Opinion: Airport Departure Boards Are Soft Targets, Says Security Exec
2026-10-27 · via Digital Signage Today
Airport digital signage, from flight information display systems (FIDS) to gate and baggage boards, is built on ordinary computers that often go unpatched and unmonitored for years, according to a new opinion piece from Kumar Abhinav, VP at Veratas, published on Digital Signage Today.
Abhinav's argument matters to anyone running a large screen estate: these displays are operational systems, not just marketing surfaces, and a compromised board can move thousands of people in minutes. He cites two real incidents to make the point. In 2016, hackers took over public FIDS at two major Vietnamese airports to display political messages. In 2018, a cyberattack forced Bristol Airport to pull its passenger-facing displays offline for two days, with staff reduced to using whiteboards.
The piece distinguishes between legacy setups, where an external PC-based media player drives each screen, and newer system-on-chip (SoC) displays with compute built into the panel. Abhinav says large airports typically run both side by side, and each needs its own security baseline, with older media players replaced first since their operating systems are harder to patch.
A tiered approach to network isolation
Rather than treating all signage the same, Abhinav proposes four isolation tiers reviewed twice a year: Tier 0 for cloud-managed retail and advertising screens; Tier 1 segmented networks for lounges and wayfinding; Tier 2 unidirectional data diodes, which he calls the minimum standard for FIDS, baggage displays and gate screens, allowing flight data in but nothing out; and Tier 3 full air-gapping for security control-room displays.
He also flags AI-driven signage, such as queue forecasting and automated gate-change messaging, as a new risk surface, warning that hidden instructions in a ticker feed could manipulate an AI system and that a convincing fake security alert costs little to produce. His recommended safeguard is a human approver on every AI-generated message reaching a public or safety screen, with AI never permitted to author flight status, security instructions or evacuation guidance.
Most of the fixes Abhinav lists are procedural rather than expensive: building a full inventory of screens, changing default PINs, locking displays into kiosk mode, isolating signage on its own network, closing CMS consoles exposed to the internet, requiring multi-factor authentication and a second approver for safety messages, and rehearsing a 60-second fallback to a holding screen.
The piece references CVE-2024-7399, a vulnerability reportedly exploited in a widely used signage CMS in 2025, as evidence the threat is not hypothetical. It does not name the CMS vendor involved or detail how operators should verify whether their own platform was affected, which is the obvious follow-up question for anyone managing an airport or transit screen network.
The announcement in full
Reproduced from Digital Signage Today for reference. Digital Signage Magazine did not write the text below.
Airport screens are operational systems and an airport’s principal voice to passengers. Reassuringly, most protection depends on discipline rather than budget.
October 27, 2026 by Kumar Abhinav — VP, Veratas
It is 6:40 a.m., and the morning departure wave is at its peak. Security queues snake back toward check-in, and the coffee counters are three deep. Then every departure board flips to the same six words: ALL FLIGHTS CANCELLED. LEAVE THE TERMINAL IMMEDIATELY.
Nobody in the operations center sent it. That hardly matters. People trust what screens tell them, and within seconds thousands are on the move.
I wish this were pure fiction. In 2016, hackers seized the public flight information display systems at two of Vietnam's largest airports to broadcast political messages. Two years later, a cyber attack led Bristol Airport to take its passenger-facing flight information displays offline for two days; staff resorted to whiteboards.
Compute capability comes with every screen
A large airport can run thousands of screens: flight and baggage boards, gate and check-in displays, lounge screens and advertising walls. Every one of them relies on compute capability. Legacy installations, including many FIDS and baggage information systems, use an external media player, typically a PC behind the screen. Many modern displays are SoC-based (system-on-chip), with compute built into the display. Large estates often run both.
Either way, each screen depends on an operating system, a network connection and a password, whether or not anyone remembers what it is.
Screens make tempting targets for three reasons. They run unattended for years. Everyone sees them, so a hijack commands an instant audience. And ownership is divided among the operator, airlines, concessionaires, advertisers and integrators, so no single party owns the risk.
