I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID | Hacker News Reader

I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID

bobdahacker.com

315 pointsBobDaHacker99 comments

Please stop using AI to write for you, it ruins what is otherwise a fascinating story, and on reflection I struggle to trust it.

If you used AI to generate the blog post, did you use AI to generate the screenshots and story?

Agreed. The post looks great. The story is great but the AI style in this case does distract.

I'm not against using AI for writing at all but you want to be careful that the output doesn't contain too much of this noise over signal type of wording that repeats and wants to just sell you something.

Unfortunate to see AI police as top comment on a good amusing post!

I am curious, what exactly triggers your AI senses in this post?

"This wasn't some dev environment. This wasn't test data."

It's not X, it's Y. And repetitions of three.

Thats a literary style called anaphora. Some people learned this in school, so they can use it to emphasize something. IMHO this is not a strong sign of AI, in fact I think this text has no strong AI indicators.

Something having name is not a sign of not-ai. It when it is in places for no reason other then blow up the text length. As if school kid was trying to make the text longer to fit the minimal amount of words.

Thank you for speaking up -- I feel the same way.

Agree, i don't think it was ai written, or atleast written very well with AI.

I am usually able to pick up ai writing quickly but didnt feel it in this case

Same, and I'm growing tired of the witch hunt comments derailing the topic.

For example, why is this thread the top thread in this post?

You sure about that?

https://github.com/blader/humanizer/blob/main/SKILL.md

P.S. Claude produced the initial text. :^)

https://news.ycombinator.com/item?id=48551441

You're right to call that out

Also, “ What I didn't expect was what happened next.”

The Unicode arrows is also something Claude is using really often: “Camera -> RTMP ingest -> MediaKind -> broadcast partners -> your TV.”

And the table at the end is such a Claude thing.

The general style, a series of short sentences that feel like they are building up a punchline is what tells me it’s Claude, but the whole thing does stink of LLM generation

The table don't even add information, all but one cell share the same value for "When".

Ah la la, this is something I actually write sometimes. And em-dashes.

This hunt for AI is sometimes counterproductive

I found myself writing exactly like this for a while after reading pages and pages of this special construct before my bs detector understood what it is...

What do you think why AI uses that pattern so often?

Could it be in the human generated training data?

Seems like a logical fallacy. Just because AI uses that pattern doesn’t mean that pattern means AI

Gemini loves talking about "The Nuclear Option" too

You've hit a classic "gotcha".

It's honestly unbelievable how people continue to paste stuff like this. Do they not know that credibility is lost instantly?

I love how in one post everyone piles on someone for using the word "retarded", meanwhile in another post someone with autism gets piled on for using AI for accessibility.

I remember a frontpage post from like 2 days ago:

"If you want human attention show human effort" or something in that direction. I think this fits here just right.

I think in this case the human effort was put into the actual discovery, honestly I don't mind if AI helped him write the blog post if the result is enjoyable and not sloppy

https://news.ycombinator.com/item?id=48497609

I don't mind it here at all, in fact I didn't even notice it's AI before reading this comment. It's clearly not a one-shot AI slop but a well thought out and edited by a human post.

Not everyone who has something interesting to say is a good writer, and I think it's great if AI can help them tell their stories.

Yeah I used Claude as a writing assistant for the initial draft. I'm autistic and long-form writing isn't my strong suit, getting a 4000 word blog post to flow well is genuinely hard for me. But I do edit it pretty heavily after, the voice and the jokes and the structure are mine, the AI just helps me get a baseline down so I'm not staring at a blank page. The research, the screenshots, the disclosure, that's all me. I've been doing this stuff for years.

My opinion is that this is a great story.

But the haters are going to hate.

If you had not used AI to fix your post, I bet the top post will be complaining about your grammar.

Some people will always find something negative. Simple as that.

While I appreciate the positivity, but I've honestly grown to appreciate grammar mistakes. Just like it's not X, it's Y indicated AI, those indicated that the effort behind was human.

