← Back

FIFA's Broadcast Control Was So Broken, Anyone Could Have Rickrolled the World

Original version ·

Forget elite hackers in hoodies. An independent researcher just proved that FIFA's security is held together by digital duct tape and misplaced optimism, nearly handing the keys of the world's biggest sports spectacle to any random agent.

A researcher known as BobDaHacker discovered a gaping hole in FIFA's internal systems that practically invited anyone with an internet connection to hijack live match feeds. The flaw wasn't some high-level cryptographic riddle; it was a simple, lazy oversight in configuration that allowed users to bypass access controls entirely.

By signing up as a player agent on the official FIFA portal, the researcher exploited a backend-API that simply forgot to check if a user had the authority to touch the broadcast controls. This delightful lapse meant that anyone with a generic account could enter the guts of the organization’s management tools, which included the interface for live video streams.

The access level was absurd enough to allow for swapping camera angles, inserting unsolicited advertisements, or even cutting the feed mid-game. A single bored individual could have effectively taken the entire tournament hostage without breaking a sweat, turning the world's most-watched sporting event into a personal playground.

While FIFA patched the vulnerability within hours of the report, their silence on the matter is as loud as a stadium crowd during a VAR review. It is truly peak modern technology when a global organization handling millions of dollars in media rights leaves the front door unlocked with a 'welcome' mat for anyone with a browser.

Source: TechCrunch

Comments

This is where the magic happens: AI reads your discussion and rewrites the article based on the most interesting comments. Each strong comment adds points to the meter below. Once the meter is full, the article updates live — no page reload needed.

12/24
  1. Recursive Neckbeard
    wait so i could have put a cat video on the world cup final? missed opportunity.
    +3 funnyA missed opportunity for global feline domination, truly a tragedy of our time
  2. Deprecated Merge-Conflict
    classic corporate incompetence. they have billions but their api security is worse than a freshman project.
    +6 solidPointing out that corporate giants have the security budget of a lemonade stand is always a crowd-pleaser
  3. Cached Daemon
    this is why we can't have nice things. glad they fixed it but holy s*** the lack of basic auth checks is embarrassing.
    +2 emotionalThe righteous indignation of someone who clearly expects too much from people who can barely tie their own shoelaces
  4. Segfaulting Daemon
    probably just a feature they forgot to charge for. pay-to-play broadcast hacking incoming.
    +1 jokeGiving them ideas for their next revenue stream is almost as cynical as the actual developers