Is It Really Possible For Malware To Make a Lithium Battery Explode?

[@m-faccin]

I would call it supply chain attack

[@shenjg]

a t-ist attack *

[@algharibe]

what happened in lebanon is that An explosive material was planted in the device's batteries. The material used is Pentaerythritol tetranitrate, 20 grams were used. It is a highly explosive material with a power of 1.5 compared to TNT.

[@ricky4673]

Was a trigger also installed or did the the device act as one. See the problem? Used devices are sold all the time.

[@Memoonah-s5q]

New reports are showing up of laptops mobiles being exploded pagers walkie talkie. How are they planted in so many devices? and many people have been injured due to it

[@shenjg]

What happened was a t-ist attack

[@algharibe]

@@ricky4673 the trigger was the temperature of the Li battery , the signal was sent from a drone to rise a battery temperature its an easy way

[@Memoonah-s5q]

@@shenjg Frr

[@UKCheeseFarmer]

Congratulations on the 100k Subscribers Marcus!

[@DeviantOllam]

MG did such a great thread on this, too... I'm really enjoying all of these write ups and explanations

[@MalwareTechBlog]

Just looked up his thread, really great stuff!

[@magnus8759]

Where I can read it?

[@kimothefungenuis]

I am an electrical engineer BSc. student and the only way I think one can hack to make something explode is if they somehow figure out the closed loop transfer function of the device then transmit/trigger a signal with a large enough frequency above the critical frequency to cause the system to be unstable which causes the battery to explode. Possible theory but not sure how practical it is.

[@modelrailwaysales3850]

would they be able to blast it with a massive 5G beam and the stronger the beam the bigger the explosion?

[@nopenope7914]

Fascinating side note: The energy density of high explosives certainly much higher than lithium-ion batteries but not incomparable (PETN @ 1600 W*h/kg versus Li-ion @ 300 W*h/kg). But as you noted the biggest difference is speed... lithium battery has to discharge (uncontrolled but still over time spans a human can perceive). A high explosive is a solid mass turning into a high-temperature gas across boundary that expands 10 times faster than the speed of sound. I have to say though... what REALLY blows my mind is how on earth this never set off any explosives sniffing dogs. There is a ton of publicly available literature documenting such explosives canines getting testing that includes low-volatility high-explosive like RDX or PETN.

[@MalwareTechBlog]

Also worth noting that a significant percentage of the battery's energy is going to be lost to electrical discharge and various chemical reactions. Maybe some chemist can do the math, but I'd imagine that even under perfect circumstance only a small percentage of that 300Wh/kg gets converted to flammable gasses.

[@pan2aja]

Dogs are Haram

[@Hexanitrobenzene]

@@MalwareTechBlog I'm not an expert, but... :) As far as I understand, the most danger in Li-ion battery explosion actually comes from the organic electrolyte, because it is flammable (water based electrolyte cannot be used because lithium reacts with water). Stored electrical energy is enough to boil this liquid, and when the vapour comes into contact with sparks and air, fire and possibly explosion occurs. In my country recently two flats burned down because people were charging eletrical scooters inside. However, explosions occur primarily due to mechanical damage or old age - nothing remotely controllable.

[@nopenope7914]

@@MalwareTechBlog Don't have background for those calculations either, but yeah I would bet good money with 10 to 1 odds that is the case. Not to mention the flammable gases would definitely be (at most) a low-order fuel-air explosive. But your comments actually bring up a question that I figure has been asked (as it is much more plausible as a threat) regarding the nature of the gases released... is it possible for malware to create conditions where the battery produces large amounts of extremely toxic gases? Perhaps in a subtle fashion that where the danger is that it would not be noticed? There are plenty of papers (including Nature "Toxic fluoride gas emissions from lithium-ion battery fires", August 2017, Larsson et al) which cover the extreme dangers the gases pose, particularly with indoor/confined spaces. I don't study malware but I know that when you have a controller chip that is low-level/close-to-physical-parts enough (like a lithium-ion charging controller) then it should (in an ideal world) have a limited set of instructions which abstract away inner workings which only carry risk by allowing outside interference (whether that is updated SoC firmware via bus, laptop usb control, wifi adapter login). But the PLC worm with Iranian centrifuges demonstrates nothing is too "hardware" to be vulnerable these days... and updates guarantee a malware vector (not sure if "vector" is the right term but it seemed fitting given its use in epidemiology)

[@nopenope7914]

@@pan2aja Holy crap! I know that is a thing for dogs as pets but I guess I should have realized it would apply for bomb sniffing dog too. I mean, they do have specific conditions referring to protection of farmland, etc which I would have assumed were extended to other working dogs. I am surprised because Islamic scholars and religious leaders are usually practical and thorough when it comes to the nuts and bolts of novel situations. Before the first muslim went to the ISS there was a meeting with over a hundred Islamic scholars in his home of Malaysia to put down guidelines for questions like how would "face Mecca" while orbiting the earth!

