dc509 – Tri-Cities, WA defcon group

Next Meeting: July 6th, 2011

by on Jul.06, 2011, under meeting announcements

We’re planning on having an impromptu meeting tomorrow night, June 6th from 6-8 PM. Meeting will be at nGenuity’s office.

We’ll order some pizzas and have drinks available.

Map:320 N Johnson, Suite #300, Kennewick, WA

Best place to park is on the east side of the building, our office is in the northwest corner.

Adam will be doing a preview of his defcon talk on pillaging DVCS repos, and there has been plenty of other interesting stuff going on lately so there should be no shortage of things to chat about.

Hope to see you there!

Comments Off more...

Next Meeting: September 14th, 2010

by on Sep.09, 2010, under meeting announcements

We are re-inventing DC509! We’ve cleaned up the mailing list, we have some great ideas for topics going forwards, and we’re ready to have the first meeting of September 2010. The meeting will be held at the office of nGenuity Information Security, which is located at 140 Gage Blvd, Suite 101, Richland, WA (click the address for a map). The meeting will begin at 7 PM, and run until we’re done, but probably about 2 hours. Some snacks and beverages will be provided.

Aaron Howell will be discussing the future of DC509, and we will have a special guest on hand to talk about lock picking. We will also have some locks to practice on, and picks available to practice with. If you’re interested, feel free to stop by.

Comments Off :, more...

Lost @ Con Mystery Challenge recap, The Final Day

by on Aug.27, 2010, under defcon

After a lengthy interruption due to real life, I’m back to finish up my tale of the Lost @ Con Mystery Challenge at Defcon 18. Previously I covered registration, the first day, day number two, and the third day. This installment will cover day 4; astute readers will notice this would be Sunday, the final day of defcon. We rejoin our heroes after a long night of problem-solving, and possibly some drinking…

As you will remember from day 3, we had finally received a message from the (very creepy) dolls on LosT’s table. The message took the form of the doll’s eyes flashing in a sequence, which we captured on video. After analyzing the video there were two lines of thought regarding how to decode the message. One interpretation was as follows:

Light on means 0, light off means 1. So the dolls eyes had the following:
0101 -> 5
0000 -> 0
0001 -> 1
0111 -> 7

So, 5017 -> 1057 -> LOST. Ok, simple enough, and possibly the correct answer.

However, if you interpret it as light on means 1 and light off means 0, you get something we thought was more elegant:
1010 -> 10 -> A in hex
1111 -> 15 -> F in hex
1110 -> 14 -> E in hex
1000 -> 8 -> 8 in hex

Now, at this point we remembered all the stuff that had gone on from registration to the end of contest. Morse code popped up in the beginning, then resurfaced later as well. In fact, there were several common themes throughout that seemed to do the same thing. So, we thought back to registration, where we had to modify a binary string to make a palindrome, then convert it to another base. Well, switch the second bit on 1000 and you get 1100 -> 12 -> C. Actually, we went back and looked at our video, and the lights inside the first doll were a little ambiguous for the last sequence, so it could be that we had misread them when interpreting the binary in the first place.

When we all met up in the contest area Sunday morning we were going over our various theories and trying to come to a consensus. LosT showed up, and we were given a piece of paper that said simply “Team _____, Why do you do this contest?” The rest of the page was blank. LosT also asked if anyone had a number for him. We discussed the various possibilities and In the end, we went with the last solution, which spells out FACE, a tie in to all of the clocks and masks and other themes used in the challenge. We wanted to give LosT a little treat in how we interpreted things, even though 1057 seems like an obvious choice and we may have lost some points. We also answered his question with “To have fun”, as this is the primary reason all of us wound up trying the contest out in the first place. After lots of second-guessing ourselves we resigned ourselves to the fact that the contest had reached its end, and sat around for the next few hours chatting with LosT and the other teams. Eventually, we decided to get some food and start packing up in preparation for leaving the next day, with an agreement to meet back up for closing ceremonies to see how everything shook out.

Everybody met back up at Track 1 for closing ceremonies, and we found a place to sit. Finally it was time, and LosT took the microphone. He looked a little sad as he explained that this was the last year for the Mystery Challenge as we knew it. When he announced that Team Zero had won the challenge, it took us a few seconds to realize he was talking about our team, referring to us by the number he had given us during registration! We made our way to the stage and gratefully accepted our trophy:

giant bolt cutters

The DC18 Mystery Challenge Trophy

That’s right, the trophy was a set of bolt cutters, about three feet tall and weighing about 20 pounds. Luckily some of our team members live in Vegas, so we didn’t have to try and get it through security in our carry-on luggage. We were so excited about winning that we completely forgot to gather up our Black Badge, and LosT had to bring it down to us:

defcon 18 Uber badge

The DC 18 Uber badge

Earlier in the day we had let the other teams know that we would be going to Hofbrauhus for dinner, and hoped that they would join us. Several Teams said they would be there. We divied up the other goodies LosT had given us, and then headed out in search of victory beer:

Victory Beer!

