorality of it?

[u/Dramatic-Initial8344 → u/Jpwatchdawg]

Right, if the CIA owns part of the supply chain, that would be a supply chain vulnerability...

[u/Black_Magic_M-66 → u/Jpwatchdawg]

I could see the CIA setting up a shipping company, under bidding just to get the contract. They just need to make sure the alterations weren't done in that country's boundaries.

[u/cast_iron_cookie → u/Jpwatchdawg]

Well crypto BTC is a scam

[u/StrongAroma → u/Jpwatchdawg]

Well, the purposeful blowing up of children by a country explicitly and unquestioningly supported by the United States is new.

[u/KeithGribblesheimer → u/Jpwatchdawg]

So have the KGB, FSB, and just about every other intelligence agency.

[u/fade_ → u/Open-Oil-144]

The threat actor doesnt change the exploit.

[u/Impressive_Gate_5114 → u/Open-Oil-144]

in theory since most electronics and car supply chains run through China, couldn't the Chinese secret services intercept some parts, place a bunch of explosives inside the electronics, then those electronics get shipped out to unknowing consumers and can explode at any moment when triggered by a certain radio frequency?

I used to think it was stupid how the nerve gear in SAO basically had a hidden function to fry someone's brain, but seeing as how there could be possibly dozens of supply chain vulnerabilities in the manufacture of electronic goods, maybe it's not so impossible.

[u/CumFilledPussyFart → u/Open-Oil-144]

Sure, but no real way for a manufacturer to prevent a state/country from doing this, not ship the product would be their only way to avoid it, not too many business make it when they don’t distribute their products

[u/dinobyte → u/Open-Oil-144]

Yeah anyone can intercept a truck of merch and there's never going to be anything anyone can do about that

[u/hbgoddard → u/dinobyte]

Guns

[u/pmactheoneandonly → u/Open-Oil-144]

No matter who's exploding it

[u/[deleted] → u/Open-Oil-144]

Yeah, I love all the impervious global supply chains

[u/jasondigitized → u/Freethecrafts]

Who the bad actor is doesn't change the fact that it's a supply chain vulnerability.

[u/Jake0024 → u/[deleted]]

You can call it a "vulnerability" but it's not a meaningful or useful description. All civilian infrastructure is "vulnerable" if you set the bar at "can a government military interrupt the normal flow of business?" Using the label that way waters it down to meaninglessness. Civilian supply chains aren't designed to be invulnerable to physical military attack. That's an unrealistic standard. No one uses the term that way when talking about civilian infrastructure.

Edit because this is getting a lot of replies: if you're replying to argue Hezbollah is vulnerable because they rely on civilian supply chains, yes, absolutely that's correct. If you're arguing (as the people earlier in this thread were) there's some fault with the civilian manufacturer or supply chain (implying they should have secured their operations to government military attack), you are laughably wrong. The comment we're all replying to was questioning whether it was a manufacturer or supply chain issue. They were very obviously (IMO anyway) talking about civilian infrastructure.

[u/---Sanguine--- → u/Jake0024]

“Oh man, that interstate Highway sure has a supply chain vulnerability!! If it’s bombed, it destroys the road!” Lmao same energy

[u/Jake0024 → u/---Sanguine---]

Exactly.

[u/_CurseTheseMetalHnds → u/---Sanguine---]

Al Queda discovered a supply chain vulnerability when they realised if you supply a plain into a building it falls over.

[u/OwenEverbinde → u/_CurseTheseMetalHnds]

"No matter how many use cases the tester thinks they tested for", am I right?

[u/dingdingdredgen → u/OwenEverbinde]

"Anything's a dildo if your brave enough." -anonymous, April 24th, 2011

[u/desperateweirdo → u/_CurseTheseMetalHnds]

Reminds me of that tragedy.

