Hacking LED Signs
by Bernie S.
We've all seen them - those annoying, attention-getting LED signs with moving, flashing messages. They're in airports, train stations, bus terminals, vending machines, retail establishments, banks, and even government offices. Almost without exception, they're in high-traffic areas where lots of people are subjected to their not-so-interesting messages.
This article provides a brief overview of most types of displays out there, how they're programmed, and how you can use them to get your message out to the people. In no way should this article be misconstrued as encouraging unauthorized programming of such signs, for that would be in violation of State and Federal laws and punishable by up to 10 years in prison. No matter how harmless the method may seem, expressing yourself in ways our government doesn't approve of can be hazardous to your health. (Maybe all electronic hardware and software should have government warning labels similar to cigarettes and alcohol.) In any case, be forewarned.
Most LED signs out there are self-contained, microprocessor-based units that are field-programmable by a variety of methods depending on the manufacturer, model, and configuration. These methods include direct RS-232 connection, telephone modem, proprietary or PC keyboard connection, wireless telemetry (via cellular modem, packet radio, ARDIS or RAM radio data networks, FM broadcast via SCA or RDS, or Motorola paging data receiver), and wireless infrared keyboard programming. Older "dumb" LED signs require constant connection to a proprietary or PC-based data source, which stores messaging data in addition to controlling the LED display. All use multiplexed light emitting diode arrays, from tiny one-line units only a few inches long to massive 16x40 foot models.
The total quantity of LEDs can number from a few hundred to hundreds of thousands depending on the size of the array. The CPUs are usually 8-bit microcontrollers and memory is usually low-power static RAM backed up by battery to ensure messaging data aren't lost if power is removed from the system. Small to medium-sized LED signs are usually powered by an AC adapter, with the voltage being filtered and regulated on the sign's main circuit board. Currently there appears to be little or no standardization between different manufacturers of LED signs with regard to messaging protocols, programming commands, memory mapping, CPU type, or data connectors.
Some models are fairly intelligent and allow for multiple and scheduled messages, and special effects like rotation, scrolling, zooming, bitmapped graphics, and multiple colors (using rapidly switched red and green diodes at various duty cycles). Blue LEDs are still too expensive to use in volume, which is why you don't see any blue or true-color LED signs yet. When blue LEDs are cheap, all primary color requirements will be met and any color in the spectrum will be easy to generate, like the color cathode ray tubes in TVs and computer monitors do. Eventually, giant full-color LED video billboards will be commonplace.
Alongside highways and on bridges, overpasses, and toll booths are all popular locations for large dynamic text displays for informing automobile travelers of road and traffic conditions and toll fares. These large dynamic text displays using arrays of incandescent bulbs or electromechanical flippers painted fluorescent green and illuminated by black light are often placed alongside highways or on overpasses to inform automobile travelers of road and traffic conditions. "Portable" programmable road signs are often mounted on wheels atop a small trailer (complete with gasoline generator and a dedicated PC or proprietary controller or cellular modem) and towed to road construction sites as needed. Surprisingly, the metal cabinet containing the programming electronics is seldom (or insecurely) locked.
Supermarket chains hang LED moving-message displays in store aisles to announce specials and promote products. These signs are usually networked and fed a datastream received by a Very-Small-Aperture Terminal (VSAT satellite dish) on the roof. UPC barcode scanners at point of sale terminals connected to the store's LAN/WAN allow real-time tracking of the signs' effectiveness. LED signs are often used on factory floors to display production run data to assembly-line workers, or in call centers to indicate call volume, ANI data, or other information to telephone operators. Stock markets and brokerage houses use LED moving-message signs to monitor real-time stock and bond prices. These units are usually hardwired via an RS-232 interface to a computer receiving data from another source. An advertising company called TDI has even installed moving-message LED signs on the outside of certain NYNEX payphone booths in midtown Manhattan which are remotely programmed with new ads via a Motorola paging data receiver mounted on top of the booth.
If you come across a programmable sign (say, at a garage sale but there is no manual or programming device with it) get the manufacturer's name off the unit and contact them for an operations and programming manual for that model. Often, you can get it free if the company believes you're a previous customer. Also request a catalog of accessories for that model; it will be helpful in determining specifically what additional hardware you'll need to program and power it. There are so many manufacturers, models, and programming interfaces out there that it's not always obvious how to go about it without proper documentation or social-engineering one of the manufacturer's technicians.
