Hackers Hijack Digital Billboards Globally, Displaying Explicit Content
A group named Leakers$ has claimed responsibility for hijacking digital billboards in Egypt, Malaysia, and Brazil, replacing advertisements with explicit content by exploiting vulnerabilities in content-transmission software.
A cybercriminal group known as Leakers$ has claimed responsibility for a series of coordinated attacks that saw explicit content displayed on digital billboards across multiple countries, including Egypt, Malaysia, and Brazil. The group stated that they did not compromise individual billboard hardware but instead exploited vulnerabilities within the software responsible for transmitting content to these displays. This method allowed them to remotely inject their own material, leading to widespread public embarrassment for the billboard operators.
One notable incident occurred on October 29th, where a large billboard overlooking a major Egyptian highway was hijacked to display pornographic footage. Videos shared online showed the attackers' aliases and a Telegram channel address superimposed on the explicit material, attracting significant attention from motorists. Egyptian authorities indicated that the billboard's operator experienced a website compromise, which facilitated the simultaneous unauthorized display of content across several countries. Similar incidents were reported in Malaysia and Brazil, with Leakers$ also claiming, though less definitively, access to systems in Iraq and China.
A representative from Leakers$ told The Cairo Report that their automated scanning efforts identified thousands of exposed systems within a mere two hours. They highlighted a critical flaw in content-transmission software, accessible through the systems' web interfaces, as the primary vector for exploitation. This suggests a systemic vulnerability rather than isolated incidents, enabling the attackers to achieve broad reach with relative ease.
The attack underscores a critical security risk associated with internet-exposed management systems. By scanning for and exploiting these exposed interfaces, attackers can bypass the need for physical access to individual devices. The ability to find and exploit a single software weakness across numerous installations amplifies the potential impact, turning a localized flaw into a widespread security crisis.
This incident is reminiscent of other attacks that leverage the convenience of remote management for malicious purposes. For instance, recent attacks on refrigerated systems in European supermarkets demonstrated how internet connectivity, intended for remote diagnostics and maintenance, can be exploited by threat actors. In the case of digital billboards, control over the content management system provides a direct pathway to manipulate displayed information without directly interacting with the physical display hardware.
Security experts emphasize that the fundamental principles of cybersecurity apply equally to digital billboards as they do to any other networked system. Recommendations from organizations like the Out of Home Advertising Association of America include avoiding default passwords, never reusing passwords across multiple devices, restricting access to management services, implementing multi-factor authentication, and securing remote connections, ideally through a VPN.
The practical advice for securing these systems involves treating them as remotely managed computer systems. This means restricting public internet access to management interfaces, enforcing strong, unique passwords, and enabling multi-factor authentication. Keeping all signage software, controllers, and network equipment updated is crucial, as is regularly auditing who has access to these systems, including third-party vendors, and ensuring that access is adequately protected.
Ultimately, the ease with which Leakers$ claimed to compromise these systems serves as a stark reminder of the importance of basic security hygiene. Organizations deploying internet-connected devices, especially those with public-facing interfaces, must prioritize robust security measures to prevent their systems from being abused for malicious purposes.