FIFA WC26 streaming Hack and Advanced AWS Loadbalancing

all right so welcome back and let's talk about the world cup now specifically about how the entire global broadcast of the world cup was for a little while not like it was it really hacked but for a little while it was actually sitting on really thin line where it can go anywhere now let me set the scene it's june 2026 fifa the organization that run the sports is managing the biggest broadcasting events on the planet billion of viewers i mean a lot of camera angles a lot of commentators single feed worldwide everything funneled through fifa system i mean when i was reading about broadcasting as a whole now it's just a little bit off route from our actual news I'm from India and the news was that actually no one was ready to broadcast FIFA World Cup in India because of the high prices they were charging to all the broadcasters.

Of course, they have like a certain cap which any broadcaster have to maintain and which was really high for Indian broadcasters because India was not in the World Cup.

So it of course, for them, it was like doesn't make sense to pay that much amount of money.

and then that's when i realized the big amount which fifa gets when someone someone gets this contract of streaming some services like fifa of official services in their country finally fifa world cup is being streamed in india so it's not like people in india are not able to watch i'm not based in india so of course i can watch in sky sports in uk so that's fine but anyhow so there was a hacker back to our news now there was a hacker going by the name bob the hacker who was looking all of that just like me and he actually got in so i was not able to go to get in because i didn't even try but he managed to get in And not through like some elite zero-day vulnerabilities or maybe trying to drop a USB drive where you have some of the parking lot in which FIFA officials were going on and someone like take the USB drive and put it in their system.

So it's not those like fancy ways of hacking an organization.

But he signed up as a football agent.

Now, if you are not aware of football agents, these are like those men or they can be women as well, to be honest.

It doesn't make any difference.

So any person can be acting as a football agent.

What they have to do is they have to negotiate transfers.

They take maybe 10% or 15% of some, I don't know, 19-year-old who want to sign up for a club in Portugal or England.

So anyone can apply for that because, of course, FIFA wants more and more agents to be on their platform.

They want more and more talents to come up.

So how you can register yourself as an agent on FIFA? Well, you upload your ID, verify your email, and that's it.

FIFA will create a nice account for you on their Microsoft Entra system.

Well, normal.

It's cool, right? well except that this is the part that it should make every it personnel like me spill up their coffee because that agent account lives in the exact same tenant where you have fifa's core internal systems so the stuff that is actually running the actual tournament so your user id your groups your credentials your all the authentication is going via the same entra system where you have hosted your own servers where you are handling the whole streaming so mr bob the hacker he walks around tries to access fifa's core data platform and of course fifa is a good organization right he gets hit with the access denied message well great he thinks security is working but it isn't because that access denied message was just you know website being polite like hold on you're not allowed can can you stop doing this but the back end the actual server which is supposed to act as like second guardian That server didn't care.

So once you get the key, so once you get past that initial front end website, you basically can go anywhere.

So there is no second level authentication anywhere.

So Bob described this as one of the most common patterns you see in companies that build some sort of like a beautiful front door, which will say like, you shall not pass, sign taped on it.

but they just leave the back door just unlock which even with slight breeze it just blows and open so what did that get him of course he was able to go into the live production hub for the entire world cup broadcast so he was able to see every camera feed every stream and not just viewing access he was able to control it as well if he would have wanted so he could have i don't know blacked out a match mid game so just imagine you're watching your i don't know down with like three or four pints you are cheering for your team and then suddenly it's a blackout or worst there is someone who is playing some other weird clip while you're watching that game i don't know it gets scarier right so this person can do actually anything during a live world cup match so billions of people tuning in and then instead of like watching the game they could have just listened to some song because this guy can do anything so it's it's really getting crazy and scary now now naturally being a responsible human being and not a bad person to the society he tries to report this to fifa and where it gets funnier now fifa actually have no contact for security.

So there's no sort of like vulnerability disclosure policy.

There's no bug bounty, nothing.