Of all the programming methods available, one of the most convenient and intriguing is via an infrared keyboard. The technology is similar to TV remote controls: it's a one-way low-speed data link using an invisible light beam. Range is limited to about 30 feet which of course is line-of-sight. You can usually tell if an LED sign has infrared programming capability by looking at it carefully. One of the corners of the front of the sign will have a small window with a red filter over it, behind which is an IR phototransistor for detecting the keyboard's signal. The signal is demodulated and decoded on the main circuit board and sent on to its CPU for processing. From the manufacturer's name on the sign (usually on the front bezel) you can determine the type of infrared keyboard necessary to program it. Fortunately, these keyboards are not expensive.
The most popular manufacturer of LED signs seems to be Adaptive Micro Systems (Milwaukee, WI) because they have a large selection of well-designed models, with most features one might want - and at reasonable prices. The author has seen AMS's ALPHA series of signs in numerous commercial and government applications. Their BETA-BRITE model is extremely popular with retail establishments and vending machine companies because it's small (but not too small), versatile, and relatively cheap (about $300). It has numerous features, including a built-in infrared interface and an RS-232 port for downloading complex scripts directly from a standard PC. In addition, their infrared keyboard controller (which looks like a mutant TV remote control) is well-designed and allows programming of all their IR-capable models. It costs about $70.
Anyone so inclined could write a computer program to enable laptops with IrDA ports to program infrared-capable signs, thus eliminating the need to use a dedicated IR keyboard controller and allowing rapid programming of entire sequences via infrared. Laptop IrDA emitters are fairly weak, but one of those TV remote control extenders should boost a laptop's IR signal to at least 30 feet. Naturally, an infrared keyboard controller would first have to be obtained and its command sequences "learned" to write such an application, but IrDA shareware utilities for learning TV remote-control units' command sequences are readily available on the Internet.
The author has heard of several humorous situations involving LED signs programmed by unauthorized parties. In one case, a state-owned lottery ticket vending machine with an LED sign mounted on it was located in a drugstore. It had apparently been reprogrammed from the street through the drugstore's main window using an infrared keypad to say, "This machine sells only losing tickets - don't waste your money on another government scam!" When this was called to the store manager's attention, he panicked and began wildly pushing all the vending machine's buttons in a futile effort to delete the message, eventually unplugging the entire machine (preventing it from vending tickets altogether).
In another case, an LED sign on a prepaid phone card vending machine in a major train station had been reprogrammed to say, "These phone cards are a total rip-off at 50 cents a minute!" The machine didn't indicate the true cost of the cards; a call to the vending company confirmed they were indeed 50 cents a minute, so some hacker arguably provided a valuable consumer advisory service.
Someone reprogrammed the LED sign in the main window of a major metropolitan bank (which had been hawking high-interest loans) to say the bank was offering a special one-day sale on new hundred-dollar bills for only fifty dollars each (one per customer). There were some rather excited people lining up until the chagrined bank manger finally unplugged the sign and had to explain to eager customers that the bank wasn't so generous after all.
An observant 2600 reader wrote in to the letters column to say he'd noticed a large LED sign by the escalators at New York's 53rd and Lexington subway station (by Citicorp Center where monthly 2600 hacker gatherings are held) had been reprogrammed to announce the time and dates of the hacker gatherings, inviting everyone to come. Previously, the sign merely advised people to watch their step on the escalator. Tens of thousands of people a day got to read that sign; that's real power. There must be tens of thousands more LED signs out there just begging to be programmed with more interesting messages. Do any come to mind?
The following URLs are for websites belonging to various LED sign manufacturers. You can contact these and other manufacturers directly for more information:
Note: AMS's infrared-capable LED signs all incorporate password protection to prevent "unauthorized" programming. This feature must be specifically enabled by the user, and most users seem to forget to do this. If you forget your password, there is an undocumented master default password. Telling you what it is would take all the fun out of it, but it's six characters long and it appears on computer password screens everywhere (system). Have fun! And be careful.