Honestly, no need to write 4000 words if the story can be told in 400. The story is what matters, not word count or "flow".

I think the criticism is constructive. It's really not about hating. I'd wager many of the people who convey this criticism do use AI to aid their writing as well.

It's just that this one in particular lacks one more edit pass removing some of the AI noise on branding-speak and needless repetition (AI tends to list things and beat the point).

> If you had not used AI to fix your post, I bet the top post will be complaining about your grammar.

I'm positive that a post complaining about the grammar would've been (rightfully) downvoted to oblivion on this site.

I understand that it feels helpful but the post ends up repeating the same insight over and over. Reads very sloppy, while you wanted the opposite.

Don't take my criticism of AI writing as criticism of your work. This is stellar stuff! What I'm trying to say is I'd really like to hear it in your words.

I'm glad to hear the voice is yours, and I apologize for assume it was the AI's.

Great post. It was an amusing read, and quite the discovery! Good work, and great job documenting it.

Understandable, but open disclosure would help. You of all people must know how hard it is to hide things from being discovered, and this is something that will be discovered without any doubt. Just explain it and most reasonable people will understand. Some won't but at least they will be honestly warned.

> I'm autistic and long-form writing isn't my strong suit, getting a 4000 word blog post to flow well is genuinely hard for me.

I find the way I interact with the world is exceptionally different from the descriptions of everybody else. Some of the symptoms of such manifest as difficulty communicating... with most people.

There are a subset of people who I have not only no problem, but seemingly a drastically increased information exchange rate.

Do with that observation what you will, but I don't write for the lowest common denominator, the preferred style of AI, because I don't write for the people who cant be bothered to understand me. I'm writing for people like me.

n.b. Maybe you are writing for the lowest common denominator. In which case, say that: "Yeah I know it sounds like AI but it's supposed to be advertising, not a technical white paper or PoC"

> the AI just helps me get a baseline down so I'm not staring at a blank page.

If this was true, the top comment wouldn't be a complaint about how the voice of the article sounds "inauthenticlly human" or like an LLM. It's having a stronger influence on your writing than you're giving it credit for. It's on you to decide if or how much you care, but ideally you wouldn't be lying to either yourself or your readers.

I got 100% Human on Pangram, so either they did the work to have their AI service pass this test, or...they actually wrote it.

These comments don't help much. AI is here, not everybody can write well, AI is gonna be used.

I'd wish we come to a day where people would just post the prompt. Then I can decide what story to generate from it.

I'm still planning to add a "AI-edited version" toggle to my blog. Not that it would do anything, because people wouldn't click it anyway.

Look I don't like to see a wall of AI slop as much as the next person (see: https://news.ycombinator.com/item?id=48551462), but "just post the prompt" is also too dismissive. AI had access to information that we don't have and all you see here is probably a compilation of multiple prompts, edits and various sources (like author's notes) for context.

We can adjust our expectations for people to take some time to make the output theirs.

OTOH, and this is me arguing against myself, maybe this is not too different than the million web sites we saw using the unmodified default bootstrap theme.

I guess my opinions as well as the response of the community are still evolving.

- It's called "writing in bullet points"

- Normies frown upon it

They don't! Before AI, people complain about long emails and what not. The literally preferred to read short ones.

The problem is that people who are bad writers have trouble understanding that AI writes worse than they do

you clearly have never read a 1000 word text written by me (/s, but only partially)

Honestly I would prefer to read a long text from a human that is badly written than a LLM version. It’s fine to not write well

> AI is here, not everybody can write well, AI is gonna be used.

I don't know about you, but I'd love to read a fascinating story written by a relatively poor writer. But if they can't be bothered to write, I assume the story can't be that good.

But this isn't a story, literature, or a fancy piece of art; it's merely a technical blog post that discloses a security vulnerability. Here, the writing serves only as a vehicle to convey a message. Once you've received it, its purpose has been fulfilled. I would agree with you if the writing were an important part of the message, but here it is not. Not everybody can write well, and this guy clearly had something to tell, and that is what matters.

