Hacking the price tag: when the shelf label believes anyone

TL;DR

The little digital price tags clipped to supermarket shelves look official, and we treat them that way: whatever number they show is the price, no questions asked. They update themselves wirelessly, so a store can change thousands of prices from a back office over a few minutes. What almost nobody realises is that on some of these systems, the channel that updates them has no lock on it at all, which means a stranger standing right in front of a tag with a cheap gadget can make it say whatever they like.

These are Electronic Shelf Labels, or ESLs, and they are a small, strange corner of security that says something much bigger about trusting screens. I put TagTinker in the Evil-M5Project because changing a price on your own test tag, just once, makes a point that matters far beyond a supermarket: a screen is only ever as trustworthy as the channel that feeds it, and a surprising number of the screens around us are fed over channels that never learned to ask who is talking.

The tag we never question

Think about how completely you trust a price tag. You glance at the number on the shelf, you put the thing in your basket, and you have already decided what it costs, without a flicker of doubt about where that number came from. The little e-ink label is a tiny screen, and we treat whatever it displays as simply true, the same way we treat a clock or a road sign. That reflexive trust is the whole point, and it is also the whole vulnerability.

Because on a good number of these systems, the number on the tag is not a fact the store guards closely. It is just the last message the tag happened to receive, from anyone who knew how to speak to it. This is a small, almost comic problem on a shelf edge, but it is a clean, visible example of a pattern that turns up in things that matter a great deal more than the price of a tin of beans. Let me show you how these tags work, how little it takes to rewrite one, and why that should bother you slightly more than it first seems.

What a shelf label actually is

An ESL is a tiny e-ink display, the same low-power screen technology as an e-reader, which is exactly why it can run for years on a small battery and keep showing an image even with the power off. That property, holding a picture with no power, is why a shelf of them does not go blank in a power cut, and why they are cheap enough to put on every product in a shop. It has no keyboard and no real brain of its own.

It sits there and waits to be told what to show, and a controller somewhere in the store sends it updates over a wireless link. Most big store systems use radio for this. A specific set of cheaper families, the ones the tool later in this article works on, instead receive a pulse of infrared light, the same invisible medium as a TV remote, though the tags speak their own, faster code. Either way, the tag’s entire job in life is to display whatever arrives, faithfully and without complaint. Crucially, it does not ask where the update came from, and that single omission is the whole story.

Rewriting one

That last part is the weakness, stated plainly. On a good number of these systems the update channel carries no authentication at all: the tag accepts a correctly formatted message from anyone who can reach it, because it was only ever designed to hear from the store’s own controller and nobody imagined it would hear from anyone else. There is no password, no signature, nothing for the tag to check. It simply trusts the format.

Once the protocol (the fixed language the tags listen in) is understood, and researchers have reverse-engineered several, meaning they worked out the undocumented format by studying the signals from outside, you can address a specific tag and push it a new image, new text, a different price, blink the LED on models that have one, flip it to another page, or simply blank it entirely. From the tag’s point of view, your message and the store’s controller’s message are completely identical, because there is nothing in either one that proves who sent it. It is, in the end, a screen that believes anyone who speaks its language.

Why a price tag is worth attacking

Changing a number on a shelf sounds like a prank, and often that is genuinely all it is. But a display that people trust is a display worth tampering with, and the consequences scale up faster than the silliness suggests. A wrong price causes confusion and arguments at the till. A shelf full of scrambled or blanked tags is a real headache that takes staff hours to walk round and put right by hand. And a mismatch between the shelf and the till is the kind of thing consumer-protection law takes an interest in.

More broadly, and this is the part that lifts it out of the joke category, it shows that a device quietly presenting something we act on, here the price of a thing, can be fed bad information by anyone standing close enough. The price tag is the visible, slightly comic version of a problem that is not comic at all: the screens and sensors we treat as authoritative, from a shelf label to a dashboard gauge to a public information display, often have no check whatsoever on who is feeding them the numbers we then believe.

Technical deep dive: e-ink, the infrared channel, and no authentication

This is the part worth slowing down on, and you can skim it if you only want the defenses. Three things combine to make these tags so open. The first is the display itself: e-ink is bistable, meaning each pixel holds its black-or-white (or limited colour) state with no power, so the tag spends almost all its life asleep and only wakes briefly to receive an update. That design is all about power budget, not security, and it shapes everything else.

The second is the channel. The families this tool addresses are driven by infrared, the same invisible light a TV remote uses, but with the tags listening for their own faster, denser code rather than a remote’s simple button presses. Infrared is line-of-sight and short-range, which is a limit for an attacker but also why the store felt safe: you have to be right in front of the tag. The third, and the fatal one, is that the protocol has no authentication. Thanks to reverse-engineering work by researchers, notably furrtek, who did the hard job of recovering the undocumented format of these infrared SmartTag families by studying their signals, the language the tags speak is understood well enough to address a specific tag by its identity and send it a fully valid command. The tag has no way to distinguish that command from the store controller’s, because nothing in the protocol was ever designed to carry proof of origin. Understanding the format is the entire barrier, and once it falls, a valid message is a valid message no matter who sends it.

