Here’s your detailed tech possible explanation with citations:
Pagers known used in the attack were Apollo Gold AP-700, AP-900 and AP-924, which all use the same ALA25 programmable logic chip.
If you google the Gold Apollo AL-A25 Programming Manual and look for battery gauge inputs, you can see it is possible to program the voltage ranges.
By setting the battery gauge level-high to an invalid selection that is also greater than the low level it creates a bridge between the anode and cathode, resulting in thermal runaway which will in fact cause the battery to overload and explode due to the increased temperatures.
We’ve done this using similar batteries on battery backed write cache controllers sitting in a nema-3 enclosure just to see what the tolerances are.
Here’s your detailed tech possible explanation with citations:
Pagers known used in the attack were Apollo Gold AP-700, AP-900 and AP-924, which all use the same ALA25 programmable logic chip.
If you google the Gold Apollo AL-A25 Programming Manual and look for battery gauge inputs, you can see it is possible to program the voltage ranges.
By setting the battery gauge level-high to an invalid selection that is also greater than the low level it creates a bridge between the anode and cathode, resulting in thermal runaway which will in fact cause the battery to overload and explode due to the increased temperatures.
We’ve done this using similar batteries on battery backed write cache controllers sitting in a nema-3 enclosure just to see what the tolerances are.
Edit Citations:
https://www.mitsubishicritical.com/resources/blog/thermal-runaway/
https://www.apollopagers.com/support/al-a25-gold-pc-programming-manual/
https://www.manualslib.com/manual/1198103/Gold-Apollo-Al-A25.html?page=23&term=voltage&selected=1#manual
Programmable chip responsible:
GAPOLLO AL-A25_6 RA5794.1 chip = AP-900 and AR-924 models