> But this isn't a story, literature, or a fancy piece of art; it's merely a technical blog post that discloses a security vulnerability. Here, the writing serves only as a vehicle to convey a message. Once you've received it, its purpose has been fulfilled.

I disagree wholeheartedly. I'm not a machine. I'm a thinking, feeling, human being.

As a mathematician, I can certainly appreciate precise formulations. They have their place. But this is not that place.

> Not everybody can write well, and this guy clearly had something to tell, and that is what matters.

I'm sadenned that he wouldn't tell it in his way. I'd much rather read his own (poorly written?) words.

Really amusing to read this one. I did something similar for Qatar 2022 and got access to roster submission (https://zachholman.com/posts/hacking-fifa). To their credit they patched it pretty quickly, but their promised "token of appreciation" never came. (Although on the other hand, they didn't sue me, so I guess that's a win.)

I'll write a full article in a year or two, but here's the short version: some weeks ago, as I was looking for job offers, I found one that was interesting. As I didn't knew the company, I wanted to do my due diligence and check them out. I open the website and find a ClickFix (the "prove you're not a bot" type) attack on their main page.

I spent over 2 hours and a small (but bigger than 0) amount of my own money to report the issue by emailing and even trying to call them (they didn't have any dedicated responsible disclosure page or contact). After some time, they finally answered my emails, took down the website and "fixed" the issue.

When I finally applied for the role, got ghosted for a week and only after I wrote them again, asking for an update, I got rejected as they allegedly were looking for someone more junior - though the job title was explicitly "Senior XXX Lead".

Some years ago, I went to interview (in person) at a big European financial institution. As I got there around lunchtime, I happened to get to the front door at the same time as some employees were returning from lunch who, very kindly, held the door open for me.

I was in their office around their computers, unsupervised and unaccompanied, for 10-15 minutes, enough time to plant some O.MG USB-C cables.

During the interview, I had a chance to talk to the CTO and told them what happened and how I was allowed access in the office, and immediately saw his face change and quickly change topic, and end the interview.

Unsurprisingly, I didn't get the job - I should have probably kept my mouth shut.

Clearly a big f-up by FIFA on what looks like quite a tidy platform otherwise.

One question though, how do you know your feed would kick off the 'real' feed if you pushed to RTMP, does it just take the most recent connection as live? Does the protocol have a mechanism for dealing with multiple people pushing to the same endpoint? There maybe more checking on that endpoint and if course I'm sure most live broadcasters would have a live director to cut any feeds at their end if a dodgy feed popped up too.

A huge vulnerability nonetheless and a great write up!

Good question! So RTMP doesn't really have a clean way to handle two publishers on the same stream key. What would actually happen is the two streams fighting for the ingest endpoint, so the output would glitch between the two sources. Like if I pushed Subway Surfers gameplay it'd be flickering between the actual match and Subway Surfers with the audio cutting back and forth. You're right that a live director would catch it pretty fast but even a few seconds of that on air during a World Cup match is not great.

How do you know that you can even write to any of those fields? You didn't try it, so maybe there is a JWT role check in the backend on POST and PUT.

That's a different thing. RTMP ingest endpoints aren't behind the same API layer, they're just open media endpoints that accept a connection if you have the stream key. The stream key was right there in the URL. There's no JWT involved in pushing video to an RTMP ingest, it's just connect and publish.

I don't understand why people obsess over LLM(AI)format. The content is interesting, but they dismiss it just because the format is an issue. All of this content is worth reading and is good. And it's about security.

It's really annoying. Honestly I'm impressed how quickly one becomes able to smell it after seeing enough of it, I feel like a year or two ago everyone thought LLM bots would be forever indistinguishable from real users (and in fairness, the well-managed ones probably are).

No hate on the author, but LLMs just have such an annoying and overdramatic way of phrasing things. The content is worth reading, I enjoyed it! It would just be even better if it hadn't been turned into such a slog to read through.