So they think themselves like we are the big guy.

We are the big shots.

all right so welcome back and let's talk about the world cup now specifically about how the entire global broadcast of the world cup was for a little while not like it was it really hacked but for a little while it was actually sitting on really thin line where it can go anywhere now let me set the scene it's june 2026 fifa the organization that run the sports is managing the biggest broadcasting events on the planet billion of viewers i mean a lot of camera angles a lot of commentators single feed worldwide everything funneled through fifa system i mean when i was reading about broadcasting as a whole now it's just a little bit off route from our actual news I'm from India and the news was that actually no one was ready to broadcast FIFA World Cup in India because of the high prices they were charging to all the broadcasters.

Of course, they have like a certain cap which any broadcaster have to maintain and which was really high for Indian broadcasters because India was not in the World Cup.

So it of course, for them, it was like doesn't make sense to pay that much amount of money.

and then that's when i realized the big amount which fifa gets when someone someone gets this contract of streaming some services like fifa of official services in their country finally fifa world cup is being streamed in india so it's not like people in india are not able to watch i'm not based in india so of course i can watch in sky sports in uk so that's fine but anyhow so there was a hacker back to our news now there was a hacker going by the name bob the hacker who was looking all of that just like me and he actually got in so i was not able to go to get in because i didn't even try but he managed to get in And not through like some elite zero-day vulnerabilities or maybe trying to drop a USB drive where you have some of the parking lot in which FIFA officials were going on and someone like take the USB drive and put it in their system.

So it's not those like fancy ways of hacking an organization.

But he signed up as a football agent.

Now, if you are not aware of football agents, these are like those men or they can be women as well, to be honest.

It doesn't make any difference.

So any person can be acting as a football agent.

What they have to do is they have to negotiate transfers.

They take maybe 10% or 15% of some, I don't know, 19-year-old who want to sign up for a club in Portugal or England.

So anyone can apply for that because, of course, FIFA wants more and more agents to be on their platform.

They want more and more talents to come up.

So how you can register yourself as an agent on FIFA? Well, you upload your ID, verify your email, and that's it.

FIFA will create a nice account for you on their Microsoft Entra system.

Well, normal.

It's cool, right? well except that this is the part that it should make every it personnel like me spill up their coffee because that agent account lives in the exact same tenant where you have fifa's core internal systems so the stuff that is actually running the actual tournament so your user id your groups your credentials your all the authentication is going via the same entra system where you have hosted your own servers where you are handling the whole streaming so mr bob the hacker he walks around tries to access fifa's core data platform and of course fifa is a good organization right he gets hit with the access denied message well great he thinks security is working but it isn't because that access denied message was just you know website being polite like hold on you're not allowed can can you stop doing this but the back end the actual server which is supposed to act as like second guardian That server didn't care.

So once you get the key, so once you get past that initial front end website, you basically can go anywhere.

So there is no second level authentication anywhere.

So Bob described this as one of the most common patterns you see in companies that build some sort of like a beautiful front door, which will say like, you shall not pass, sign taped on it.

but they just leave the back door just unlock which even with slight breeze it just blows and open so what did that get him of course he was able to go into the live production hub for the entire world cup broadcast so he was able to see every camera feed every stream and not just viewing access he was able to control it as well if he would have wanted so he could have i don't know blacked out a match mid game so just imagine you're watching your i don't know down with like three or four pints you are cheering for your team and then suddenly it's a blackout or worst there is someone who is playing some other weird clip while you're watching that game i don't know it gets scarier right so this person can do actually anything during a live world cup match so billions of people tuning in and then instead of like watching the game they could have just listened to some song because this guy can do anything so it's it's really getting crazy and scary now now naturally being a responsible human being and not a bad person to the society he tries to report this to fifa and where it gets funnier now fifa actually have no contact for security.

So there's no sort of like vulnerability disclosure policy.

There's no bug bounty, nothing.

So they think themselves like we are the big guy.

We are the big shots.