Cyber Threats Loom as 5B People Prepare to Watch World Cup Final

The 2022 FIFA Mens World Cup final in Qatar will be the most-watched sporting event in history — but will cybercriminals score a hat trick off its state-of-the-art digital footprint?

As Argentina and France prepare to face off in Doha for the final of the 2022 FIFA Mens World Cup, stadium staff and tournament organizers likely have more on their minds than whether Lionel Messi or Kylian Mbappe will claim the title of top goal-scorer. The event represents a vast
cyberattack surface
for both FIFA and the host nation of Qatar, security experts say — and ahead of the tournaments grand finale, cyber threats from all corners remain very clear and present.
According to FIFA, 2022 will
end up being
the most-watched tournament in history, followed by literally billions around the globe. On-the-ground numbers are impressive, too: Stadium Lusail, where the final will be played, is the biggest stadium in Qatar and has a capacity of the 88,966 spectators. Ticket sales for the World Cup have topped 3 million for an unprecedented 1.2 million visitors, which is equivalent to nearly half of Qatars population.
Thats a juicy target for not only financially motivated threat actors and hacktivists but also nation-state groups, who more often than not can get the ball in the back of the intelligence-gathering net when they want to.
Smart Stadiums & the Digital Pitch
The risks come from a few different places: social engineering efforts against fans and visitors being the most well known. Whats less well known is the fact that Qatar has leaned in hard to the smart stadium concept, connecting its eight World Cup venues into one connected digital space.
A partnership between Johnson Controls OpenBlue digital platform and Microsoft Azure, for instance, has enabled an artificial intelligence-based approach to physical security and operations, gathering data from edge devices and systems to identify when a security or safety issue has the potential to affect fans and players, or how crowd size and weather changes might affect energy efficiency and playing conditions.
Each stadium also has a 3D digital twin, an interactive digital model that provides live information on safety, comfort, and sustainability to a team of command center experts.
With major sporting events becoming increasingly digitized, the attack surface for threat actors has also increased, a recent ZeroFox
report on World Cup threats
noted. Qatar has constructed eight state-of-the-art smart stadiums specifically for the World Cup, meaning sophisticated threat actors will almost certainly aim to compromise networks by exploiting vulnerabilities within interconnected stadium systems, including operational technology and Internet of Things (IoT) devices.
This raises the possibility of denial-of-service attacks or disruption on the order of the
Olympic Destroyer threat
, which took aim (largely unsuccessfully) at the Winter Games in Pyeongchang in 2018.
While its not known what specific cyber defenses this first-of-its-kind footprint has in place, Qatar brought in a team of cybersecurity experts for a summit in March, and it has been working closely with Interpols Project Stadia to enhance its security posture. So far, so good — but its not over yet.
Also, notably, there is a pair of mobile apps that everyone 18 and above entering Qatar for the World Cup is required to download, named Ehteraz and Hayya. Ehteraz is a COVID-19 tracking app, while Hayya is an app used for World Cup game tickets and accessing the Qatar metro system to move between stadiums.
At issue is the fact that Ehteraz has an extensive list of required permissions so that it can monitor locations and proximity to other app users; it can capture data from the device, automatically exfiltrate data from a users phone, disable a lock screen, make calls from the phone, and access location services.
The Hayya app, meanwhile, is able to access almost all personal information on a phone, according to ZeroFox, and can tap into location services and network connections between a phone and other networks.
Both apps potentially offer riches to cybercriminals. When threat actors look to exploit an app, the end goal is to steal information that would be profitable — login credentials, personally identifiable information, email, credit cards, etc. — so that they can either sell it to actors who know how to further exploit or use the credentials and check to see if they can steal money or crypto from the victim accounts, says Adam Darrah, senior director of Dark Ops Collections at ZeroFox.
However, more shadowy risks also apply; the apps, with their broad set of access to personal data, are a perfect vector for espionage and creating fan chaos.
When a nation-state or a motivated hacktivist group has you in their sights, they will find a way in, Darrah says. All nations view an event such as the World Cup as a way to gather intelligence.
Regarding the COVID-19 contact tracing app for instance, the ZeroFox report noted, Critics fear downloading the app could give the Qatari government access to privileged or sensitive content on a user’s phone. This is particularly notable if the user is breaking a Qatari law. It could also give Qatari authorities access to proprietary information contained on a company phone.
The firm recommended not installing the app on any phone with access to sensitive information, as a precaution.
Another wrinkle in the threat landscape for the World Cup is the vast facial-recognition footprint that Qatar has stood up in order to help respond to any threats of bodily harm to visitors and staff. Tensions famously run high at football (aka soccer) matches, but beyond run-of-the-mill hooliganism, some tourney-watchers are concerned that there could be a
serious physical security incident
.
To help thwart such a situation, the country has installed more than 15,000 cameras with facial recognition technology stationed throughout the eight stadiums and along roads and transportation infrastructure in Doha.