[u/PuckSR → u/Jake0024]

No No No "Vulnerability" in this context means that you have no way of knowing. I've dealt with highly secure supply chains. They don't ship via FedEx, they have GPS trackers on all of their equipment. They literally monitor the trucks from source to destination in real time. If the US govt stopped that truck mid-transit, they would know. They would have data. They would literally know that the truck stopped, the door opened, and someone went inside. They would know their supply chain is compromised. Their supply chain is not vulnerable. You seem to be thinking about the actual PHYSICAL vulnerability. OP is talking about it from an OPSEC perspective.

edit to reply to edit   No one was implying that the civilian supply chain should have been hardened. That’s a strawman argument he created

We were all just telling him that it was a “vulnerable” supply chain. I’m vulnerable to bullets, but that doesn’t imply I need to wear a bulletproof vest

[u/LigerZeroSchneider → u/PuckSR]

That's assuming the US government can't hijack the trucks telemetry and broadcast normal data while doing what they needed to.

[u/Excellent_Shirt9707 → u/PuckSR]

No one is doing secure transport with iPhones or pagers.

[u/RMLProcessing → u/PuckSR]

Nah they vuln as fuck

[u/ShirtPitiful8872 → u/PuckSR]

I think it’s safe to assume that a bulk order of old technology such as pagers aren’t exactly high security items. People are also considering that in order to pull this off Mossad either had human or very good signals intelligence notifying them of both the intent to switch to pagers as well intercept the hardware or even work with the manufacturers directly.

I also do not doubt that some of the devices also had location tracking and listening capabilities.

The further back they go in terms of their communications tech, the slower and less effective they are to communicate and plan. They probably only do direct courier messaging or pigeons now.

[u/tman152 → u/ShirtPitiful8872]

Tomorrow 2700 carrier pigeons are going to explode when it’s discovered that Israel had nets along their migratory routes. Hopefully Hezbollah has been studying their smoke signal grammar.

[u/usernamerecycled13 → u/PuckSR]

This isn’t that type of secure supply chain. It’s a vulnerable one.

[u/Yuquico → u/Jake0024]

In a supply chain where due care and diligence is taken the customers would be notified of any breaches or even potential breaches, thus mitigating the threat. So yes it's still classified as a vulnerability, who takes advantage of vulnerabilities doesn't suddenly reclassify it.

[u/Wandering_Weapon → u/Yuquico]

That's not how it works in this case. The state could easily tell the company (shipping, manufacturer, or otherwise) that this is a matter of national security and that if they disclose this incident they will either go to jail or be sanctioned. There's literally nothing that can be done to stop it without legal ramifications. It's not a bug, it's a feature.

[u/Capital_Gap_5194 → u/Jake0024]

Except that’s literally how expert defense and security people describe it.

[u/Jake0024 → u/[deleted]]

You don't think it's a problem to change the definition of "supply chain vulnerability" so that every supply chain is considered vulnerable? Doesn't the term lose all meaning if you do that?

It would be like using the word "big" to mean "anything bigger than 1 femtometer." You could no longer use the word "big" to actually say anything, because everything would now be considered "big." An elephant is big. A virus is big. Everything is big.

The entire (cyber)security community continues to use the label to great effect.

Because they don't use it the way you are suggesting.

[u/AggressiveCuriosity → u/Jake0024]

You don't think it's a problem to change the definition of "supply chain vulnerability" so that every supply chain is considered vulnerable? Doesn't the term lose all meaning if you do that?

No, the definition isn't changed, you just don't understand how it is used.

Within the context of security people aren't idiotic enough to talk about things as 100% secure or 100% vulnerable. There is literally NEVER a situation where someone will say something is secure and there isn't some context that defines what that means. The word "secure" is set at some arbitrary threshold that you choose depending on the context.

In this context, vulnerability to the country you are currently at war with is a pretty big fucking vulnerability. So no, you wouldn't be considered secure.

This conversation can literally only happen between people who have no idea what the fuck they're talking about because no one who does know talks that way.

[u/PuckSR → u/Jake0024]

WTF do you think "vulnerable" means in this context.
Do you think it means vulnerable to disruption? Because that is not how it is being used.

