Sometimes, hacking requires a certain amount of restraint, especially when you find a system woefully unsecured. It would be so easy to play some pranks, but [bobdahacker] chose not to rickroll the entire FIFA World Cup.
The fun starts after [bobdahacker] signed up for a free FIFA agent profile. After a simple ID verification process, he had a login for the FIFA Agent platform, but they used the same account system across the whole organization in Microsoft Entra. When he tried to access the FIFA Football Data Platform system, it returned an error saying he had no assigned role to allow access. This was on the client side though, so he was able to bypass the error as the server didn’t block accounts without assigned roles.
Once inside, he found he was able to access not just the data, but had full control of the RTMP ingest URLs of all the FIFA matches. For those of us less conversant in streaming media protocols, “Those RTMP ingest URLs are the literal pipe from the stadium cameras to FIFA’s broadcast distribution chain. Camera -> RTMP ingest -> MediaKind -> broadcast partners -> your TV.” He could’ve shut off the feeds or injected whatever alternate stream he wanted, but instead chose to try contacting FIFA, their streaming contractor, and various law enforcement agencies since the World Cup was already underway when he made the discovery.
“Competitions, Matches, Teams, Tools, Exchange Platform, Analysis Dashboard, Commentator Information System, FIFA AI Pro, Admin” were also in the open. Live match scores could be changed, player bios, and any number of other stats could be modified. We’ll let you imagine the possibilities of what mischief could occur.
While rickrolling the world would be funny, a rickroll throwie will be a bit more circumspect. If you’re more interested in soccer/football than security hacks, we hope you enjoy this LEGO soccer tank or these robot soccer players and avoid any soccer ball-sized meteorites or legal troubles for your soccer-related invention.
“Rickrolling The World Cup”
..
“but [bobdahacker] chose not to rickroll the entire FIFA World Cup.”
Good job, Hackaday. Clickbaiting is here too.
TBF the blog also is titled that way. Lighten up, Francis.
In the interest of full disclosure, it could have been titled “Not rickrolling the World Cup”. I would have clicked anyway.
Honestly? Lame.
For one of these practically 0 harm hacks, I’d much rather read how an anonymous hacker actually did rickroll or similar the World Cup.
Especially if done during an advertising break.
If you managed to disrupt even 10 seconds of an ad that ran during world cup by hacking into a computer system that is most likely located in the united states I guarantee no matter you are you would be sued by FIFA and its sponsors with the full support of the burger Reich administration
Even in the unlikely chance they cannot extradite you, you would end up sanctioned and unable to use every single western payment system, flights companies, or online service.
Great way to ruin your life for a dumb joke that wasn’t even funny in 2010
Another good reason to get our payment systems away from them. Also the case with Nicolas Guillou and other EUGH judges.
I think our burger administration is presently quite jealous about World Cup being more popular then them, so they may even allow this one go unpunished for the time being.
With FIFA’s famous litigious nature and obscenely deep pockets, i can’t blame the hacker for NOT doing this. They can, without batting an eyelash, end you. And your familiy.
Only if they catch you.
Pranks are always best when you don’t get caught.
So:
Goto charbucks
buy shake, get internet
boot from a CD
get new creds from FIFA
promote NFL and denigrate soccer on the crawl (make it look like you’re a Raider fan, they’re all criminals).
Watch the FIFA flop.
Trying to draw a court case/red card.
Forgetting they don’t know who you are.
and this from the same people that go behind every legitimate lawmaking process to try and
DRM the hell out of any device with a screen and invoke the death penalty on anyone streaming 30 seconds of a game without paying.
You are probably correct. But… that’s not the fans’ fault. Do you want to take the game away from all the fans who are watching in order to punish the company behind the league?
You don’t need FIFA to watch futbol, kill it and another hopefully less evil company will fill the void.
Some of us tried to force changes on the PRS (Performing Rights Society) here in the UK.
What we ended up with is an unholy alliance between them and the MCPS (Mechanical-Copyright Protection Society) now called the PRS for Music.
Which has exclusive, non-revocable control over public performance licensing, takes 25% of any income from said licensing. And they get to keep all of that income if your membership is revoked or you allow it to lapse.
The only fault fans might have is not taking a decisive stance against a corrupt company (they keep giving plenty of money to FIFA to watch games). But blaming someone for not boycotting a company is questionable.
That said, I personally would have loved to see a couple of games interrupted for a few minutes to denounce FIFA’s corruption. I mean, they already have plenty of hydration breaks for TV ADs ;)
Look at all those grass field, great opportunity to blast ads in the viewer’s face, the future of soccer, like NBA.
Wait, one can access stadium camera feeds?