The benefits to physical security are myriad, of course. Say a fan places a suspicious package close to a stadium entrance. When security personnel are alerted to this threat, staff can retroactively use facial recognition to trace the suspects steps, determine where they are going next, and possibly pick them out in a crowd if needed, Terry Schulenburg, vice president of business development at CyberLink, tells Dark Reading. The technology can even alert staff when a bad actor enters their area. Facial recognition will provide staff with the information they need.
However, critics have raised privacy concerns, a
well-worn issue
when it comes to facial recognition. After all, the population cant opt in to being scanned; the potential for surveillance by the Qatari government or advanced persistent threats (APTs) is there; and, its unclear how the system handles the biometric data it collects.
It would benefit them not to store faces in the cameras, workstations, or servers, Schulenburg says. Rather, they could use software that identifies hundreds of vectors on a subjects face — such as the distance between the eyebrows — convert them into an encrypted file, send this file to a workstation or server, and compare its values with those of previously recorded subjects or those enrolled in a database. If its being used, this more airtight facial recognition model will help security operators process camera feed data more quickly and securely.
If Qatar is not storing full images of attendees faces, any unlikely leak of facial recognition data would be unreadable without access to the specific software Qatar is using, he stresses.
Thwarting Social Engineering Threats
And finally, utterly predictably,
phishers and scammers
have been drawn to the event, using World Cup-themed lures, malicious mobile apps, and bogus ticketing websites to harvest data and steal funds from unsuspecting fans. In fact, Kaspersky said this week that its researchers have seen
fake tickets being sold for as much as $4,000 a pop
.
Group-IBs Digital Risk Protection team
recently said it has detected more than 16,000 scam domains, and dozens of fake social media accounts, advertisements, and mobile applications created by scammers aiming to capitalize on the worlds largest sporting event. The researchers also uncovered more than 90 potentially compromised accounts on official FIFA World Cup 2022 fan portals.
Patrick Harr, CEO at SlashNext, notes that FIFA and any World Cup host nation can take action to protect aficionados of the beautiful game from social engineering.
FIFA could ensure its security program includes brand impersonation identification, remediation, and a takedown service, he says. With this type of security control, FIFA could safeguard their millions of fans, so they don’t accidentally engage with malicious content while following the news on their favorite teams.
Eyal Benishti, founder and CEO at Ironscales, notes that FIFA also should be focusing on raising awareness, sounding a loud drumbeat to fans.
They should be told to avoid clicking on links behind QR codes, stay away from SMS messages asking to validate or verify, and to go directly to the official FIFA domain only, to interact and purchase tickets, he says. Send out clear communication to the future guests on the guidelines, what to expect and what to be on the lookout for.
He also pointed out that World Cup employees
have also been targeted
throughout the tournament, bringing up another layer of responsibility for organizers.
For the FIFA organization and businesses of Qatar, focus on what you can control, like making sure your internal employees are educated and aware of the probability of fake emails and fake support requests that will spike, he says. If they receive requests that seem out of place, always validate with the sender via phone or alternate communicate method. Be extra cautious and ensure the proper communication and education are taking place for your employees.
Qatars World Cup hosting duties may be coming to a close, and hopefully without a major cyberattack marring the experience, but there are lessons to be learned when it comes to implementing good security for such a sprawling endeavor.
Whether its an attack on infrastructure, privacy concerns, or the phishing glut that has surrounded the tournament, the time is now to be thinking about risk mitigation for future events, like the upcoming 2023 FIFA Womens World Cup next summer.
Researchers say that its especially crucial to conduct an assessment once all is said and done, ideally using threat intelligence and data from this winters event — given that its likely that many of the pioneering technologies that Qatar put in place for the tourney will be tapped for future tournaments. For instance, stadiums across the US, which is a co-host of the 2026 FIFA Mens World Cup, are already using facial recognition tools for staff and fan entry, ticket verification, and contactless payments.
An event the size and scale of a World Cup represents rich pickings for the criminally inclined, with millions of visitors seen as millions of potential victims,
Rob Fitzsimons
, field application engineer at Telesoft Technologies, said in a recent column. It is the responsibility of the host nation to ensure the safety and security of its guests — both physically and digitally.
He added, Indeed, a continuous flow of real-time threat intelligence in advance of and throughout the tournament [provides] a greater understanding of the potential threats, and enables security professionals to better defend against them. Recognizing where vulnerabilities lie, and addressing these accordingly, will allow better protection of mobile networks, and help protect against targeted attacks … and, by monitoring and controlling the flow of information across these networks, its possible to reduce the likelihood of more widescale attacks.

Last News
▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security	▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Cyber Threats Loom as 5B People Prepare to Watch World Cup Final