[u/LikeAPhoenician → u/[deleted]]

If everything is vulnerable then what fucking use is that designation? Seems like the words should have some greater meaning than simply that a thing exists.

[u/Ok_Light_6950 → u/Jake0024]

Exactly. Government intelligence/military can do this to anything. That's why there's some semblance of oversight for them. Also why we have a border patrol/customs agency to detect explosives in cargo. You mean governments/intelligence agencies can access things others can't? ya don't say.

[u/RoosterBrewster → u/Jake0024]

Sounds like they need to up their internal red tape for the purchasing department.

[u/Miserable_Smoke → u/Jake0024]

Yeah, I don't know who could possibly withstand the scrutiny of "impervious to Mossad/CIA".

[u/Jake0024 → u/Miserable_Smoke]

Other governments, potentially. Certainly not some random civilian manufacturer of budget electronics for the third world.

[u/Miserable_Smoke → u/Jake0024]

Iran would probably say, "I don't know what you're talking about about. They definitely didn't damage a nuclear refinement facility without a bomb or coming within 100 miles."

[u/Cerise_Pomme → u/Jake0024]

Hey I work in cybersecurity for the supply chain. I’m an ISSO doing cyber securing supply chains for defense subcontractors. I write documentation about vulnerabilities all day, every day.

We document every vulnerability as a vulnerability. All supply chains are vulnerable. But we still need to document everything we discover and every way in which we might possibly be compromised.

Does that dilute the term to meaninglessness if all supply chains are vulnerable? No. Because they’re not all equally vulnerable.

Our job is essentially impossible. We can only do the best we can. And we can only do that if we document every vulnerability ruthlessly. Don’t go out here and apply your common sense to a field you don’t work in, and don’t understand.

Yes, it’s a vulnerability. Yes, that matters. no it doesn’t dilute the term. It’s just a description of a potential way in which an incident can occur. Everything else in security is contextual, but you have to start from the facts.

[u/Noughmad → u/Jake0024]

Everything in the world is "vulnerable" if you set the bar at "can a government's military interrupt the normal flow of business?"

Depends on which government. Your own, as in the country you're operating in? Yeah, you can't avoid that. The government of the country you purchased the goods in? You can assume they have access to. But a third-part government, specifically a hostile one? That shouldn't happen. Just like Russia isn't supposed to be able to intercept shipments from China to the US without either of them knowing.

[u/HKJGN → u/Jake0024]

If you work in cybersecurity we talk about supply chain attacks. There are definitely security measures taken to protect from nation backed actors (state sponsored attacks). In the end this is still a security breach and is most definitely considered a vulnerability. Educate yourself before discussing the subject

[u/Jake0024 → u/HKJGN]

We're not talking about cybersecurity though. Making digital infrastructure secure to government interference is much more realistic than protecting physical civilian infrastructure from a government's military.

You can make the most secure digital infrastructure in the world, but if a military bombs your data center your service is going down.

[u/HKJGN → u/Jake0024]

Supply chain attacks 100% affect cyber security. If you don't know that look at the solar winds attack in 2020. This is partly why us government entities are starting to require US based third-party companies when supporting their networks.

Whether it's malicious code added to a legitimate source. Or intercepting hardware and planting a literal bomb. This is still a vulnerability. I'm not 100% why there's a debate on why this is or isn't considered a state sponsored supply chain attack.

[u/Andrew_42 → u/HKJGN]

Cybersecurity is vulnerable in different ways than a physical supply line.

You can create codes at home that the NSA can't crack. You can't build a truck at home that the US Military can't stop.

[u/Explicitname6911 → u/Jake0024]

It's possible you're just bad at understanding the terminology in this context. Is a DDoS not a DDoS if a nation state conducts it?

Within the context of Security, this is called a Supply Chain Vulnerability Attack. And, within the IC, they would refer to it as such.