Victory Beer!

Some of the other teams showed up, and we ate and drank and were merry:

Mystery Challenge @ Hofbrauhaus

Mystery Challenge folks having a great time at Hofbrauhaus

LosT showed up too, and was kind enough to take a victory photo with us:

VICTORY!

VICTORY!

Then LosT suggested that we take a second picture, just for grifter:

...about the bird

Well everybody knows the bird is the word

Just kidding grifter! All things considered, we had an awesome time this year. Team psychoholics would like to thank LosT for consistently putting on a kick-ass contest. We would also like to thank all the other teams who make competing in this contest that much better. Through the course of this contest we have met some really cool people, and we are humbled to be competing with some of the smartest folks out there.

I would also like to personally thank each and every member of Team psychoholics. You guys (and girl!) rock, and I’m stoked to have met all of you, and developed what I’m sure will be lasting friendships. I look forward to seeing all of you next year, including ph4rg0! and stits, since we’ll be at a new property and they haven’t been thrown out of that one yet. Oh yes, about stits. As it turns out, there was someone else at the conference using the handle “stits”, and at some point he tweeted that he should be referred to as “good stits” since he didn’t get 86′d from the Riv. To avoid confusion we shall refer to our stits as “evil stits” from now on.

1 Comment :, , more...

Defcon 18 Mystery Challenge Wrap-up coming soon…

by on Aug.26, 2010, under defcon

So I dropped the ball and haven’t finished my write-up on the MysteryChallenge. I will write up the final day today and get it posted by tomorrow. Thanks to @_defcon_ for sharing the love…

Comments Off :, , more...

Lost @ Con Mystery Challenge recap, day 3

by on Aug.08, 2010, under defcon

If you’re just joining us, you should go back and read the coverage of registration, day 1, and day 2 of the Lost @ Con Mystery Challenge. Today we’ll be discussing day 3 of the competition, Saturday, and while this account runs a little long, this turned out to be about a 13 hour day, just working on challenge puzzles, so I hope you’ll read all the way to the end. After Friday’s fun some of us chose to sleep in, while others met for breakfast and strategery. At breakfast it was decided that we should buy a piece of pie for LosT, as a reference to the numbers on the picture, so a ninja went in search of pie. Once the pie was acquired it had to be decorated, in the spirit of the competition. Using the same runic alphabet that LosT used in his contest a few years ago we wrote “The pi is a lie”, along with a string of random binary, a circle with the symbol for pi inside it, and our team name across the top. Once this was done we headed over to the contest area to see if LosT was around yet.

LosT was just starting to set up when we got there, so we waited for him to get set up and then gave him his pie. He had put up a new clue for us, something to the effect of “We all wear masks”, so we quit focusing on the numbers from the picture and sat down to figure out the cipher text. We made several unsuccessful runs at it, and some members of the team were starting to get frustrated. Around this time we decided it was time to plant a listening device somewhere on his table. After some scouting we found a likely spot, and then it was just a matter of waiting for the right moment when no one else was nearby. As luck would have it LosT got up and left the table for a short time, so we moved in for the kill, only to be thwarted by two other teams coming up to look at things on the table and generally mill around. Finally they left, and we had the opportunity to plant the device, and LosT walked back in. We decided we couldn’t wait any longer, so with LosT standing about a foot away from where we wanted the device we went for it. We managed to get the device under one of the towers he had set up on his table, right next to a light so it was practically invisible. Turning on the receiver we found there was a lot of background noise, but we could make out conversations as long as they were fairly close to the device. One of our surveillance specialists was assigned bug duty and monitored the listening device for useful intelligence.

Meanwhile, back at the ranch, the rest of the team was still cracking away at the mask cipher. The “Poe’s words” hint from the previous day’s letter had us thinking of Edgar Allen Poe, so several of us were looking for connections there while others continued to find a key that would unlock the riddle. The answer finally came to us when someone decided to take spaces into account. Most ciphers do not account for spaces between words, but we tried it on a whim and were surprised to get results. Once the message was deciphered we fed it into google and came up with a quote by Edgar Allen Poe, we took the quote to LosT and were rewarded with an odd piece of blue construction paper with a circuit diagram on it.

