I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID.
Source: bobdahacker blog ·
How I found that anyone could register on FIFA's public Agent Platform, gain access to the Football Data Platform's Streaming Management panel, and get RTMP ingest URLs and stream keys for every live FIFA World Cup 2026 camera feed. I then spent hours calling FIFA, MediaKind, HBS, CISA, and the FBI trying to get someone to pick up the phone.
Frequently Asked Questions
What is I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID.?
I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID. is a article discovery curated from bobdahacker blog. How I found that anyone could register on FIFA's public Agent Platform, gain access to the Football Data Platform's Streaming Management panel, and get RTMP ingest URLs and…
How can I access or experience this?
You can experience this content directly on its original host (bobdahacker blog) by clicking the "Open Original" button.
Where does this content come from?
Curated from bobdahacker blog by the OnSuggest team to surface the most interesting and serendipitous content on the web.
More like this
All Article discoveries →From hakyll to comrak based generator
Tl;DR: I decided to gradually switch from hakyll- based framework for this blog to comrak -based custom generator. I’ll migrate both HTML render of posts and RSS feeds in the following few days. You should not see any changes: all the URLs and UUIDs are the same before and after. Until I missed something crucial. I hope I did not. The one exception will be the style of syntax highlighting in the HTML render of posts (and it will probably keep changing for a while more when I experiment with various backends). Background I used hakyll for about 13 years at least since first commit from 25 Novem
You Paid $50K for a Pentest. You Didn't Get One.
I'm going to tell you something big cybersecurity doesn't want you to hear: the pentest you paid for probably wasn't a pentest. I've lost count of how many times I've disclosed critical vulnerabilities to a company, only to hear: "That's weird, we just had a pentest done and they said we were clean." At this point, hearing that a company recently passed a security assessment is almost a leading indicator that I'm about to find something bad.
The Fix That Wasn't: Why Outsourced Dev Teams Are Your Biggest Security Risk
There's a conversation I have over and over again. A company hires an agency to build their app. The app ships. It works. Everyone is happy. Then someone like me takes a look, and the whole thing falls apart. And you better hope it's someone like me, not someone who wants to exploit it. This isn't about where developers are located. Talented engineers exist everywhere. This is about a business model where agencies are incentivized to ship features fast, security isn't in the contract, and nobody checks the work.
Your Lowest-Paid Employee Can Probably See Everything
Companies spend millions on firewalls, endpoint detection, and perimeter security. Then they give a part-time employee the keys to the kingdom. This is one of the most common patterns I find in my security research, and one of the least talked about. It's not about hackers breaking in from the outside. It's about what's already accessible from the inside, to people who were never supposed to see it.
Your Google Calendar Is Probably Public. Here's Why That's Terrifying.
Google Calendar has a setting that makes your entire calendar visible to anyone with your email address. Not just your availability. Full event details: titles, descriptions, attendees, Zoom links with passwords, and any documents linked in the description. All anyone needs is your email and a URL like calendar.google.com/calendar/u/0/embed?src=you@company.com. No authentication. No notification to the owner. This whole rabbit hole started by accident. I was doing security research on MSCHF, the viral product company behind Big Red Boots and Blur, and ran an employee's email through GHunt, an
Your Boarding Pass Is a Skeleton Key. Frontier Airlines Doesn't Care.
How I found that anyone with a boarding pass photo can pull full passport numbers, home addresses, children's dates of birth, credit card details, and Known Traveler Numbers for every passenger on a Frontier Airlines booking. Reported March 3rd. Still live 105 days later.