[@liquidsnake6879]

As always what actually happened is far less impressive than what the media imagines, at least techonologically because i'm in awe of the social engineering required to import and commercialize electronics packed with explosives in a hostile country.

[@geroffmilan3328]

I think Israel probably has the ability to disrupt/intercept physical deliveries to Lebanon. They would have short- listed the devices their targets use (standard operating procedure for intel types), then intercepted & tampered with those devices.

[@mad_mario_]

Gotta love when a smooth talking real expert disprove bs. It's like sippin your fav cocktail on a beach watching sunset.

[@3bdo3id]

fail-safe is one of the best concepts we learnt in the college, thanks for mentioning it.

[@isaiahindigenousaboriginal5261]

Facts!

[@marcusaureliusanonymous]

Never say Never: If compromised, malicious hackers can alter charge speeds, forcibly disrupt charging cycles, or rapidly switch between alternating current (ac) and direct current (dc). These actions could damage EV batteries, leading to thermal runaway and, in extreme scenarios, fires or even explosions.

[@NeonVisual]

Duracell Bunny looks a little unnerved.

[@ralfbaechle]

A news article today claimed the batteries were injected with explosives then made to overheat to ignite the charge. That sounds like a load of rubbish. I don't know any battery that could just be injected and still function. And still fit into a small device. This whole thing did imply a LiIon battery - but as you say that's not even what was used. The Lebanon is a country with a notoriously unreliable energy supply. So disposable batteries just make sense for something which probably would have been considered mission critical by those issuing the pagers. Pagers were classically often powered by disposable batteries anyway.

[@geroffmilan3328]

The intelligence commentators say: extra circuit board + PETN was installed. Circuit board is used to detonate the PETN upon receipt of a specific message. So it's all "side by side", no real dependency on the device's power source.

[@jonwinder6622]

The thumbnail of this is too damn funny

[@lexxel01]

the answer is definitely yes - it is possible if they are experience to hack into the device and corrupt the firmware in regards to maintaining safety protocols for the battery, I would imagine there is some type of safety coding that signals protection for possible overcharging - so will say its possible your phone can be hacked to turn on microphone or camera it may also be possible for someone to do something that causes some sort of feed back loop - to simply say no is really inability to think outside the box

[@MalwareTechBlog]

Perhaps if you watched the video before commenting, you'd have reached to the part where I explained that's not how it works.

[@lalotime]

​@@MalwareTechBlogbut there have been cases where people have hacked into computers to overheat and possibly cause a fire. For a phone it wouldn't be that surprising. Also wouldn't it be possible for the overheating to cause pressure for the battery to eventually combust? Especially if it's in a pocket? A fire isn't an explosion but it could still be dangerous. Especially the fumes from the battery are toxic.

[@yasarali45]

It happened in Lebanon.. In my young age i heard about that.. Highly electro magnetic wave apply one line of communication target will be distroyed.. However, speed ran out battery charge lead to thermal change in battery of mobile phone. In future like antivirus need to install safety software to keeping battery usage shunting software. Making program to trigger all software to works together to drain battery within least time create a rapid thermal change cause burst battery of mobile phone..

[@evilrex91]

yo Marcus just heard your story from a different content creator but i am glad you ok but my reason for this comment is for your hmm two cents on a firewall idea i had one that more advanced than normal everyday firewalls something similar to what you would find in megaman nt warrior a firewall that protects against alot of viruses and allows it user to fight along side the firewall to keep the computer safe from malware and viruses?

[@Plasticjesus504]

Loving the content Marcus. Thanks for all the hard work!

[@jamesmurillo144]

Just watched your documentary. What a legend!

[@cipher3966]

I have a fifteen year old laptop and I'm pretty sure I could make it catch fire if I just opened as many programs as I could. In theory I could make a script that maximises power consumption to the point of fire

[@dfs-comedy]

It's unlikely. Even a 15-year-old laptop will have thermal protections that will shut it down if it starts overheating. And these are implemented in hardware, not software.

[@cipher3966]

​@@dfs-comedy I have heard in the news of cases where people have left their laptops on beds and fallen asleep causing housefires. It's unlikely but not impossible

[@jonnyphenomenon]

I still think there is a good chance some kind of "cyber" was involved, after all, how were they able to trigger it? I really want to know how they triggered it. was it sent a command remotely? Or was it on a timer delay? Some news site simply said it was on a timer, but didn't elaborate. That seems far too crude and inaccurate...

