Description

Welcome to the CYBAR Open-Source Intelligence CTF. Most challenges can be solved with a browser and some know-how - online tools might help too.

When you find something, whether it be a picture, text, code or whatnot, you can submit it into the CTF server by putting the ‘flag format’ around it. For example, if the flag asked you to find the name of a yellow fruit, and yo confirmed it was a banana, you’d submit “CYBAR{banana}”. Don’t worry too much about caps, it’s not case-sensitive.

To kick it off, let’s try your first flag. You get into work, boot up your system and hit Spotify up. You can’t remember the name of the artist or song you were listening to the other day but it put you in the ZONE. Scratching your head, you remember just a line of lyrics…

“In the name of the Spam God, that’s what’s up”

Huh. Let’s do a quick search and see if we can find the artist, and submit as a flag. When done, you can kick off their playlist to pair with the CTF.

Method

This was just a quick warmup task, so nothing super difficult here. Mods were even kind enough to supply the correct google dork in the description.

Put "In the name of the Spam God, that's what's up" into your favourite search engine and you’re off to the races!

Description

The Roombas are trying to gain the upper hand over the human population. We believe they’re going to target pivotal industries such as real estate, critical infrastructure, information security and healthcare. We don’t know who yet, but we know it’s a group of close friends and all are infected with COVID-19.

We need to enact Contact Tracing - finding every detail about their lives in order to predict and contain their movements. No one has heard from them since March. We must build up details about them for the agents to then take over. That’s where you come in.

Our first piece of intelligence is a gentleman by the name of Marc Hevis - a co-owner of Hevis Properties Pty Ltd. We have agents ready on the ground, and others covering all his other social media

• your task is to find his Twitter account.

Method

Essentially we have to find the existence of “Marc Hevis” on twitter. There are a few different ways to do this, but I chose to search with: site:twitter.com marc hevis.

We can click on the first result which is for @HevisMarc. We cross-reference some information on his bio to confirm that this is the correct person (he’s the CTO of Hevis Properties according to the bio).

Another good clue in this instance is that the account has few tweets and was recently created which suggests that it was purposely made for the CTF.

Description

Pong may have travelled international recently, and we need you to find out which city he was in.

Method

Okay, so to do this challenge we were kind of doing the whole Contact Tracing asynchronously as we chatted about it on Discord. So it was a little out of order, but that didn’t affect the task too much.

After scanning over all of the mutual followers of @HevisMarc, we knew that Pong was a mutual connection and after searching on twitter with: !tw from:HevisMarc we can see that Marc has replied to one of Pong’s tweets.

This tweet seemed to be the most likely to suggest that Pong had been overseas. By way of a fluke I recognised the insignia on the building as being similar to the Sri Lankan Flag 🇱🇰.

As the building was quite large and “imperial-looking”. I searched on duckduckgo for sri lankan government building, and after scrolling through the images I found a building that had the same two distinctive inverted glass entry covers.

Interestingly, the correlating image was on an Austrian website (who would have guessed?). The caption of the Austrian site said that it was taken in Colombo.

Description

We need more locations Alycee may have or will visit in the future.
What is the first name of the park that Alycee likes to visit?

Method

This challenge was part of the wider Contact Tracing series, and Part I asked us to find Alycee’s art account.

Having previously done this, "JakePaul" had the art account link and there are a few examples of drawings that she enjoys making. One of them was “My favourite place”.

Upon closer inspection, this image contained a set of coordinates:

 38° 01' 27.8" S  (latitude)
145° 20' 29.0" E  (longitude)

I’m a very decimal kind of person, much the same as most technology that deals with maps so I opened up a GPS coordinates converter which provided the correct decimal conversions from the original degrees, minutes and seconds. Google maps does also accept the old-style coordinates but without the degree symbol readily available on my keyboard, I just went for the quick and easy solution of getting it converted. 🤷‍♂️

!maps 38°01'27.8"S 145°20'29.0"E

Those coordinates led us to Wilson Botanic Park on Google Maps, so boom, another flag.

Description

We need more locations Alycee may have or will visit in the future.
What is the exact name of the volcano that Alycee visited?

method

For this challenge, once again we are hanging out on Alycee’s deviantart page (she’s pretty great at drawing, I won’t lie).

The day it all changed is a drawing of an erupting volcano in Hawaii, and much like Part III, there is information hidden within the drawing: A date, 30 April 2018.

Using the query: hawaii volcano eruption "30 april 2018" on duckduckgo, we scroll down a few times and find a wikipedia article about the 2018 lower Puna eruption which mentions Kilauea by name at the correct point in time, so we have the name of our volcano 🌋.

Description

Contact Tracing continues. We need to locate Marc’s home and evacuate the neighborhood/building and place them in isolation.
What’s the name of the building Marc lives in?

Method

Oof, okay, this one was pretty tough, not going to lie. We’re still dealing with the twitter peep @HevisMarc, so that at least makes things a bit easier, no new people. Our biggest data source on Marc has been twitter so we’ll keep rolling with that until it runs out.

If we search twitter with: !tw from:HevisMarc we can go through all the posts that this account has ever made, and one of them has a video taken from a balcony.