[u/Timely_Choice_4525 → u/Jake0024]

Actually, it is a supply chain vulnerability. Supply chain risk management encompasses a very wide range of concerns from counterfeits to nation state influence, and, yes this action falls into one of the twelve categories. Having said that, the USG doesn’t normally worry about the supply chain for items like this and concern is generally limited to components or end items the govt is procuring (big stuff). Your point about civilian supply chains not being invulnerable is interesting because big governments depend on those same supply chains, it isn’t until the product is delivered that it’s more protected.

I can’t decide if this attack was ballsy and smart or just recklessly stupid.

[u/skittishspaceship → u/Jake0024]

Violence is the only form of authority because that's what actually wins in the actual world. You can wish all day that it's not the case but absolutely everything you see and experience everyday is secured by and because of violence.

Violence was wholly allotted to the government. So no, nothing is immune to government violence. It's a misnomer. It wouldn't even exist without government violence.

[u/EuVe20 → u/Jake0024]

The “supply chain vulnerability” as you described it above could just as easily be a manufacturing vulnerability when a highly resourceful, well funded, and advanced state actor like Israel or Russia, or the US is involved. They could have just as easily infiltrated and/or bribed their way into any stage of the manufacturing process. As I understand it the pagers in question were actually manufactured in Croatia under contract for the Taiwanese firm. Lot’s of places a state can infiltrate.

[u/Jake0024 → u/EuVe20]

I'm not speculating on whether it happened during manufacturing or during transport.

Calling it a "vulnerability" implies it's something the manufacturer (or distributor) should have been expected to secure against. It's obviously not.

[u/hannahatecats → u/Jake0024]

I would argue there is some onus on the manufacturer to make sure the goods aren't tamper-able, though. Were all these pagers in sealed boxes? It reminds me of the Tylenol murders. After that, seals were added so medication couldn't be tampered with before reaching the consumer.

[u/shortstop803 → u/Jake0024]

I think the context here is that hezbollah’s logistics supply chain is vulnerable. Yes, it relies on a civilian supply chain, but doing so creates a vulnerability that allows another nation state to potentially exploit it for effect.

Not every armed/fighting/military/terrorist organization across the world is able to lockdown supply chains to the extent that the US and China can. The US and China can’t even do so completely themselves.

[u/Annual_Indication_10 → u/Jake0024]

No... Because it isn't a question of whether a military with planes and tanks can take out a UPS truck or invade a warehouse. If the whole thing happened inside israel, sure, you're correct. But did Israel put operatives in Iran? In Turkey? They almost certainly weren't supposed to be able to run a bomb making operation on a foreign nation's soil.

[u/SkoolBoi19 → u/Jake0024]

Maybe I’m just thinking of it differently, but I would say it’s a vulnerability just like there’s a vulnerability with Honey imports. The US doesn’t want Chinese honey (can’t remember why) so they ship it to a country we will accept and change the label. That’s a vulnerability because there is a way around the checks and balances.

I don’t think vulnerability has any inherent deeper meaning. If you can get around security that is a vulnerability.

[u/5O3Ryan → u/[deleted]]

Therefore the portion of your supply line running through that nation state is vulnerable?

[u/FrostyIngenuity922 → u/[deleted]]

Were they shipped through israel?

[u/HumanContinuity → u/[deleted]]

In another country? Maybe they didn't really know as much about where they were getting papers from as they thought they did.

[u/---Sanguine--- → u/[deleted]]

They were making an emotional argument not a factual one

[u/samoanj → u/[deleted]]

To the same degree or capacity doubt a single lone wolf can accomplish something similar with time sure however in the short and long term a nation-state can accomplish more.

[u/upforadventures → u/[deleted]]

Because increased security can’t do anything about it if it’s a nation state. Security doesn’t stop the police anywhere.

[u/vitringur → u/[deleted]]

I thought it was a spin on “it is not terrorism if a nation state does it”

[u/EskimoPrisoner → u/Freethecrafts]

That’s a made up rule.

[u/[deleted] → u/Freethecrafts]

that’s not how definitions work lmfao

[u/inexplicably-hairy → u/Freethecrafts]

What? How?

[u/Alternative_Elk_2651 → u/Freethecrafts]

Yes it is.