Wish I’ve know how to do that during The Olympics to bypass the US’s NBC death stronghold on the games. I’ve known simpler hacks on the cheap, which don’t involve creating logins or giving any information to anyone (which I won’t advertise here, of course) and doing anything remotely advanced, but I wish there was simpler way of connecting to the direct feeds bypassing state-sponsored (or corporations-sonsored) propaganda channels.
you could access the “fun” things going on where fifa changes the camera and forbids commentators from telling the world what’s going on in the field.
this is how you get, for example, Argentina being “awful” against Netherlands in 2022 for yelling goals in the face of the other team. By not showing the other team taunting the players before kicking the penalty shots. what’s allowed, mind you, is commentators saying “there we go, argentina again having no class”.
You still won’t be able to see the billionaire BJ corner at the Monaco GP.
They aren’t allowed to point cameras at it…Next to the cafe right after swimming pool, right next to track.
Honestly I think the experience has to be much worse for the poor billionaires.
Compared to when the cars had that awesome 20kRPM engine sound.
NHRA should do similar.
10 meters from the starting line in Top Fuel…
OK. Let’s narrow to Hackaday hacks. How they can localize the dynamic ads on fences? They have one ad on the fence itself, and on TV in another country it is different ad, not the original was there before
You use a 3D model of the stadium and fences and a tracked camera. The relevant ad can be placed and oriented over the exact area required. It’s much like the virtual studio process, but a bit simpler as it doesn’t need the green screening. I don’t know about this company, but when I worked in that area we used Unreal Engine.
Had you done anything it would still be under a login that points back to yourself right? Yah… as much as I would like to throw a little “FDT” into the bottom corner of the feed I think not messing with it is a much safer option!
I really did not think in 2007 that in 20 years the world would be exactly the same except lamer and 10x more expensive
FIFA are not using public internet RTMP to get broadcast-critical stadium camera feeds back to the IBC for global TV production.
THe majority of the cameras are UHD HDR (a few are HD HDR, a few are high frame rate for slowmos, etc). FIFA HBS is operating a private Broadcast Contribution Network between IBC and venues to carry full uncompressed or losslessly-compressed signals between venues, MCR and centralised production facilities.
I believe all 16 venues are producing their main ESF (Extended Stadium Feed) on-site as UHD HDR, delivering back to the IBC uncompressed. Other cameras are delivered back in JPEG-XS for bandwidth reasons. Every microphone is also delivered back to Dallas and multiple stereo, surround and immersive broadcast mixes are created for each game. There’s ~600 Gbit/sec of bandwidth between each venue and MCR, delivered via two 100 Gbit/sec paths, each with multiple redundant routes.
See https://www.sportsvideo.org/2026/06/12/how-decentralized-production-may-well-be-the-legacy-of-the-2026-fifa-world-cup/ and https://ibctours.tv/stop-2-central-equipment-room/ for more technical info.
Bob da Hacker states on his blog, “Those RTMP ingest URLs are the literal pipe from the stadium cameras to FIFA’s broadcast distribution chain. Camera -> RTMP ingest -> MediaKind -> broadcast partners -> your TV.”
Those match feed RTMP ingest URLs are very likely feeding an ancillary system, FIFA’s Football Data Platform, used by people registered as Agents through the FIFA Agent Platform. They will have the various available angles for each match alongside the game stats, but those feeds are NOT the broadcast-critical feeds for the main TV production. I think Bob is misinformed in this case or has made an assumption without doing more research.
Major broadcasters will have a hand-off directly in Dallas between themselves and FIFA’s MCR (with feeds from the MP router). Alternatively, they’ll receive high-quality streams over various private/broadcast-grade methods derived from the MP router (which is quite often SRT using a private distribution network), for broadcasters who can’t afford to co-locate their own kit and connectivity in Dallas.
Neither FIFA nor broadcast partners will be rebroadcasting low-bitrate 1080p RTMP feeds only intended for FIFA’s Football Data Platform. My belief is that the only people he might have rickrolled or disrupted would have have been people like team members or staff in delegations using the FDP portal to follow games.
Plenty of freely available info about the HBS production for this World Cup:
https://www.sportsvideo.org/2026/06/12/how-decentralized-production-may-well-be-the-legacy-of-the-2026-fifa-world-cup/
https://ibctours.tv/all-stops/
https://www.reddit.com/r/broadcastengineering/comments/1tylmrt/does_anyone_know_which_trucks_are_being_used_in/
60 Gbit/sec of bandwidth to each venue, not 600. The perils of proof reading your own essays (I always miss something)…
(Mods – feel free to correct my original comment, and either leave or delete this reply as you see fit)
Ugh, I misread my own typo then replied with another error. The heat is getting to me…
To clarify: the FIFA BCN this year has 600 Gbit/sec of capacity, and each venue has two 100 Gbit/sec paths.
Sorry for any reader confusion due to my bad proofreading. Those details are according to a few industry articles, including https://www.iseurope.org/news/fifa-world-cup-2026-broadcast-technology-blueprint-future