The Federal Bureau of Investigation (FBI) has warned that malicious users could potentially target the Beijing Winter Olympics in February 2022 and the Paralympics in March 2022. However, no details have yet been revealed about the planning of such attacks.
See also: Disposable mobile phones recommended for Olympic athletes
"The FBI is not aware of any specific cyber threat to the Olympics to date, but encourages partners to remain vigilant and maintain best practices in their network and digital environments," the US security agency said in a PIN alert issued on Tuesday.
As the FBI explained to TLP:WHITE PIN, attacks coordinated by economic or state motives targeting the Beijing 2022 Winter Olympics could include malware delivery, distributed denial-of-service (DDoS) attacks, ransomware, social engineering, phishing campaigns, and even insider threats.
If successful, such attacks could disrupt or block live broadcasts of the event, infiltrate sensitive information after breaching IT systems, or affect the private or public digital infrastructure supporting the Olympic Games.
The attackers' ultimate goal would likely be "to make money, sow confusion, increase their reputation, discredit opponents, and advance ideological goals."
See also: 2022 Olympics: The Covid-19 app for athletes has flaws
This warning from the FBI follows a similar one issued last year regarding potential cyberattack risks during the Tokyo 2020 Summer Olympics, which were the first to be broadcast exclusively through digital platforms and television broadcasts due to COVID-19 pandemic restrictions.
Data belonging to the Tokyo 2020 Organizing Committee was stolen in late May 2021, before the games began, after Japanese information technology company Fujitsu revealed a breach of data belonging to government clients, including the Tokyo 2020 Organizing Committee and the Japanese Ministry of the Environment, Infrastructure, Transport and Tourism.
In 2020, the Justice Department also charged six Russians, believed to be members of the Russian hacking group known as Sandworm, with hacking operations targeting the Pyeongchang Winter Olympics.
As revealed by a report by Citizen Lab, My 2022, the official app for the Beijing 2022 Winter Olympics, was found to be insecure, as it does not protect its users' sensitive data and a flaw in the encryption system allows intermediaries to access documents, audio, and files in clear text format.
See also: Tokyo Olympics: 450 million cyberattacks!
The researchers also found that the app collects large amounts of sensitive information, including real-time location, list of installed apps, audio information, location access, device identifiers, WLAN status, full passport information, daily health status, COVID-19 vaccination status, demographic data, and the organization the user works for.
The data collection is disclosed in the app's privacy policy and, according to Chinese officials, is required for COVID-19 protection checks, translation services, and tourist recommendations and navigation.