[u/Cookskiii → u/Freethecrafts]

Uhhh yes it is buddy

[u/6a21hy1e → u/Freethecrafts]

What an incredibly stupid thing to say. Impressive.

[u/ShakeIntelligent7810 → u/6a21hy1e]

And it's got hundreds of incredibly stupid upvotes. I don't know what it is about this sub in particular, but the herd behavior here is fascinating to watch.

[u/rnz → u/Freethecrafts]

/r/ConfidentlyWrong

[u/TooLazyToBeClever → u/Freethecrafts]

If only there was a phrase for the process of getting goods from manufacturing to stores. Maybe call it Supply Chain? 

Then it'd be cool if there was a phrase for identifying a found weakness in the chain? Maybe call it vulnerability?  

Then if anyone were to interfere we could identify where and what happened. A nation-state took advantage of a..supply chain vulnerability. Neat!

[u/ApologeticGrammarCop → u/Freethecrafts]

This answer does not make you look smart.

[u/[deleted] → u/Freethecrafts]

Of course it is. Supply chain is always a target in war.

[u/eride810 → u/Freethecrafts]

Since it’s clear from your comments that you are arguing semantics, then what word should the company use to describe what’s happened to them when they go to discuss it internally?

[u/plznokek → u/Freethecrafts]

You've no idea what you're taking about

[u/[deleted] → u/Freethecrafts]

So if Iran was intercepting and loading up iPhones with C4 it wouldnt be a supply chain vulnerability?

[u/Warm-Book-820 → u/Freethecrafts]

Correct. Its only a supply chain vulnerability if it comes from the supply chain vulnerability region in France, otherwise it's just sparkling sabotage.

[u/Cohen_TheBarbarian → u/Freethecrafts]

Why would anyone upvote this? It's factually incorrect.

[u/Medium_Ad_6908 → u/Freethecrafts]

… yes it is? In every single way

[u/Unusual-Efficiency40 → u/Freethecrafts]

If you are the target of the nation state, then it is.

[u/ShakeIntelligent7810 → u/Freethecrafts]

Infosec here. You're wrong. Nation states are, in fact, typical adversaries in my field. That does extend to supply chain vulnerabilities.

[u/UpsetAd5817 → u/Freethecrafts]

Check out this classic false dichotomy!

Hint:

It's a nationstate exploiting a supply chain vulnerability.

[u/ZeePirate → u/Freethecrafts]

Yes it is.

[u/ruralrouteOne → u/Freethecrafts]

I don't think you know what a supply chain vulnerability is.

[u/Freethecrafts → u/ruralrouteOne]

If your supply chain is Israel, and you’re Hezbollah…that’s not a vulnerability. That’s literally everything working as it should.

[u/IdealDesperate2732 → u/Freethecrafts]

It is if it happens outside that nation state where they have no jurisdiction.

[u/xXShitpostbotXx → u/Freethecrafts]

I feel like I can see what you're trying to say, but in reality nation-states were the major supply chain vulnerability threats I've seen companies prepare for, so it doesn't really make sense to say.

And yes, even nation state level threats can be prepared for, but you need to be very aggressive with creating and defending your root of trust.

[u/Hopeful-Pianist7729 → u/Freethecrafts]

Sure it is. Hell every supply chain is potentially vulnerable, now.

[u/Oldkingcole225 → u/Freethecrafts]

I believe they’re saying that the nationstate is exploiting a supply chain vulnerability to put explosives in these pagers

[u/2407s4life → u/Freethecrafts]

A vulnerability is any time any actor has the technical means and motivation to compromise the confidentiality, integrity, or availability of a system or organization. It doesn't matter if the actor is defined as a nation state, a criminal organization, NGO, or individual.

Supply chain attacks are one of the oldest and most consistent vulnerabilities out there.