Where it shows up

Mostly this lives in research and demonstrations, people poking at retail hardware to show how open it is, plus the occasional harmless prank. It is not, at the moment, a plague of shelf-tampering sweeping the world’s supermarkets, and it would be dishonest to dress it up as one. The realistic framing is retail and consumer trust: a store’s pricing is supposed to be controlled and auditable, and an unauthenticated tag quietly undercuts both of those guarantees in a way most retailers have never thought about.

Its more interesting place is in the pattern it belongs to. It sits right alongside the other control-channel stories in this series, the drone that obeys any phone, the garage remote with a fixed code, the home router that opens its own doors in the UPnP episode. Every one of them is the same theme wearing different clothes: a device taking orders, and acting on them, without ever checking who is giving them. The shelf label is just the one you can see with your own eyes in a shop on a Tuesday.

A strange morning on aisle six

Say you are Nadia, a shop manager, and one ordinary morning customers start coming to you because the prices on aisle six do not match what the till rings up. You go and look, and a whole row of tags is showing numbers you know for a fact you never set, with a couple of them displaying a cartoon instead of a price. Your first instinct is that the system has glitched, so you check it.

But nothing in your system logged a change, because as far as your controller is concerned, nothing changed. The tags were updated by something that was not your controller at all, speaking the same language from the other side of the shelf edge. You spend the morning walking the aisle resetting labels by hand, one at a time, quietly wondering how long it had been going on before a customer happened to notice, and whether any other aisle is doing the same thing where nobody has looked yet. Nothing was broken into. The shelf simply believed someone who was not you.

Why it works

ESLs were built for a friendly, practical problem: update a great many cheap displays, quickly, without running a wire to any of them. In that framing, authentication looks like pure cost. It adds complexity and power draw to a device that is meant to be nearly disposable and to run for years on a single coin cell, so plenty of systems simply skipped it, and for a long time nothing bad came of that choice.

And underneath the engineering trade-off sits a failure of imagination that runs through this whole series: nobody ever thought of a price tag as something worth attacking. It is a label on a shelf. Who would bother? That assumption, that the thing is too trivial to be a target, was the entire opening, exactly as it was for the drone and the garage remote. The weakness was not a bug anyone introduced. It was a question nobody thought to ask.

How to protect yourself

This one lands almost entirely on the retailer, with very little for a shopper to do, which is worth saying clearly so nobody leaves worried about the wrong thing.

If you run the retail system

• Choose an ESL platform that authenticates and encrypts its updates, so that a tag only ever accepts messages from the store’s own controller. The newer systems do this properly; the older and cheaper ones often do not, and that is the line that matters.
• Prefer platforms whose tags confirm their state back to the controller, so that an unexpected change raises an alarm instead of going unnoticed. Be aware that the one-way infrared families in this article usually cannot report back, which is exactly why a rogue update there can stay unlogged, so for those, spot-check shelf prices against your system of record.
• Treat the shelf edge as an attack surface in your audits, the way you already would a payment terminal. It displays a number that both your customers and the law care about, which makes it worth the same scrutiny.

If you are a shopper

• There is little you need to do, and this is genuinely not something to worry about at the checkout: the price you pay is set by the till, not read off the tag by magic. If a shelf price and the till disagree, that is a perfectly normal thing to query with staff, and in many places the lower advertised price is the one you are owed.

Doing it with the Evil-M5Project

Evil-M5Project, the firmware I build, includes TagTinker, a tool for driving Electronic Shelf Labels over infrared using the Cardputer’s IR light. It builds directly on the ESL protocol research by furrtek, who did the hard work of reverse-engineering the infrared SmartTag families these tags belong to, and it exists to make the whole thing concrete on a tag you own.

• It can push images (with dithering, which fakes shades of grey using patterns of dots so a photo still reads well on a one-bit black-and-white or colour e-ink screen), text, or freehand drawings to a tag you are addressing.
• It can broadcast simple commands to tags in range: blink their LEDs, show a debug screen, or flip pages.
• It recognises dozens of tag models automatically, so it knows each one’s resolution and colour mode without you having to tell it, and there is a web interface for doing all of this from a phone.

The honest limits keep it firmly in its place. Infrared means line of sight and close range, so you have to be right in front of the tag and pointing at it, which is why this is a shelf-edge trick and not an across-the-store one. It only works on the ESL families that use this open infrared protocol, because systems with authenticated or encrypted updates simply ignore it, which is the whole fix in one sentence. And it only changes what a tag displays: it is not a way into the store’s network or its pricing database, just a message to a trusting little screen.

Evil-M5Project is for ethical and educational use only. Only drive ESL tags you own or are explicitly authorized to test. Tampering with prices in a real shop is fraud, and this exists to show the weakness, not to commit it.

Firmware and docs: https://github.com/7h30th3r0n3/Evil-M5Project.

A screen that believes anyone

The hackable price tag is a small thing, and that is exactly why it makes such a good lesson. We have quietly surrounded ourselves with cheap screens and sensors that show or report something we take as true, from the shelf edge to the lobby display to the gauge on a wall, and a surprising number of them are updated over channels that never learned to ask who is talking. A shelf label is the friendly, visible version of that problem: tamper with it and the worst case is a confused queue and an annoyed manager.

The same design in something that matters more is a far quieter problem with the exact same root. I put TagTinker in Evil-M5Project because changing a price on your own test tag, just once, drives home a point that outlasts the demo: a screen is only ever as trustworthy as the channel that feeds it, and « it is just a little display, who would bother » is precisely the sentence that leaves the channel unlocked.