Cyber threats loom as 5 billion people prepare to watch World Cup final
As Argentina and France prepare to face off in Doha for the final of the 2022 FIFA Men’s World Cup, stadium staff and tournament organizers likely have more on their minds than whether Lionel Messi or Kylian Mbappe will claim the title of top goal-scorer. The event represents a vast cyberattack surface for both FIFA and the host nation of Qatar, security experts say — and ahead of the tournament’s grand finale, cyber threats from all corners remain very clear and present.
According to FIFA, 2022 will end up being the most-watched tournament in history, followed by literally billions around the globe. On-the-ground numbers are impressive, too: Stadium Lusail, where the final will be played, is the biggest stadium in Qatar and has a capacity of the 88,966 spectators. Ticket sales for the World Cup have topped 3 million for an unprecedented 1.2 million visitors, which is equivalent to nearly half of Qatar’s population.
That’s a juicy target for not only financially motivated threat actors and hacktivists but also nation-state groups, who more often than not can get the ball in the back of the intelligence-gathering net when they want to.
Smart Stadiums & the Digital Pitch
The risks come from a few different places: social engineering efforts against fans and visitors being the most well known. What’s less well known is the fact that Qatar has leaned in hard to the smart stadium concept, connecting its eight World Cup venues into one connected digital space.
A partnership between Johnson Controls’ OpenBlue digital platform and Microsoft Azure, for instance, has enabled an artificial intelligence-based approach to physical security and operations, gathering data from edge devices and systems to identify when a security or safety issue has the potential to affect fans and players, or how crowd size and weather changes might affect energy efficiency and playing conditions.
Each stadium also has a 3D digital twin, an interactive digital model that provides live information on safety, comfort, and sustainability to a team of command center experts.
“With major sporting events becoming increasingly digitized, the attack surface for threat actors has also increased,” a recent ZeroFox report on World Cup threats noted. “Qatar has constructed eight state-of-the-art ‘smart stadiums’ specifically for the World Cup, meaning sophisticated threat actors will almost certainly aim to compromise networks by exploiting vulnerabilities within interconnected stadium systems, including operational technology and Internet of Things (IoT) devices.”
This raises the possibility of denial-of-service attacks or disruption on the order of the Olympic Destroyer threat, which took aim (largely unsuccessfully) at the Winter Games in Pyeongchang in 2018.
While it’s not known what specific cyber defenses this first-of-its-kind footprint has in place, Qatar brought in a team of cybersecurity experts for a summit in March, and it has been working closely with Interpol’s Project Stadia to enhance its security posture. So far, so good — but it’s not over yet.
Mobile Privacy Concerns
Also, notably, there is a pair of mobile apps that everyone 18 and above entering Qatar for the World Cup is required to download, named Ehteraz and Hayya. Ehteraz is a COVID-19 tracking app, while Hayya is an app used for World Cup game tickets and accessing the Qatar metro system to move between stadiums.
At issue is the fact that Ehteraz has an extensive list of required permissions so that it can monitor locations and proximity to other app users; it can capture data from the device, automatically exfiltrate data from a user’s phone, disable a lock screen, make calls from the phone, and access location services.
The Hayya app, meanwhile, is able to “access almost all personal information on a phone,” according to ZeroFox, and can tap into location services and network connections between a phone and other networks.
Both apps potentially offer riches to cybercriminals. “When threat actors look to exploit an app, the end goal is to steal information that would be profitable — login credentials, personally identifiable information, email, credit cards, etc. — so that they can either sell it to actors who know how to further exploit or use the credentials and check to see if they can steal money or crypto from the victim accounts,” says Adam Darrah, senior director of Dark Ops Collections at ZeroFox.
However, more shadowy risks also apply; the apps, with their broad set of access to personal data, are a perfect vector for espionage and creating fan chaos.
“When a nation-state or a motivated hacktivist group has you in their sights, they will find a way in,” Darrah says. “All nations view an event such as the World Cup as a way to gather intelligence.”
To read the complete article, visit Dark Reading.