It’s possible that an office building could have a balcony, but it seems much more reasonable to assume that this is in fact taken from a place of residence.

Okay, so we have found the video and we’ve got a pretty strong case that this will be the correct source to show where Marc lives, now we have to geolocate the building from which the video was taken, to figure out where his house is.

One of the most distinctive features in the footage is a building that has a face as part of the facade.

If we drop: "building with a face" into duckduckgo, we discover that this building is located in Melbourne, Australia, off Swanston St in the CBD. This fits the profile of the twitter account, so things are starting to piece together now.

We have a rough idea of where this took place, we now need to find the correct perspective in order to establish which building in particular it came from.

I went into 3d satellite google maps to check this out:

Turns out there are actually more than one QV1’s in Australia, so that caught me out once 😬

Anyway, we have the building’s name now: QV1.
Nice, a tricky but very fun challenge.

Description

We need more information on the building to work out the level it’s being potentially filmed from. How many levels (above ground) does the building have?

Method

Well, the good news is we’ve already done most of the hard work for this challenge in part 1.

On duckduckgo we put in: qv1 melbourne storeys

We end up with the third result being a link to the architects who designed the building that we’re looking into.

It turns out we actually end up with essentially two flags in one on this page as what we need for the next challenge is available here too, but for this one at least, we know the number of storeys now: 44.

Description

Alright, we need to figure out how long Marc has lived there for, and the earliest he could have moved in. What was the year the building was finally built in?

Method

Not much method here, we refer to the resources from the previous challenge, and we have a completion date of 2005 for the build of the project, so that would make it the earliest possible year that Marc could have moved in there.

Description

We’ve just received a report of The Daily News publishing an article that is causing a lot of concern and fear in the public. Given its wording and theme, we are sure it’s fake news generated by the Roomba. However, TDN will not disclose their source. Here’s the article, we need you to find the exact number of people that went through Southern Cross Station at the exact time referenced so we can determine if the article is fake. SX Station has released a statement saying that all footage of that night has been deleted so we can’t rely on visuals.

Article text:

“Wild scenes as 40 people confirmed to be infected with COVID-19 ran through Southern Cross Station at 4:00am on Friday, the 28th of February 2020. The frightening witness account has caused panic buying at stores around the country as people prepare to stay indoors. Our source confirms they were the only witness and that this infectious routine could be happening at other major transport venues through the country without the public’s knowledge."

Find the exact number of pedestrians that walked through Southern Cross Station that morning at 4am, on Friday, the 28th of February.

Method

What the heck!?

Definitely a good reason why this was set to 650 points, from the first time hearing it, this challenge sounds basically impossible. Let’s break it down.

The good news is, we have something very specific to shoot for, we know the exact target so we don’t have to use too much guesswork to know if we’ve arrived at the right solution, the problem in this challenge is mostly in the “where do we find this information?".

I took a number of failed approaches here, I copied different excerpts of the article text and tried to get something out of that with no luck. Searching for COVID-19 southern cross news also failed pretty spectacularly.

I took some time away and worked on other tasks before coming back to this one, and started to reason about what was the information I was really after.

I entered:

southern cross foot traffic

…as a query into duckduckgo. After scrolling down a tiny bit, I stumbled on a news article from the Herald Sun (a local Melbourne newspaper). Reading through the article, they had graphs showing levels of foot traffic through various places throughout the city, one of them including Southern Cross station. The source that was quoted for these graphs was the City of Melbourne. Time to go data hunting.

Another search:

city of melbourne data

Oh? They have a whole website dedicated to city-related data, and it’s completely open access? Excellent, just what we need!

An internal site search for foot traffic returned a dataset that contained hourly pedestrian counts since 2009.

After using the site to filter out the data to get to the point in time in question, we arrived on our magic number: 14. Not very many people to be going through the station at that time of the day, but it is 4AM, so that sort of makes sense.

Turns out that The Daily News' article was definitely fake, we found the official data to prove it …unless that was fake too? 😱

Description

We need to find Marc’s second office location (not the primary workplace) for the contract tracing. Business records tell us it’s relatively new. Scour his Twitter account and see if there’s anything that can help us geo-locate it. We don’t need it down to the road, just the town (not suburb) and we can work from there.

Method

Ahh Marc, I will miss you after this.

We need to find Marc’s second office location, and judging by the challenge name, we’re going to be looking for something to do with wifi.

We scroll through his tweets one last time and we stumble on this:

I hope that Marc does finally end up with 100Mbps speeds, he seems like a pretty good guy, and we all deserve to have the internet speeds that we dream of. But that doesn’t stop me from wanting to pinpoint the location of this network that he’s on.

He’s given us the BSSID and the SSID, both of which are pretty handy in narrowing down his location using a tool like wigle.net.

We do need to make an account for the service in order to use the advanced search features, but that’s fine. Once we do, we can use the advanced search to fill in his BSSID and SSID, and hey presto, we end up with his network pinpointed on the map.

If we zoom out a bit, we can see that the town in question is Ballarat.

Game, set, match(ed by BSSID)