External players and SoC displays . External media players are full computers, often running ageing operating systems that are hard to patch, where nobody checks. SoC displays remove that extra box but concentrate trust in the manufacturer's firmware, which must be kept current and locked down. While the two coexist, each needs its own security baseline, with the oldest players replaced first.
Where screens are managed . Cloud management suits retail and advertising. Hybrid estates, cloud-managed with an on-site server for resilience, suit wayfinding and lounges but leave the most doors to lock. On-premise systems keep everything inside the airport, with flight data fed from the Airport Operational Database (AODB). Full control brings full responsibility; this is the natural home for FIDS and BIDS. The choice matters. A gate screen calling the wrong flight sends two hundred passengers to the wrong aircraft and delays a departure. That is why I decide screen group by screen group.
"Just keep it off the network" sounds sensible. In practice, isolation fails in mundane ways: a contractor plugs a USB stick into a media player, nobody switches off a display's Wi-Fi, or a vendor's 4G support modem lies forgotten in a cabinet.
I use four isolation tiers, set per screen group and reviewed twice a year.
Tier 0, connected: hardened, cloud-managed retail and advertising screens.
Tier 1, segmented: lounges and wayfinding on a separate network, outbound traffic blocked by default.
Tier 2, unidirectional: a hardware data diode lets flight data in but nothing out. The minimum for FIDS, BIDS and gate displays.
Tier 3, full air gap: no network path; content is loaded through a controlled kiosk. Reserved for security control-room displays.
AI is making airport screens more useful: forecasting security queues, pushing gate changes, translating messages and nudging crowds away from bottlenecks.
It also creates new ways to put the wrong message on screen. Instructions hidden in a news ticker can hijack an AI. A convincing fake security alert costs almost nothing. Queue-counting cameras gather personal data protected by India's Digital Personal Data Protection Act, 2023. And auto-publishing can reach hundreds of screens before anyone checks a word.
A person approves every AI-generated message before it reaches a public or safety screen.
Camera images are processed on the device and discarded, so only anonymous counts leave it.
AI never writes flight status, security instructions or evacuation guidance.
Where signage is weakest and how to fix it
In my experience, most hijacks exploit basic gaps:
No one knows how many screens there are. Build a single inventory, including airline and advertiser screens.
Factory PINs and passwords. Change every one on displays, media players and the content management system.
Live USB ports, open menus and convenience features. Lock displays and media players into kiosk mode and disable those features.
Ageing media players and old firmware. Patch what you can, and retire or isolate anything that no longer receives updates.
Signage on a shared network. Give signage a network of its own, separate from airline and tenant systems.
CMS consoles open to the internet. Close them. In 2025, attackers were reported exploiting a vulnerability in a widely used signage CMS server (CVE-2024-7399).
One login can publish anything. Require multi-factor authentication and a second approver for flight and safety messages.
Unchecked content. Play only digitally signed files, so anything tampered with is rejected.
No plan for the bad day. Build a safe mode that switches any screen group to a holding message within 60 seconds, and practise it quarterly.
Airport screens are operational systems and an airport's principal voice to passengers. Reassuringly, most protection depends on discipline rather than budget.
Every departure board runs on a computer. It is time someone guarded it.
Product and commercial leader with 21+ years of experience building, launching and scaling enterprise products across India and international markets. Career spans R&D-led product management, market-facing product leadership, B2B SaaS, enterprise platforms, hardware-software systems and national-scale digital programmes. Has owned the lifecycle from market discovery and requirements through engineering, launch, adoption and portfolio optimization, while working directly with sales, partners and customers to deliver revenue and market growth..
OptiSigns is a cloud-based digital signage software that helps organizations create, manage, and scale engaging screen content across any display. With powerful integrations, flexible scheduling, and easy remote management, OptiSigns makes digital signage simple for teams of any size.
Get the latest news and resources from Digital Signage Today.