Archive — US — techcrunch
Bug in FIFA World Cup internal system gave anyone ability to modify TV stream
A security researcher exposed a flaw in FIFA's internal system, allowing unauthorized access to control TV broadcasts of World Cup games. By registering as a player agent, she exploited a vulnerability in FIFA’s API, potentially enabling an attacker to hijack broadcasts. FIFA addressed the issue shortly after it was reported, but did not acknowledge the researcher.
Key points
- A security researcher named BobDaHacker discovered a flaw in FIFA's internal systems.
- The flaw allowed access to the TV broadcast system by registering as a player agent on FIFA's platform.
- Due to inadequate authorization checks in FIFA’s back-end API, she gained control over the broadcast feeds.
- The researcher indicated that a single attacker could manipulate broadcasts, including the possibility of prank content like rickrolls.
- FIFA was notified of the flaw and addressed it within hours, but did not acknowledge the researcher publicly.
Why it matters
- Cybersecurity has become pivotal in major events; similar issues have been highlighted in the context of global sporting events.
- Potential hacking incidents in FIFA's system echo global concerns regarding vulnerabilities in sports broadcasting.
- Such security lapses reflect ongoing IT trends in 2025 focusing on authorization protocols and API security.
This incident underscores the importance of robust security measures in high-profile organizations like FIFA, highlighting vulnerabilities that could be exploited and the necessity for transparency in addressing such security flaws.