[@dfs-comedy]

Yes, there must have been a trigger signal. I expect the attackers implanted some explosives and a little circuit board that watched for a specific message to be received and triggered on that.

[@Xcar-z7v]

The timer would be simpler explanation and more reliable mechanism imo. If they had the ability to trigger it at precise moment on the fly, wouldn't they have waited til more opportune time to coordinate with IDF activities?

[@boogaplays123]

When is next stream?

[@paulsheridan424]

Thank you Marcus Hutchins: clear, calm, reasoned, and worthwhile!

[@aced3stacks]

I enjoy how well you elaborate everything. ❤ Think i found my new favorite channel

[@user-wq5dg6wn8w]

Is it considered an electronic attack or a cyber attack?

[@ZoomZoom30010]

He posted this on LinkedIn

[@trens1005]

No. You can drain them to make them defective (let the smoke out) but you can NOT make them explode out of the box.

[@joinwuck459]

i just watched ur documentary, your a LEGEND

[@AlexanderWiggins-y8z]

very intelligent analysis

[@NutellaOnToast-w1e]

The UK woman making pager exploders, in the news days before a mass denotation of pager exploders…. Seems almost too easy

[@NoBody-tz4fb]

The answer is not like what happened with the pagers. That was planted explosives.

[@6F6G]

Some manufacturers add chips to their batteries so the system can tell if a genuine battery is fitted and not a cheap third party replacement. This means the battery will have a data bus connection. The Israelis will have tbe expertise to hack the security system so they can replace the standard battery with one containing explosives and a chip which checks as a genuine component but programmed to wait for the activation code for showtime. How the Israelis managed to pull this off has to be a masterpiece of planning and preparation. A guy in a basement could modify a few but several thousand would need a production line.

[@karstenseterbakken3617]

creating a shell company and presenting as a genuine does the trick

[@JisooKim-wg7ez]

I enjoy this topic and am interested in learning cybersecurity and its risks and tools.

[@AngelCruz-gk9py]

I like how you explain everything, very easy to understand. Thank god you cannot make your phone explode 🤯.

[@aarronjones64]

What if you could get the computer in the cell phone to overclock. That would generate a bunch of heat that would also heat up the battery. Perhaps to the point where it would blow up?

[@Soandsoguy]

No. getting the battery to runaway and catch fire is one thing. you would need a strong oxidizer to make it explode like the pagers did.

[@karstenseterbakken3617]

it will most likely ruin the main board of the phone. Its hard imaginable that they can catch fire

[@GlennPegden]

Whilst not relevant to 99.9% of your video (which is awesome BTW), I believe the pagers were confirmed as BAC-manufactured Gold Apollo AR924s, which (unlike almost all other Gold Apollo pages) do use Li-ions not Alkalies. I mean, as you point out, it's an utterly moot point, as lithium batteries don't explode (at least not in any predictable or devastating way) either.

[@spebenge]

This is probably stemming from that old article about how Israel hacked into Iran's nuclear facility and caused havoc with a virus or something like that right? I might be misremembering though, but I thought I remember reading something about that.

[@twistedyogert]

They screwed with the computers that controlled the centrifuges used in Uranium enrichment.

[@spebenge]

Wasn't it something to do with overloading circuits or like that? Sorry, I'm not really tech savvy.

[@Soandsoguy]

You're thinking of Stuxnet. yes.

[@Hexanitrobenzene]

@@spebenge I'm not 100% sure, but this is my understanding. The virus sent unusual commands to electrical motors spinning the centrifuges, I guess high frequency spin-up spin-down, which caused vibrations, which made the bearings wear out very quickly. Bearing failures of high speed centrifuges probably caused catastrophic disintegration for some units, too.

[@Hexanitrobenzene]

@@spebenge PS, the name of the virus is Stuxnet. It has a quite long article on wikipedia.

[@i7rooper]

Modern phones have the battery protection circuit in the main board. Not attached to the battery. That's just too bulky with the molex connector. And that chip can be hacked or controlled remotely given that's built with Israeli technology

[@henryabela2672]

They used lithium batteries... if you bothered look up the manual...

[@Palmit_]

timer- hard coded date trigger

[@Krullfath]

How are people so dumb that they think their phone could explode like the pagers did? Smfh

[@bikeybikebike]

Betteridge’s law

[@estonian44]

now we already know that those machines where not manufactured in the original place, but in hungary? and used the same taiwanese manufacturer name.

[@RogerMcjoggin]

It was manufactured in Taiwan under license from a Hungarian brand.

[@happyatheists9361]

What about.air pod?

[@florinamartinez4282]

I am here because a new fear was unlocked! I been side eyeing my phone 👀 Things are getting weird in the world. 😟

[@fanofentropy2280]

Samsung Note 7 anyone? Even if you could send a text to explode batteries, it would pop like a Note 7. Now if the battery manufacturers are adding a little C4 to the lithium mix, then there might be the potential for a problem, but that's pretty deep down the rabbit hole.

