How could that possibly, ever have made it through. Every single API for every single service didn't check the JWT?
Vibe coding? Just have LLM make it and then press merge?
I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
11–20 of 109 posts
Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
#12> Replace that, and every TV network receiving the FIFA feed shows whatever you pushed.
Holy shit, Rickrolling is among the more harmless things you could have done with that.
Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
#13Great article! You must be pretty confident to click the "stop streaming" button without knowing whether a confirmation modal will pop up or not
Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
#14Clearly a big f-up by FIFA on what looks like quite a tidy platform otherwise.
One question though, how do you know your feed would kick off the 'real' feed if you pushed to RTMP, does it just take the most recent connection as live? Does the protocol have a mechanism for dealing with multiple people pushing to the same endpoint? There maybe more checking on that endpoint and if course I'm sure most live broadcasters would have a live director to cut any feeds at their end if a dodgy feed popped up too.
A huge vulnerability nonetheless and a great write up!
Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
#15How could that possibly, ever have made it through. Every single API for every single service didn't check the JWT?
Vibe coding? Just have LLM make it and then press merge?
Eh, ironically this is an easy mistake to make for a human especially around how middleware is handled in express or other nodejs libraries, it's the reason why so so many of the vulnerabilities come from node based apps. Python has similar footguns as well with undefined objects failing open. Typescript has somewhat mitigated these for node, but there is no real fix for python other than skipping libraries that allow failing open.
Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
#16Please stop using AI to write for you, it ruins what is otherwise a fascinating story, and on reflection I struggle to trust it.
If you used AI to generate the blog post, did you use AI to generate the screenshots and story?
Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
#17Great article! You must be pretty confident to click the "stop streaming" button without knowing whether a confirmation modal will pop up or not
I thought this too, but inspecting the HTML source could have shown that a nodal would be shown next.
Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
#18Great article! You must be pretty confident to click the "stop streaming" button without knowing whether a confirmation modal will pop up or not
I blocked my network traffic before clicking it cuz I've seen a lot of things without confirmation pop-ups. At least there was a confirmation pop-up.
Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
#19Please stop using AI to write for you, it ruins what is otherwise a fascinating story, and on reflection I struggle to trust it. If you used AI to generate the blog post, did you use AI to generate the screenshots and story?
I remember a frontpage post from like 2 days ago:
"If you want human attention show human effort" or something in that direction. I think this fits here just right.
Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
#20Earlier quoted context omitted.
Vibe coding? Just have LLM make it and then press merge?
Eh, ironically this is an easy mistake to make for a human especially around how middleware is handled in express or other nodejs libraries, it's the reason why so so many of the vulnerabilities come from node based apps. Python has similar footguns as well with undefined objects failing open. Typescript has somewhat mitigated these for node, but there is no real fix for python other than skipping libraries that allo…
Yeah I see this type of crap often honestly, especially at big companies.