Why the device is the weak point
Most signage is hacked through the device, not the cloud: default passwords, an open port for remote support, firmware nobody updated. A compromised player shows what the attacker wants to the public, and it is a computer inside your network that can be used to reach further in. The fixes are known; the work is doing all of them on every device, for as long as it is on the wall.
How a ScreenlyOS device is protected
These apply to every device running ScreenlyOS: Screenly Players, Raspberry Pi, Scala players and Sharp displays. Where one depends on the hardware, it says so.
- 01
Nothing to log in to
No open ports, no remote login, no default credentials and no backdoors. Connection attempts on port 22 are refused because there is no SSH on the device at all.
- 02
Signed, transactional updates
The operating system and the player update together, automatically and without interrupting playback. Every update is cryptographically signed, a device rejects anything that fails verification, and an update that fails rolls back.
- 03
Processes kept apart
Linux kernel namespaces, cgroups, AppArmor and Seccomp isolate every process, so a fault in one part of the device cannot be used to reach the rest, run system commands or install tools.
- 04
A hardware root of trust
Applies to: Screenly Player Max
A TPM and Secure Boot. Each stage of the boot checks the next, so the device starts only software Screenly signed, and the TPM holds the device's identity and keys so they cannot be copied off the board.
Lock the BIOS on a Player Max - 05
Encrypted storage
Storage is encrypted where the hardware supports it.
- 06
Built on Ubuntu Core
ScreenlyOS is built on Ubuntu Core, in partnership with Canonical since 2017. Each Ubuntu Core release has a published support timeline, and the current one runs until 2034.
Lifecycle and support - 07
An SBOM for every release
Each ScreenlyOS release ships with a software bill of materials, published in the trust center, and third-party dependencies are audited regularly.
A ScreenlyOS device or the Screenly app
Screenly also runs as an app on Samsung, LG and Android TVs, streaming sticks and web browsers. The app gets what its host system allows, and the host's maker decides the rest.
| Topic | Screenly app on a TV, stick or browser | ScreenlyOS device |
|---|---|---|
| Operating system updates | The device maker's schedule | Screenly, signed and automatic |
| Remote login and open ports | Depends on the device | None |
| Its own certificate for your servers | No | Yes |
| Credentials for dashboards | Kept on Screenly's servers; content rendered there | Encrypted for the device |
| Screenshots | Depends on the platform | Yes, unless privacy mode is on |
| TPM and Secure Boot | Depends on the device | On Screenly Player Max |
Questions
Can a device be reached or logged in to remotely?
Not a ScreenlyOS device. It has no open ports, no default credentials and no backdoors, and connects outbound only.
Are device updates signed and checked?
Yes. Updates arrive automatically, signed and transactional, and a ScreenlyOS device rejects any update that fails verification.
Do devices have a TPM and Secure Boot?
Screenly Player Max does. Each boot stage checks the next, and the TPM holds the device's identity.
Is there an SBOM for the device software?
Yes. SBOMs for Screenly, the Screenly Player Max models and Anthias are published in the trust center at trust.screenly.io, produced and attested for each release.
Are end-of-life dates published for the device software?
Yes. End-of-life dates for ScreenlyOS are published.
Do we have to buy Screenly hardware?
No. ScreenlyOS also runs on Raspberry Pi, Scala players and Sharp displays, with the same protections. What a Screenly Player Max adds is the TPM and Secure Boot.