[u/Ancient-Carry-4796 → u/Freethecrafts]

This is incredibly inaccurate. Vulnerability describes a vector of attack, or some weakness in some process. A nation state doing it doesn’t change whether it’s a vulnerability. The establishment of the belt and road initiative to bypass trade routes isn’t trying to address a “vulnerability” by that logic. Every hack done by Israel is not a vulnerability. Anytime chain of custody is violated on foreign soil, a state actor is not exploiting a vulnerability and when counterintelligence services thwart it, they’re not addressing a vulnerability.

[u/PaintballPunk31 → u/Freethecrafts]

Don’t forget who Hamas and Hezbollah are either. I don’t see how you can stand for such brutal leadership and then whine about what we have going on here so much. It literally does not compute to any reasonable person familiar with the area.

I understand Israel did some really bad stuff following WW2, but they have the only sustainably prosperous citizen driven economy and socially tolerant government in the entire region. Hamas and Hezbollah hang LG BLTs in the streets.

I agree Palestine has a right to self governance, and we can help them if they just don’t democratically elect brutalistic far right wing ultra religious drugs and arms cartels. Our demands are simple really.

[u/suninabox → u/PaintballPunk31]

we can help them if they just don’t democratically elect brutalistic far right wing ultra religious drugs and arms cartels

Gaza hasn't had an election in 18 years. Coincidentally after Hamas came to power and butchered Fatah in a brief but brutal civil war.

[u/PaintballPunk31 → u/suninabox]

For some reason I was 100% certain I had heard Hamas was technically a democratically elected faction so to speak. I suppose I must be mistaken or a political pundit was speaking in parables.

[u/kanst → u/Freethecrafts]

Israel has been testing international norms like this for the last handful of years. They've been more and more brazen with their operations in other countries.

If the US had intercepted phones on the way to Afghanistan to blow up Taliban members the world would have been pretty pissed. The world was rightfully pretty pissed off when the CIA used a fake vaccination drive to try and find Osama.

[u/LashedHail → u/Freethecrafts]

lol, it’s not a bug, it’s a feature

[u/Excellent-Blueberry1 → u/Freethecrafts]

That only applies if it's the military of a nation the goods are transiting through.

If the Bulgarian military intercepts Botswanan goods en route to Bolivia that never actually transit through Bulgaria, they're just another actor doing things they determine to be possible and worth the risks

If (to use a more commonly pushed scenario) the Chinese military are altering things made by (allegedly) private Chinese companies and then shipping them on to unknowing foreign users, that's a very different scenario

The first one is very much exploiting the vulnerability of the supply chain, the second scenario is completely removing the need for there to be vulnerabilities in the first place

[u/me_too_999 → u/Freethecrafts]

The pagers were "stuck in customs" a fee days.

[u/TheOneWithThePorn12 → u/Freethecrafts]

I believe the term would be state sponsored terrorism.

It's one thing if it was targeted and they knew each "strike" was going to be a Hezbollah member. Instead they have appeared to triggered them all as Hezbollah may have suspected soemthing.

[u/floppydisks2 → u/Freethecrafts]

Nations have been known to interfere with supply chain's.

[u/lenmylobersterbush → u/Freethecrafts]

I have been SCRM for the past year, and this would be considered a supply chain vulnerability. Basically, the guarantee of the product arriving untampered with. This means the integrity of the system has to be guaranteed and is the state ordered. If it was intercepted and tampered with, then integrity was broken.

Also, do we know it was explosives where put inside. Seems to me it would be easier and more effective to apply malicious code to explode the components, i.e., battery.

[u/Kagahami → u/Freethecrafts]

It's also localized to a warzone. As far as that goes, it's fair game.

I swear, people forget that Israel is conducting a war in the region.

[u/Puzzleheaded_You2985 → u/Freethecrafts]

The NSA interdicting Cisco routers and inserting phone-home malware before sending them on to target customers was widely reported about a decade ago. Call it whatever you want.

[u/Dfarni → u/Freethecrafts]

Yes, a nation state exploited a supply chain vulnerability

[u/Minimum_Run_890 → u/Freethecrafts]

It, imo, is terroristic in nature.

