Catapult Sports (cfb practice software being restricted by Michigan and bama) under NCAA investigation

Submitted by Malarkey on December 29th, 2023 at 4:32 PM

https://ftw.usatoday.com/2023/12/catapult-app-alabama-banned-players-from-using-says-ncaa-investigating-unauthorized-access-to-football-video-footage

Per Catapult:

“We are aware of the ongoing investigation of the alleged unauthorized access to NCAA football video footage. We have conducted an internal investigation and have not found any security breach in our systems. We have shared this with local authorities that are conducting an investigation. We will continue to support the ongoing investigation with the NCAA and local authorities. At Catapult, we hold ourselves to the highest of standards and safeguarding customer information is of utmost importance to us.”

 

 

this was the software the “stalbombs” Twitter handle was claiming osu exploited to spy on Penn state, Maryland and others 

 

 

Football

Ernis

December 29th, 2023 at 6:44 PM ^

My experience with tech startups has led me to believe that, while what you say re: multifactor authentication is certainly best practice, it's not a safe assumption

Unless there’s some regulatory requirement with actual enforcement mechanisms forcing it, companies typically view security and privacy as cost sinks and they get neglected. So unless you’re operating in finance or government or healthcare or some other regulated space… yeah, I wouldn’t be all that surprised if they still had a shared admin account using default credentials to manage such a server

Joined: 09/23/2008

MGoPoints: 11479

charlotteblue

December 29th, 2023 at 6:56 PM ^

Yes, the finance industry. We have and store customer financial and personal data including SS#, email, location etc.

As secretive as football coaches and administrators are I'm surprised anyone would agree to use the software without feeling reasonably certain it was actually secure.

Joined: 02/12/2019

MGoPoints: 5534

Ernis

December 29th, 2023 at 7:31 PM ^

Yes, but these cloud software vendors tend to be pretty cagey about disclosing technical details related to potential vulnerabilities. The customers probably get some boilerplate about how great their security is and if their diligence is aboverage, maybe they can get a SOC 2 audit report or something along those lines from the vendor.

Joined: 09/23/2008

MGoPoints: 11479

ESNY

December 29th, 2023 at 5:52 PM ^

Agreed. This statement just means no external hacker was found to have breached their systems.
 

Does not rebut that an insider may have granted access to certain tapes/files to an individual that shouldn’t have had it. That would be a breach of contract but wouldn’t relate to a cyber breach.

the OSU insiders at the company and the earlier smoke, it’s not hard to jump to the conclusion that some presumably Michigan-related videos were passed along to OSU

Joined: 11/06/2008

MGoPoints: 12310

Yeoman

December 29th, 2023 at 9:49 PM ^

Since the original allegations involved PSU videos going to OSU, I'm going to assume that's what we're talking about until there's some indication otherwise. If we had reason to think our own videos were leaked we would have said that, instead of talking about somebody else's stuff.

Joined: 06/08/2011

MGoPoints: 21391

bronxblue

December 29th, 2023 at 6:14 PM ^

Yeah, having worked in software development and IT at companies with very sensitive data I have my doubts about the veracity of that statement.  People wouldn't be looking into illegal data access if their hadn't been some purported form of unauthorized access, and my guess is this is a very narrow, semantic use of the term "breach" here mostly as damage control.

Joined: 11/22/2008

MGoPoints: 171968

stephenrjking

December 29th, 2023 at 5:06 PM ^

Wow.

This explains why both Bama and Michigan have restricted their players from using iPads. I thought it was a catty shot at the Stallions thing, but apparently not. 

Unauthorized capture of practice footage by opponents *is* a big deal (Stallions is alleged to be getting information that is literally publicly shown to 50-100,000 people, not at all the same thing) and is, frankly, a much bigger controversy than what is alleged by us. Now, if *Michigan* is the guilty party, that is indeed serious and a gut punch. But if it's someone else, I would expect and demand a proportionately larger media scandal, and any failure to do so would expose the Stallions thing as an issue of hype rather than substance.

Much like the lack of interest in Nick Saban having contact with Domani Jackson during a recruiting dead period while Harbaugh has been suspended multiple games for a hamburger. 

Edit: FWIW, nothing has yet been found, and based on the quote in the OP, for all we know *all* of this could just be something done in response to the type of allegations found in the stalbombs stuff. Which is to say, suggestions without any actual fact. But who knows. 

Joined: 03/15/2012

MGoPoints: 20144031

Yeoman

December 30th, 2023 at 10:18 PM ^

That's always how I thought this would go down; it's probably what was intended. The point of stalbombs was/is to get some journalists interested in stuff that Michigan was convinced of but couldn't prove. It only takes one of those to pan out for people to start digging at the others, and this was always the most likely to break first. Catapult is motivated. They've got a worldwide analytics business that could collapse under them if they let things go.