I agree. Stylistically, there are parts that really rub me the wrong way as a person

The content is rendered unreadable by the LLMs sentence construction. Secondly, it's insulting. If you didn't care enough to write it, why should I care enough to read it?

Or even believe it. Hard to believe a story if it’s right from an llm.

I saw the this post. Wasn't it a capture of something that actually happened? So it just described a real story. I can doubt the authenticity of all of it whether it's really true or not. but the content itself was interesting enough.

What I don't understand is this: 'Show sincerity'—that is, a human value. If it were AI-generated, stitched-together false content, I'd understand, but I see quite a few interesting points.

Whenever I see things like this, I always think of Sturgeon's law: 90% is bad, and only 10% is interesting. I get that most AI-generated content is AI slop. But even back when only humans could write, there were plenty of clickbait articles.

I agree that GEN AI spam content is generally bad, and I also agree that some of it may lack effort. But honestly, I'm not sure this content is completely meaningless.

Regardless of the packaging, if the content inside is interesting and valuable enough, I think that's what matters. I guess we just see things quite differently.

So what I'm saying is, I don't agree with the idea that he didn't care at all.

Awesome read! Congratulations on discovering this and reporting. Hope you get something back from FIFA. This could've lead to some huge disaster if it failed under the wrong hands.

Love your writing skills as well!

> I closed it immediately. But the damage was done (to my brain).

Laughed so hard when I read this one :D

It was a cool story, no doubt.

> Love your writing skills as well!

I‘d say it was heavily AI assisted

Do you know these feeds actually go to broadcasters? They could be internal feeds for refs, match review, head office monitoring, etc.

The broadcast contribution feeds I’ve seen in the past are MPEG-TS, not via RTMP.

Still a great find.

you're right, it's not the international signals, but internal distribution only

This happens more often than you would think.

During COVID, lots of live shows (concerts, etc.) in Japan moved to streaming (and most of them stuck, so thanks to that, lots of large concerts today have real-time streaming, which is great for foreign fans).

Out of 10+ platforms, more than half have vulnerabilities that allow you to access the content freely (sometimes including the rehearsals, because they are also streamed internally), and on a handful, you can access the admin panel and, as the author said, stream whatever you want.

Most of them have been patched over the years (some are just the byproduct of them changing the backend/SaaS provider, though), but there remain some major providers where you can get content for free.

How could that possibly, ever have made it through. Every single API for every single service didn't check the JWT?

It started as internal service where you need to be connected with a VPN so why bother with security.

Vibe coding? Just have LLM make it and then press merge?

Eh, ironically this is an easy mistake to make for a human especially around how middleware is handled in express or other nodejs libraries, it's the reason why so so many of the vulnerabilities come from node based apps. Python has similar footguns as well with undefined objects failing open. Typescript has somewhat mitigated these for node, but there is no real fix for python other than skipping libraries that allow failing open.

Yeah I see this type of crap often honestly, especially at big companies.

You hit the jackpot on security research, but you cannot take like an hour or two to at least get rid of the AI smell? Please do use AI, nothing against that, all I'm saying is please, please don't deliver this weirdness:

> I did not touch any of these controls. But they were there. Functional.

I really needed to push myself to read because it was very interesting and thank you, for doing the work and sharing.

Right before contacting FBI I would start Subway Surfers stream. Fuc** Driven Development it still the only way for big orgs, this is the only way as we can see...

> Client says "access denied"

> Server says "here's everything"

hahahaha

> Hire me (just kidding... unless?)

FIFA is a legendarily awful organization. In my weaker moments reading your piece I thought to myself how nice it would have been if someone more ruthless than you had been made an example of them.

To be fair FIFA is one of the best international federations in terms of good governance. Dutch sport think-tank Play The Game has an assestment methodology and the project called "Sports Governance Observer" and did asses FIFA in 2018 [1]

FIFA gets disproportionate amount of attention and, ofc, high-level corruption scandals, but I would say it's more like a by-product of the sheer scale of the football, and not a problem with FIFA itself. I believe most sports federations in the world are very far from FIFA in terms of governance, but also from facing problems that FIFA has.

