How Hackers Could Hit Super Bowl LIII

Security threats and concerns abound for the years biggest football game. What officials and fans can do about it.

Super Bowl LIII will draw the attention of millions of people around the world – and cybercriminals hoping to exploit attendees and fans before and during the big game.
Major sporting events are hot targets for cyberattacks. Consider the 2018 Winter Olympics, when attackers
impersonated
a North Korean nation-state group to target the Games and more than 300 associated organizations were hit with a
phishing attack
. Or the World Cup, when the Wallchart
phishing campaign
delivered malware under the guise of a game-related email.
The massive audience captivated by major sports games, concerts, political events, and similar large-scale gatherings gives attackers a perfect opportunity to strike. If theyre looking to launch a phishing campaign, they have a wealth of potential targets who will click links related to the event. If they want to cause disruption, millions of eyes will be watching when they do.
Unlike the Olympics or World Cup, the Super Bowl is a one-day spectacle, which narrows attackers window. I think the primary threat with an event like this is something disruptive in nature – its a pretty common trend nowadays, says Tom Hegel, director of threat research and analysis for ProtectWise, which runs a network detection and response service often integrated into pop-up SOCs, and which has worked with events similar to the Super Bowl in scale. There is a greater chance of hacktivism during these events, for example, Hegel adds.
In professional leagues, there is precedent of hackers targeting specific teams and their critical data, says Tom Kellermann, chief cybersecurity officer at Carbon Black. Television networks and online gambling sites, especially during the pregame and halftime show, are targets. However, he is most concerned with watering hole attacks, malicious SMS, and destructive attacks on American companies.
The Super Bowl is a global affair but it represents all that is American, Kellermann says. Given the heightened state of geopolitical tension and given that most Americans, including cybersecurity professionals, will be watching, the game represents an opportune time to target businesses and consumers throughout the US.
As with most cyberattacks, there is a financial motivation to target the Super Bowl. Theres a huge amount of transactions going on there at the same time, Hegel points out.
Ticket forgery and fake bar codes are also common concerns with these events, adds David Gold, ProtectWise vice president of solutions architecture. People may try to steal press credentials, or those who have credentials may post pictures online showing the bar code.
The Super Bowl brings a long list of security challenges. The stadiums network is overwhelmed with an unusually high number of fans, many of whom may bring infected or poorly secured devices, putting themselves and others at risk. The security team must understand and monitor the network, identify suspicious devices, and detect threats in a chaotic environment.
The sheer amount of people who come to these events is staggering, says Gold. Separating the noise from the things you actually care about is very challenging for an event of this scale.
The NFL, which was contacted for this article, declined to discuss Super Bowl cybersecurity issues.
Security: More Than A Metal Detector
Planning and implementing security measures at the Super Bowl is a big, coordinated effort, Gold emphasizes. The National Football League (NFL), the network security team, and law enforcement are only three of many players involved with ensuring the Super Bowl is secure. Oftentimes organizations like the NFL hire external vendors or academia to help with security: in the past, Gold says, high-profile university programs have gotten involved with the game.
Kickoff is at Atlantas Mercedes-Benz Stadium,
which has
a whopping 1,800 wireless access points in the seating bowl and concourse. John Clay, director of global threat communications for Trend Micro, predicts scammers will be nearby to launch fraudulent Wi-Fi networks. The more technology in these places, the bigger the attack surface becomes, he says.
Threat monitoring is no small feat. Coordination can be a huge challenge with scanning this stuff, Gold notes. Getting everything deployed is the biggest challenge. There are a lot of factors, a lot of different groups involved.
The average security operations center uses 50- to 70 different tools – the Super Bowl doesnt have time or resources to install those for one event. They need tech that can be spun up quickly and doesnt require many people to operate. Cloud deployment is helpful here because it lets on-site teams expand to include remote experts, according to Gold.
To tackle security, organizations running major events typically have a SOC on-site with their own analysts and response teams available in case of an incident. Pop-up SOCs ProtectWise has worked with have threat hunters on the ground to triage and respond to alerts. Because its service is cloud-based, there are additional experts on the backend to offer support, help customers respond to unknown activity, provide context on incidents, and generate telemetry reports if needed.
But what are they tracking? Pretty much everything, says Gold. The pop-up SOC monitors endpoints, data, servers, websites, video streaming, rogue access points, point-of-sale systems, and the networks for different groups: teams, media, attendees. Externally theyre watching threat actor groups, the Dark Web, social media platforms.
You have to think of every single attack vector, and what the risk is of that impacting the event or the game, says Gold. Other potential risks at the game could include card skimmers and keyloggers at stadium ATMs, and malicious USBs installed in device charging stations.
Fans as Targets
The NFL isnt the only one on alert this Super Bowl Sunday – people attending the game, watching online, researching articles, and shopping for merchandise should be wary as well.
Its not just a game, says Jessica Ortega, website security research analyst with SiteLock. Thats something a lot of fans dont realize – its a whole tourist attraction, basically, for the week and days leading up to the Super Bowl.
Clay warns fans to heed caution when reading websites and emails related to the game in the days prior. Spam campaigns, phishing attacks, and fraudulent sites may be designed to look like the Super Bowl homepage, ticket sales page, or another related website. Malvertisements may compromise legitimate sites and redirect fans to malicious pages or get them to download content.
In the last few years, we tend to not see the huge spray-and-pray types of campaigns, he adds. [Attackers] tend to be more targeted in their approach now. Some may purchase lists of names and email addresses for people interested in sporting events; others will do some OSINT gathering and scan social media looking for team fans they can hit with targeted attacks.
For those fans buying merchandise online, check to make sure the site is legitimate and only purchase from official sellers, says Ortega. Theres a lot of SEO spam getting injected into websites, and ecommerce sites selling sports memorabilia being compromised, she notes. To her point, ZeroFox recently discovered nearly 500 advertisements on marketplaces for Super Bowl-related merchandise, many providing minimal information about where the goods came from - a sign theyre counterfeit.
Be aware of what youre looking at, what youre downloading, what youre getting on your phones and all devices, says Clay. When youre looking at news and want information on the event, be cautious of what youre clicking on or downloading from a website or email message.
Super Bowl attendees planning to pay using their phones at the event should download a VPN to protect their transactions, Ortega notes, and use cash to pay if possible. Fans should also safeguard their tickets, both online and physical, to protect the bar codes from being stolen and resist the urge to post any photos of tickets or game credentials on social media.
Related Content:
For a Super Security Playbook, Take a Page from Football
Access Control Lists: 6 Key Principles to Keep in Mind
Creating a Security Culture & Solving the Human Problem
Iran Ups its Traditional Cyber Espionage Tradecraft

Last News
▸ 27 Million South Koreans Hit by Online Gaming Theft. ◂ Discovered: 23/12/2024 Category: security	▸ Homeland Security Background Checks Breach Raises Concerns. ◂ Discovered: 23/12/2024 Category: security	▸ Fully committed to the future world of technology. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
How Hackers Could Hit Super Bowl LIII