Joined: 06/08/2011

MGoPoints: 21391

GLORY

December 29th, 2023 at 6:15 PM ^

"SOME good info?"  How is this good information when it's not verifiable by credible sources?  

Similar to Day's potential involvement in PI hiring, Stal Bombs took a life of its own when Isiah Hole gave credence to it but of course, he couldn't reveal his sources  He even mentioned that several big media outlets are working on the story.  And that lasted about a week, then went silent and now in hibernation.  Since then, Stal Bombs posted exactly ZERO tweet and Hole hasn't given any update, not a thing.  

Where this will lead?  Nowhere.  Don't expect these bombs to ever detonate.

Joined: 06/12/2021

MGoPoints: 20492

M-Dog

December 29th, 2023 at 6:27 PM ^

This is still one of the headlines still on the ESPN NCAAF home page:

"Tide take precautions in wake of Michigan sign-stealing scandal"

Yet this has nothing to do with Michigan.

 

Joined: 07/06/2008

MGoPoints: 257576

Amazinblu

December 29th, 2023 at 6:46 PM ^

ESPN is just trying to solidify their following - after all, they’ll be broadcasting the SEC next year.

They may not demonstrate knowledge about football - but, that Disney marketing machine knows a thing or two about keeping potential customers / visitors interested.

Joined: 01/22/2010

MGoPoints: 42231

Amazinblu

December 29th, 2023 at 6:43 PM ^

So, did a Catapult authorized individual enable certain individuals to review / acquire material which was the property of other entities?

Could there be any accuracy to a rumor that a certain school in Columbus actually received access to - or the media - of other teams?

Joined: 01/22/2010

MGoPoints: 42231

Hensons Mobile…

December 29th, 2023 at 7:02 PM ^

Alabama media is very confused about the whole thing and is trying desperately to make sense of it. It's pretty funny, actually. They're calling UM police and FBI's Detroit office seeking comment, and they're trying to connect it to Weiss (of course).

https://www.al.com/alabamafootball/2023/12/after-alabama-locks-down-film-catapult-says-ncaa-investigating-unauthorized-access-denies-breach.html

I don't think the Alabama media is being devious, here. I think they're legitimately confused. From their perspective:

  1. Michigan is under investigation for stealing signs.
  2. Helow was hired.
  3. Bama said "We don't use iPads now because of stuff Michigan is known for" (paraphrasing their player).
  4. Catapult security is part of an NCAA investigation.

They do mention that Wetzel said UM is not at the center of the Catapult investigation and also that Michigan stopped using Catapult out of precaution two months ago. Those two items would seem to suggest that Michigan is not abusing Catapult but rather has been a victim of it. Yet, Alabama is suddenly concerned themselves just ahead of the Michigan game. Why?

My theory is that as Alabama researched Michigan, they came across this rumor about OSU getting info from Catapult and that Michigan knew about it. Maybe they learned this from Helow, but I doubt it, because Helow was gone before this was a known issue.

Unsure of what or how this happened, they decided that if Michigan knew Catapult could be exploited, they thought Michigan might be willing to exploit it. It's no big deal (as both UM and Bama have now said) to just watch all the film at team facilities, so, better safe than sorry.

Joined: 09/12/2019

MGoPoints: 49873

Perkis-Size Me

December 29th, 2023 at 7:11 PM ^

Can’t wait to hear about Michigan somehow being responsible for this and Michigan should just forfeit the Rose Bowl. 

You know, for player safety and the sanctity of the game…..

Joined: 11/30/2011

MGoPoints: 106047

MHNet

December 29th, 2023 at 7:45 PM ^

As mentioned in threads earlier this season, I work in the TV biz. Just so happens one of my best friends from college worked at Catapult until being laid off earlier this year due to cuts (and believe me, he’s not crying over it but I’ll leave it at that), so of course I had to ping him on this. His dept was responsible for recording games for multiple sporting events and cutting up game tape for teams and conferences (could be a whole game or a clip for social media for example). He said depending how tape is labeled could be an issue. For example, if Michigan requested something and it was labeled Michigan, only they would have access to it. However, if whoever was cutting the tape labeled it Big Ten by mistake, then any team in the conference would have access to it. Or if the conference requested something and it gets labeled under the conference, then any team could see it. Not saying that’s what happened but that’s the one thing he could think of that could have been an issue from his experience there. I’ve seen mentions of practice film being a potential issue but his dept didn’t deal with that so he doesn’t know about any of that.

Joined: 09/30/2008

MGoPoints: 660