VULNpocalypse
MediumVulnerabilityMonitoring

Billboard hijacks in Egypt, Malaysia and Brazil show explicit video

Explicit video appeared on LED billboards in Egypt, Malaysia and Brazil; operators should keep screen content systems off the public internet.

Published
Updated
Exploitation
Yes, the Egyptian operator confirmed unauthorised access and the Brazilian operator confirmed a cyberattack; the group Leakers$ claimed responsibility

What happened

On Thursday, Oct. 29, sexually explicit footage appeared on a large electronic billboard on the 26 July Corridor in Giza, Egypt. Authorities suspended advertising displays along the road and opened an investigation, The Cairo Report reported.

The Cairo Report names the operator as Arabian United, an Egyptian-Saudi advertising venture of United Media Services (UMS) and Arabian Contracting Services Co. India Today calls it Al Arabia United. Both outlets say the operator stated that an unknown party gained unauthorised access to one of its screens. It switched the screen off and is investigating with the authorities (The Cairo Report, India Today).

India Today also reports similar incidents in two other countries (India Today):

  • Malaysia: the Kluang Municipal Council confirmed that several public LED screens in Johor displayed obscene content. The council switched the screens off and police opened investigations. The report does not say whether the council confirmed unauthorised access.
  • Brazil: an LED panel near the BR-343 highway in Campo Maior, Piaui, showed explicit footage. Its operator, Ferreira & Ferreira Publicidade e Comunicacao, confirmed a cyberattack, shut down the equipment and filed a police complaint.

How the screens were compromised is not confirmed. The sources give different accounts:

  • Egypt’s Interior Ministry said the website of an unnamed international company had been hacked, and that the same footage appeared in several countries at once. It did not name the company, all the countries affected, or any suspects. It gave no technical explanation (The Cairo Report, India Today).
  • The group Leakers$, which runs a Telegram channel, claimed responsibility. It told The Cairo Report that it exploited “a genuine vulnerability in the software responsible for transmitting content to LED displays”. It also said there were weaknesses accessible through the system’s own pages and interfaces. The group said an automated scan of about two hours found thousands of exposed systems, and it claimed access in Iraq, Malaysia, Brazil, China and elsewhere. The Cairo Report notes that the group did not provide enough technical evidence to establish the precise method (The Cairo Report).
  • Security sources quoted by Al-Shorouk, as cited by The Cairo Report, said investigators were examining two possibilities: an external intrusion, or an upload by someone responsible for operating the screen (The Cairo Report).

India Today, citing CNN, reports that the Egyptian screen showed the handle @LeakersGov and the names of group members (India Today). The group said it was not seeking ransom or donations (India Today, The Cairo Report).

Am I affected?

  • Software and versions: the sources do not identify the content software, its vendor or any affected versions. These details are not confirmed.
  • CVE and patch: not confirmed in the sources. No fixed version is confirmed.
  • Who could be at risk: based on the group’s claims, operators whose screen content systems or web interfaces are exposed to the internet (The Cairo Report). It is not confirmed whether a specific product flaw, weak protection, or another cause was involved.

What to do now

The sources do not identify the vendor or software. The steps below are therefore general hardening practice, not sourced vendor guidance.

  1. List every system used to push content to your screens, including web panels and remote management interfaces.
  2. Check whether any of those systems can be reached from the public internet. If they can, restrict access to trusted networks or a VPN.
  3. Replace default or weak credentials on those interfaces.
  4. Review recent content uploads and access logs for changes you did not make.
  5. Ask your signage software provider whether it knows of this incident and whether an update is available.

Sources