[@Xcar-z7v]

That's gotta be the answer, no? How else do they go undetected on such scale?

[@PatriciaBermudez21]

Pretty Edge Video. Thanks

[@ihad2reload]

Can make a CRT burst tho

[@modelrailwaysales3850]

would they be able to blast it with a massive 5G beam and the stronger the beam the bigger the explosion?

[@Demo-je8jm]

Social distance from tech mandates coming soon

[@JoseantonioNavarroAguilar-o2z]

Congratulation Marcus u are the internet superman

[@geroffmilan3328]

Don't say it's more useful as a sxi-fi plot device, please! 😬 And agree: not really a viable attack vector. Now, if a specific generation of a specific device had a specific problem..? *And if* causing fire was both the outcome of exploiting that problem *AND* a useful outcome to the attacker? That's approaching realistic, since we have already seen batteries prone to spontaneous combustion more than once. If the conditions which make them [more reliably] combust can be induced, and there's some means of delivering a payload, the attack is on. Sounds like a lor of ifs & buts. And yet most every attack involves a chain of such things.

[@SusanIvanova2257]

45 seconds in and I almost spat my coffee everywhere. Glad to know you're backing your opinions up with a truly unmatched level of expertise

[@Soandsoguy]

You can criticize his credentials, but his logic and information is correct.

[@rokyo401]

We only need to ask Samsung... they're the experts since the Galaxy Note 7 😂

[@guilherme5094]

👍Thanks man!

[@dfs-comedy]

No.

[@murisio]

devices have hardware protections against these type of events because they're a real danger and also a bad look for the company, it'd be unthinkable to believe that you can just hack your way into fucking it up. Kinda reminds me of the Mr Robot episode where Elliot and Tyrell would hack into E Corp's paper records and make the UPS explode

[@Soandsoguy]

Those hardware protections are not always as forward thinking or comprehensive as necessary. Yes, many things can be hacked into being f'd up. Have you never heard of Stuxnet?

[@murisio]

@@Soandsoguystuxnet fucked with the SCADA. Phones and modern electronic devices don’t have stuff like that and usually (at least what I’ve designed in my research group) we include several battery protection measures at hardware level, since they are a genuine danger to the user or mission, that trip in case certain conditions are met. If every telemetry or security measure is only set as a peripheral then its a pretty major design oversight

[@Land_of_Goshen]

it can hardly explode,if a steel case is around look some crazy russian video

[@NeonVisual]

Ultra fast charging

[@SimonZerafa]

No. No they can't 🤣🤦‍♂️

[@happyatheists9361]

Note 7

[@cloey_b]

You're a living legend.

[@paq1g-lg4ij]

If you talk me like that, your life will be very poor. By the way do you have summa cum laude, Marcus?? Or just text how bypass EDR because a friend of yours made the research and you only get credits???

[@MalwareTechBlog]

Nope, some of us don't need to pay a university over $100k to teach us how to use a computer.

[@mcbmghome]

I expected 10 second intro saying no and then 7 & and half minutes of subway surfers

[@swiftheadkick]

I gave the 666 like

[@HTRAD-sc9dm]

You are evil

[@santaclaws1508]

The true reason is less interesting but yours is a good theory

[@yzz__]

first mayyynnn

[@jonjohnson2844]

It's more impressive when the first comment is actually something interesting about the content.

[@yzz__]

@@jonjohnson2844 yep good one mate, wasn’t meant to impress you. fack off 🙏🏽

[@yzz__]

@@jonjohnson2844 good one mate, wasn’t meant to impress you.

[@Chris-e5c6i]

Yes it is possible

[@derrekchilson8606]

I needed the answer so i could breathe easy laying next to my phone 🫡 thank you for your service soldier

[@cactusslapper]

You're British... its a lu mi -NI- um.. :)/:(

[@panjak323]

You are still missing a "n" Aluminum, not alumium.

[@cactusslapper]

@@panjak323 no. look at what you wrote, You need an "I". It is not u-ra-NUM, it is not BA-RUM, its not plu-to-NUM Its a-lu-mi-NI-um (alu-mini-um) aluminium but maybe America is the worlds' dominatrix and it wont stop raping the world until we all say the safeword correct; A LU MI NUM

[@cactusslapper]

@@panjak323 the 'n' is there, next to the 'i ' you guys cant pronounce, just got dashed through instead of surrounding the i .

[@panjak323]

@@cactusslapper you crossed it out

[@cactusslapper]

@@panjak323 ... got dashed through instead of surrounding the i ... what are you, eight years old?