Billboards in Egypt and Malaysia Hacked, Sounding the Cybersecurity Alarm Again

Incident Overview: Public Screens Become New Attack Targets

According to reports cited by the Hacker News community, a billboard on a highway in Egypt and multiple display screens in Malaysia were recently hijacked by hackers, who played pornographic content on the screens. This type of attack is not an isolated incident—it exposes widespread weaknesses in the cybersecurity protection of public digital signage systems. Unlike previous attacks targeting websites or servers, public screens face real-world audiences directly; once compromised, the visual impact and social consequences far exceed those of online data breaches.

The incident received 5 points and 1 comment on Hacker News. Discussion was not particularly heated, yet it reflects an underappreciated risk area. Public billboards and display screens are typically operated by third parties, involving a multi-layered architecture of hardware, content management systems, and remote network connections—any weakness in any link can become a point of entry.

Why Public Screens Are So Vulnerable

The security predicament of public digital signage systems stems from a misalignment between their original design intent and security requirements. These systems prioritize the convenience of content publishing and the efficiency of remote management, rather than robustness against malicious attacks.

Default Credentials and Weak Passwords

Many digital signage devices ship with default administrative credentials that operators often fail to change during deployment. Attackers only need simple scanning and trial-and-error to gain control. This problem is common among IoT devices, and public screens are simply one particularly visible manifestation.

The default credentials problem has a well-known precedent in the IoT realm: the 2016 Mirai botnet. This malware scanned the internet for cameras, routers, and other devices using factory-default usernames and passwords, infected them, and assembled them into a large-scale botnet that ultimately launched a DDoS attack against DNS provider Dyn, causing widespread internet outages across the U.S. East Coast. The Mirai incident demonstrated that default credentials are not a trivial oversight but a systemic flaw that automated tools can exploit at scale within hours. Digital signage devices share highly similar characteristics with these IoT devices: dispersed deployment, long-term unattended operation, and difficult firmware updates—making them equally susceptible to automated scanning. For operators, mandating default password changes before devices go online and incorporating this into deployment checklists is the lowest-cost, most directly beneficial security measure.

Insufficient Network Isolation

Signage systems are often connected to operators' office networks or content management platforms. Without effective network segmentation, attackers can move laterally from weaker links and ultimately gain control over screen playback permissions. Although the specific attack paths in the Egypt and Malaysia cases were not disclosed, the outcomes clearly show that attackers gained control over content delivery.

Network segmentation refers to dividing a larger network into multiple isolated subnets so that devices in one zone cannot directly access another, thereby limiting the scope of lateral movement by attackers. In digital signage scenarios, the ideal approach is to place signage devices in a dedicated VLAN (Virtual Local Area Network), allowing only necessary one-way or restricted communication with content management servers, while denying access to office networks, financial systems, or customer databases. Even if a signage terminal is compromised, attackers cannot use it as a springboard to penetrate core business operations. The core principle of segmentation strategy is least-privilege communication: only open ports and protocols required for business, and block everything else by default. Combined with firewall rules and intrusion detection, network segmentation can significantly raise the cost of attack and is the most critical architectural defense alongside supply chain risk mitigation.

Supply Chain and Third-Party Risks

Billboard content is often provided by multiple third-party advertisers or content platforms—the more access points, the larger the attack surface. Any weak content source or management interface can become a springboard for intrusion.

A supply chain attack refers to attackers not directly targeting the ultimate victim but instead infiltrating through third-party software, hardware, or service providers that the target relies on. In the digital signage ecosystem, this risk is particularly pronounced: a single screen's content may come simultaneously from ad exchanges, content delivery networks, local media players, and remote management software—each layer involving different vendors and access protocols. The SolarWinds incident exposed in 2020 is a classic example of a supply chain attack, where attackers compromised approximately 18,000 customers—including multiple U.S. government agencies—by tampering with legitimate software update packages. The digital signage industry faces risks based on similar logic: a single compromised content source or management interface can become the entry point for controlling a large number of screens. Therefore, conducting security assessments of third-party access and requiring suppliers to commit to security updates are tasks operators should fulfill at the procurement stage.

Attack Motives and Impact Analysis

In terms of motive, hijacking public screens to play pornographic content is typically not for financial extortion but rather for showing off, pranks, or deliberately causing social embarrassment. The technical barrier to such attacks is not high, yet they can quickly generate public attention and media coverage, causing direct reputational damage to operators.

For Egypt and Malaysia, the impact extends beyond individual billboards. It sends a warning to all industries relying on public digital signage—transportation, retail, sports venues, urban information screens: the boundary between the physical and digital worlds is blurring, and screens are entry points. Although discussion on Hacker News was limited, such incidents are often regarded within the security community as typical examples of gaps in IoT security governance.

Implications for Operators and the Industry

To reduce such risks, operators need to harden defenses at multiple levels. Mandating default password changes, implementing multi-factor authentication, and isolating signage networks from core business networks are the most basic yet most effective measures. Access permissions to content management systems should follow the principle of least privilege, and third-party access must undergo security assessment.

At the industry level, security standards and regulation for digital signage remain lagging. Compared to personal computers or smartphones, public screens have lower firmware update frequencies and fewer security audits, and the division of responsibility between vendors and operators is often unclear. The incidents in Egypt and Malaysia may push more operators to make cybersecurity a mandatory element of procurement and operations—rather than an add-on for after-the-fact remediation.

For the general public, such incidents remind us that seemingly ordinary street billboards are backed by networked computing systems. The security of digital infrastructure has long ceased to be confined to data centers.

Conclusion

The hijacking of a highway billboard in Egypt and display screens in Malaysia is small in scale but carries strong symbolic significance. It once again proves that any networked device can become an attack target, and public screens—due to their visibility and social impact—deserve particular vigilance. Security gaps are often only acknowledged after incidents occur, but for operators, proactive hardening is far more economical than post-incident public relations.

One-line Summary

Public screens in Egypt and Malaysia were hijacked by hackers to play pornographic content, exposing the widespread security vulnerabilities of digital signage systems.

Paragraph Summary

A highway billboard in Egypt and multiple display screens in Malaysia were recently hijacked by hackers and used to play pornographic content. The incident drew attention on the Hacker News community but received limited discussion. The article points out that public digital signage systems neglect security in pursuit of convenience and efficiency, commonly suffering from unchanged default credentials, insufficient network isolation, and high third-party access risks—making them easy targets. Such attacks have a low technical barrier and are mostly motivated by showing off or pranks, but they have direct reputational and social impact on operators. The article recommends that operators enforce default password changes, implement multi-factor authentication, and conduct network segmentation, while calling on the industry to improve security standards and regulation—making cybersecurity a mandatory element of procurement and operations rather than after-the-fact remediation.