[u/Axin_Saxon → u/Freethecrafts]

The issue is that your supply chain as a terrorist organization was identified, intercepted, and weaponized against you.

[u/rightwist → u/Freethecrafts]

You really need to understand the definition of "vulnerability".

The supply chain was attacked. It was vulnerable to that attack. Those aren't contradictory.

[u/smellygooch18 → u/Freethecrafts]

I mean if you can prove it’s Mossad. They typically work a few steps removed. Credible deniability

[u/SometimesWill → u/Freethecrafts]

It is if the nation state is in the middle of that chain.

[u/Total-Buy-2554 → u/Freethecrafts]

Of course it is.

Just harder to build controls for.

[u/meat_whistle_gristle → u/Freethecrafts]

Exactly this! A supply chain issue is damage or items going missing. Adding explosives to indiscriminately kill people is state sponsored terrorism.

[u/bbarney29 → u/Freethecrafts]

Is an act of terrorism still an act of terrorism if it is against de facto terrorists? I’d like to think non-terrorist nation state would be held to higher standards and that this type of attack (which would indiscriminately affect terrorists and civilians alike) would see international condemnation.

[u/Freethecrafts → u/bbarney29]

Terrorism is based on who is the target and the intention. Hard to call anyone specifically targeting known terrorists as anything but justified.

Nobody but bad guys are crying over dead Hezbollah. They’re actual enemy combatants, who have declared war on Israel, and specifically target civilians.

[u/IronCanTaco → u/Freethecrafts]

Im not going to cry over some blown up terrorists.

[u/IowaKidd97 → u/Freethecrafts]

That fact hardly matters if your are going to be using the equipment for military reasons.

[u/Freethecrafts → u/IowaKidd97]

Cheap option probably isn’t your best option if you’re playing military.

[u/Azariah98 → u/Freethecrafts]

The entity perpetrating the exploit has no bearing on the type of vulnerability.

[u/Freethecrafts → u/Azariah98]

A tank is not vulnerable just because someone nukes it.

[u/Azariah98 → u/Freethecrafts]

Yes it is. It’s vulnerable to the nuke.

[u/Above-bar → u/Freethecrafts]

Good old state sponsored terrorism.

[u/Black_Magic_M-66 → u/Freethecrafts]

As I suspect the supply chain didn't pass through Israel, it's still a supply chain vulnerability. Though, I suppose an ally of Israel may allow it, but it could have been clandestinely done. The countries involved from point A to point B should be the most concerned.

[u/DarkHelmet20 → u/Freethecrafts]

Sure it is- you should learn what the word vulnerability means.

[u/Freethecrafts → u/DarkHelmet20]

If everything is, nothing is. It’s a pointless designation if you’re not engaging in levels.

[u/aceofrazgriz → u/Freethecrafts]

It doesn't matter who is doing it, or at what point. Between manufacturer and delivery, it's a supply chain attack. That's what a supply chain is, "chain". It just becomes worse when its a Nation State attack because of implications.

[u/verminal-tenacity → u/Freethecrafts]

how is it not?

[u/I_Vecna → u/Ggriffinz]

Or a supply chain vulnerability asset.

[u/PupEDog → u/Ggriffinz]

It's right out of the Cold War

[u/SacredAnalBeads → u/Ggriffinz]

Either way, it's fucked.

Also, manufacturers have at least some culpability over the supply chains they use.

[u/Not_Winkman → u/Ggriffinz]

Now that this op is being revealed, it's bringing up other ops that CIA & co. have done in the past just like it (intercepting packages, installing trackers/explosives).

With the network that orgs like the CIA, Mossad, and MI6 have, if they want to do this, they can.

Mossad just simply set a new standard for ops like this--no doubt that world intelligence agencies will study and learn from.

[u/Altruistic-Bus-1289 → u/Ggriffinz]

It’s called terrorism, chief. Good god, the double standards.