[1] https://www.playthegame.org/publications/sports-governance-o...

Great article! You must be pretty confident to click the "stop streaming" button without knowing whether a confirmation modal will pop up or not

I blocked my network traffic before clicking it cuz I've seen a lot of things without confirmation pop-ups. At least there was a confirmation pop-up.

I thought this too, but inspecting the HTML source could have shown that a nodal would be shown next.

This is honestly one of the only instances where I am like "you're an idiot for reporting this". The amount of reach, provided the feeds can indeed be overriden, is absolutely insane. Paired with how shitty of an org FIFA is, I personally would have just leaked this.

As much as I like being butt fucked, I dont wanna go to prison :3

Also, I am not much of a football gal myself, so I didn't know they were a shitty org.

Holy crap. Had to pick my jaw up off the floor. I hope you get some kind of acknowledgement or bounty for this. Kudos for having the willpower to resist sending a message to millions of people and sparking a global phenomenon!

> They understood the issue immediately.

I'm guessing this is not the first time this happened to them.

> Replace that, and every TV network receiving the FIFA feed shows whatever you pushed.

Holy shit, Rickrolling is among the more harmless things you could have done with that.

What's the most harmful thing you could do?

Are you trying to trick me into writing something here that I would later regret?

Use your imagination, brother. What's the worst thing you can think of them showing to the entire world?

JWTs strike again.

encrypted cookies still work & they're stateless. & yeah you can pass cookies between servers & also server - S.P.A.

to BoBDaHacker - great research but slow down on the a.i writing.

If the backend doesn't check the credentials then it doesn't matter if its JWT or encrypted cookies or anything else.

That was really cool! It was one of the impressive exploit i have ever read about. I really hope they give you something in return for your service, at the very least a thank you.

> FIFA never responded. Not to acknowledge the report. Not to say thank you. Not to discuss compensation. Nothing.

If this is true, why help them if they do not take their own security seriously, especially if they have vibe-coded their auth backend server?

If you can Rickroll, you should.

"If you can go to jail, you should."

Registered on FIFA's public Agent Platform with my ID, got added to their Microsoft Entra tenant, and found the Angular app only checked roles client-side. The backend APIs served everything: RTMP ingest URLs and stream keys for every live World Cup 2026 camera feed across all five angles. Confirmed live in VLC. An attacker could have pushed arbitrary video to the ingest endpoints and replaced broadcast feeds on TV worldwide. Write access to match stats, commentator notes, and the live score system was also exposed.

As someone that also wears security hat from time to time, regarding devs best practices, that is a very common failure in SPAs, client side only validation.

There is always some fun showing teams how easy it is to bypass with a plain browser and developer tools window open.

Could have made a killing off of poly market and rick rolled ftw.

Given that they had to hand over their identity to get access, seems like a 1-way ticket to prison (assuming FIFA logs events like that, which honestly I’m not so sure about anymore).

> Hire me (just kidding... unless?)

Would you really want to work for one of the world’s most notoriously corrupt organizations?

I am not much of a football gal myself, so I didn't know they were a shitty org.

I don't follow football in the slightest, but these have been major media stories. See: https://en.wikipedia.org/wiki/2015_FIFA_corruption_case

Not saying "you should have heard of it", just giving info.

The US DOJ investigation found over $150 million in bribes and kickbacks over two decades. This led to dozens of criminal indictments, and ongoing legal battles over the recovery of stolen funds.

But maybe they've resolved that now and are a changed organization? Oh wait, this is the organization that made up a "peace prize" to give to a certain Donald Trump, to make up for the Nobel committee's completely inexplicable refusal to award their Peace Prize to the guy who started a pointless war with Iran that plunged the world into economic chaos. It'd be hilarious, if it weren't so sleazy, sad, and depressing.

Long story short, if FIFA offered you a cybersecurity job tomorrow, you should do a lot of due diligence before accepting.

Reply on news.ycombinator.com