Not a ton is known, by from what I understand the explosives were part of a secondary board added to the pagers, which would also have the ability to listen for a separate signal or look for a specific one the pager received.

This wasn't an interception. The devices were designed and manufactured by Israeli intelligence. They just licensed out brandnames through shell companies, and convinced Hezbollah to buy models from their agents by conventional spycraft.

May have been done at the source of the manufacturing.

Replace battery with battery/explosive/receiver combo.

I believe they triggers a cell in the LIPO batteries to overheat causing the explosive material to explode.

If they can plant explosives they can 100% tap into the circuit or maybe reprogram the board. The CIA is known to be able to do this to specific devices by plucking them from the mail. Mossad could likely do their own production run and ship that to Hezbollah.

you really might not.

before there were mobile phones there was analog dtmf wired telephones. they replaced pulse dialing and allowed for all kinds of additional signalling and triggering. ring a bell, operate a relay, kick people off so you could call the president, entire automated analog switching centers, you name it.

when mobile networks came on the scene there were all sorts of additional triggers but because the (second gen? the ones that could do sms) signals were actually digital, there was a much wider array of possibilities. dtmf had a handful of frequencies it supported and if you wanted to do something more you had to basically make sure the entire network you were using could send, transport and receive those frequencies.

now imagine instead of sixteen combinations of frequencies played at the same time you have access to thousands of possible triggers. once you have simple stuff like the basic receiving of text and lighting a led or playing one of several legally distinct jingles covered, you could do do much more. and people did. there were all kinds of things pagers could do through combinations of local interface and digital communication with a cell tower, all mediated through a handful of baseband chips on the pager pcb that could have the pins for stuff they wouldn't be used for disconnected.

but how would you make a pager set off an explosive?

well, the same way you use a casio f91w wristwatch to. you use its built in functionality (the speaker when the alarm goes off) to trigger a battery that can deliver enough electricity into a resistor to heat it up enough to make your (primary) explosive detonate.

in the case of a pager, those baseband chips have all kinds of on and off switching built in. it's not hard to imagine that basic, out of the box functionality would include pulling a pin high when it gets "*97" or some such. now tie that pin to the base of a transistor across the positive and negative terminals of the battery and sitting against a little petn and you got yourself a remotely triggered explosive.

you wouldn't even need a pcb.

there's probably a lot of stuff thats incorrect in this reply. it's late and this is off the dome.

If they can intercept the message where it isn't encrypted, they can simply sniff the messages coming on the page and wait for their signal.

Then, they can trigger the explosive to a specific message.

That's a wild guess though.