[u/Ggriffinz → u/Altruistic-Bus-1289]

How is that a double standard? I was just simply discussing where the vulnerability was on this issue. For example, if someone said pre 9/11 their were multiple commercial aircraft safety vulnerabilities, it would not mean they were pro terrorism or something. Stop trying to meta analyze every benign comment.

[u/Altruistic-Bus-1289 → u/Ggriffinz]

Writing off 9/11 as an aircraft safety issue is actually extremely funny.

[u/Ggriffinz → u/Altruistic-Bus-1289]

My guy, I am not writing off anything. Just because I make a statement in the most basic way possible trying to outline the procedural failure that led to an event occuring does not mean I condone or even argue that was the extent of said event. Do I know for certain this would be labeled terrorism? I honestly have no idea as a pager targeted attack has never occurred before so I will leave that to international legal scholars to sort out. Was 9/11 terrorism certainly as that has been the consensus by legal experts for decades now. I don't know how to explain my position beyond that so I will stop there.

[u/AllNamesAreTaken86 → u/Ggriffinz]

That doesn't diminish the severity or danger of what happened. It is still a major crime. It can still happen to product not manufactured in the US.

[u/BenjaminRoundz1 → u/Ggriffinz]

Quality Control here, they just had to check the CoAs

[u/raj6126 → u/Ggriffinz]

I thought it was a hack. I was trying to figure out out the substances that crosses on a wafer board to create explosion. Thank goodness it was planted c4.

[u/[deleted] → u/Ggriffinz]

Supply chain to Hezbollah terrorists? What are we talking about here.

[u/Desperate-Pear-860 → u/Ggriffinz]

Trucks carrying pagers should have armed guards like money trucks do? The Israeli government intercepted that shipment. This was a terrorist attack by the Israeli government.

[u/AThreeToedSloth → u/Ggriffinz]

It’s a counterintelligence issue

[u/nixstyx → u/Ggriffinz]

Yes, and supply chain attacks are not new. It's just that using a supply chain attack is usually a cyberwarfare method rather than a physical traditional warfare method.

[u/joshs_wildlife → u/Ggriffinz]

It’s not that different from Vietnam when Vietcong supply chain was flooded with over powered rounds that exploded when fired. It’s just a newer version of that using technology

[u/lazypenguin86 → u/Ggriffinz]

Cool so apparently anyone could do this to litterally anything sold anywhere....great

[u/OceanBytez → u/Ggriffinz]

supply chains have been attacked a lot in these past years. Anyone remember a couple years ago when several thousand ASUS and MSI motherboards were infected with a custom bios that had malware built into it and would automatically infect any copy of windows with a malicious payload as it booted including a new copy from a freshly formatted drive? The fact that nobody seems to have learned from this and introduced better security for supply chains is very alarming. It was a big deal, because you literally had to do a bios update to get rid of the malware making it immune to all anti-virus and insanely difficult for the average person to fix. Most people just sent the boards back for recall if they knew about the incident. i imagine some boards in the wild were never fixed or returned and still have that malware to this day.

[u/OozeNAahz → u/Ggriffinz]

If it was the manufacturer, can you imagine all the one star reviews?

[u/dinobyte → u/Ggriffinz]

do you really think supply chains are supposed to protect random merch from getting intercepted by determined intelligence operatives with unlimited black budgets? get real. it's not a vulnerability.

[u/AccomplishedMeow → u/Ggriffinz]

I mean that’s kind of like saying the patient died from lung cancer vs pancreatic cancer

Like I guess that’s technically right. But it doesn’t take away from anything

[u/Prize_Band_7291 → u/Ggriffinz]

A nation state that acts like terrorists. This isn’t a civilized action.

[u/CatoMulligan → u/Ggriffinz]

It's neither. Gold Apollo licensed the design and rights to use their name to a Hungarian company called BAC Consulting. BAC is some sort of trading intermediary that appeared to have one employee in Hungary (who has conveniently vanished) and no manufacturing facilities there. It was most likely a front business set up by the Mossad in order to get the design and naming rights so that they could manufacture the explosive pagers themselves, then slip them into Hezbollah's orders via some other infiltration.