Cybersecurity at the World Cup: What you should know

Athletes, sports clubs and sports agencies have become frequent victims of cyberattacks and information leaks over the past two years, as noted by The Telegraph. The upcoming World Cup would provide an ideal opportunity for cyber actors seeking to garner enhanced attention for their actions.

Hacktivists and nation-state backed actors seeking to tarnish the reputation of athletes, teams or their countries may find a worldwide sporting event an ideal setting in which to disclose derogatory information. Additionally, cybercriminals or malicious actors hired by an opposing team have an incentive to steal valuable information about game tactics or financial data to affect high-stakes games.

In the fall of 2016, a hacking group released confidential information about athletes acquired from databases on the World Anti-Doping Agency’s (WADA) networks, according to a public statement from WADA. The statement further explained that the attackers had used targeted phishing attacks against several WADA accounts, eventually gaining login credentials, allowing unauthorized access to the system. In April 2017, the International Association of Athletics Federations (IAAF) reported that the same group had hacked into its system, targeting information on athletes’ exemptions for drug use.

Athletes and those that support them also face potential threats from opposing teams, judging from past precedent. In 2015, personnel working for the St. Louis Cardinals, a U.S. baseball team, came under FBI investigation for allegedly hacking into sensitive networks belonging to a rival team, the Houston Astros, according to The New York Times.

Some teams are already implementing additional security measures to prepare for the World Cup this June. According to The Guardian, the Football Association will provide its own secure Wi-Fi for players and cautioned them about posting information that could reveal the team’s location, choice of players for the game or tactics.

Athletes and those that support them can follow similar practices to enhance cybersecurity during the games:

• Employ a team chief information security officer (CISO).
• Enhance awareness of potential attack vectors, including suspicious links or attachments in emails and prompts to update software systems.
• Prohibit players from connecting to nonsecure Wi-Fi, and provide a separate, secure network for the team.
• Harden any computer equipment the team may use by installing the latest versions of operating systems and patches, and disabling unused ports, unused accounts and file and printer sharing.
• Limit players’, coaches’ and support personnel’s use of social media and email.
• Consider asking players or support personnel to go “off the grid” immediately preceding and during major sporting events.

As sporting event venues, scoring equipment and communication with journalists and fans become increasingly digitized, cyber risks related to event administration are likely to grow exponentially. Nation-state backed actors or hacktivists may seize the opportunity to compromise the integrity of networks controlling event venues, particularly when controversial political events dovetail with planned games. Cybercriminals and attackers hired by opposing teams may be motivated to fix a match by tampering with cameras used to assist referees, scoring systems or power grids supporting the games.

According to a report by the Center for Long-Term Cybersecurity at the University of California, Berkeley, the most common cyberthreats to sports venues currently include attacks against IT systems and ticket operations but in the future may include devices that would affect the integrity of the game itself. Some concerning incidents at sporting events have already occurred, such as the cyberattack at the 2003 Pan American Games in the Dominican Republic that prevented scores from reaching journalists and fans, according to Security Affairs.

Industrial control systems, power grids and threats from Internet of Things (IoT) devices can further complicate cybersecurity for sporting event administrators, and an appropriate response is likely to involve close coordination with national cybersecurity units or even international organizations like Interpol. In March 2018, Interpol held a conference to discuss security at sporting venues, addressing topics such as IoT and appropriate risk management.

Distributed denial-of-service (DDoS) attacks are increasing in volume particularly against IoT devices doubling in a six-month time frame in mid-2017, according to a Corero report. IoT devices frequently lack appropriate security measures, such as updated firmware, firewalls or strong passwords during setup, with the potential to wreak havoc as a major sporting event is in full swing.

On May 23, 2018, Reuters reported how Ukraine raised alarms that a DDoS attack from malware on routers would interfere with the Union of European Football Associations (UEFA) Champions League soccer final in Ukraine later that week. Luckily, the warning appeared to inoculate the event from attack.

We recommend the following measures to sporting event administrators for enhancing cybersecurity:

• Have a cybersecurity response team and a CISO.
• Coordinate with national and international cybersecurity units to implement a collaborative approach.
• Employ the services of cybersecurity vendors.
• Be prepared for a large volume of attacks, and test response mechanisms to ensure they can handle the load.
• Isolate systems from the internet (when possible).
• Be wary of adopting new technologies for tasks central to the integrity of the game. Consider whether analog systems will be most appropriate for some functions.

From the high publicity surrounding global sporting events to the lucrative nature of exploiting expensive ticket transactions, malicious actors will have multiple reasons to target fans, athletes and venues at the World Cup this year. Potential victims can help decrease opportunities for attack by maintaining a higher level of vigilance, employing security best practices, such as updating software and patches, and being judicious about technology use, including opting out altogether when appropriate.