The schematic for an FM receiver

The FM receiver diagram

We returned to our room to examine the diagram, and tried to figure out what we were supposed to do with it, since up to this point we hadn’t been given any electronics. By the time we got back to the room our hardware guys had determined it was a schematic for an FM receiver. Someone noticed there appeared to be some writing on the page, and when inspected under bright light there were definitely marks on the paper that looked like writing. The only words on the diagram appeared inside a box, where it said “Heat Shrink Here”. We immediately began trying to heat the page, using the light bulb from our room lamp and the hair dryer, but we quickly decided these were not hot enough. We decided to head over to the hardware hacking village to see if anyone had a heat gun or something similar. We also decided to stop by the chill-out area to run the paper under black light and were delighted to see a message appear. Inside the box it said


Request
Lazlo's
Lunchbox
Have fun

We ran back to the contest area and asked LosT if he had Lazlo’s Lunchbox. He laughed and asked if we figured it out the way he thought we did. we told him we used a blacklight, and he said that we needed to go ahead and do it the “right” way. We shrugged and told him we were on our way to find a heat gun, and headed for the hardware hacking village. We found someone there with a hot-air rework tool and borrowed it. When we ran it over the paper, the words sprang to life. We hurried back to LosT and were presented with Lazlo’s Lunchbox: a small wooden box. We were careful not to tip it or open it yet, and returned to base to inspect it.

We eventually opened the box, after carefully checking for booby traps, trip wires, and alarms. Inside we found a pile of electronics, a small PCB, and a few coils of wire. The hardware team started sorting through the parts and found we had almost everything we needed to create the circuit on the schematic we had been given earlier, but no specific instructions for its assembly. They began reverse-engineering the circuit and putting the hardware together, and the rest of us worked on other things, or wandered around aimlessly. During this down time one member of our elite team cracked the code on the defcon badge. If you hit the “top” button on the badge a couple times you would be presented with “34d+5929″. If you pushed the “bottom” button at this point you would get a screen with a key on it, and the numbers 18 and 10 below the key, and LosT’s name in Korean. the number 34d, if converted from base-18 to base-10, is 1057, which by now you are probably familiar with. In similar fashion, the number 5929 converted from base-10 to base-18 is 1057. Taking the badge at face value we added the two, and came up with 2114. We didn’t know if this was significant, or just something cool that LosT had snuck into the badge this year, but we knew we had the answer now.

Also during this period of hardware hacking we returned to the contest area to find out if we could get the item we had won in the auction Thursday night. This time he said yes, and presented us with a key like the one he was wearing around his neck. There were a couple items on his table that had slots that appeared to be the right size to insert the key, but we decided not to use it yet. We called to check on progress with the hardware hackers and were told they were almost done, and were dismayed to see that two other teams had already assembled their circuits and were wandering around the contest area with them. One of these teams received a key a short time later, and started sticking it in various things. We stood close by, watching to see if we could pick up any info while we waited for our hardware to be completed.

the mysterious key

LosT with one of the keys (picture by ASTCell)

About this time LosT came over to me and said “You know you have a key, right?”, and I told him we had made a decision not to use it until we completed the hardware, because we didn’t want to buy our way past the puzzles. Our hardware gurus finished the box and brought it down, and revealed that right as they were finishing up the circuit they had found the instructions for the circuit in a hidden compartment in the lid of the box. We filled them in on what we had observed while watching the other teams and they set to work trying to find a radio station to tune in. Rather quickly they homed in and found a riddle broadcasting in a loop:


The man who made it doesn't want it, the man who buys it doesn't need it,
and the man who needs it doesn't know it

The answer is “A Coffin”, which we took to LosT and retrieved a key and a small device that appeared to be an RFID reader of some sort. We then started working on the key puzzle. The only things we could find to put the key in on LosT’s table were a book with a keyhole in the middle, and a small box with two red buttons and a slot. We started with the book. There were lights inside that slowly cycled from blue to red. We inserted the key, but the slot was too narrow to rotate the key. we tried sliding it back and forth, and leaning it one way or the other to see if we could get it to engage anything, but none of these seemed to have any effect. We moved to the small box and started examining it. We noticed that when you pushed one of the buttons on the front of the box that some lights would flash on and off, so we tried inserting the key one way, and then turning it over and inserting it facing the other direction and pusing the buttons, but there was no change in its behavior. Shortly it was discovered that the larger, or back, end of the key appeared to fit inside the box, so we untied the ribbon LosT had put on the key, and inserted it backwards. This time when we pushed the button the lights lit up and stayed on, and an LCD in another box came on. It displayed the following message:


My name is the plague, ask me for the right file

This had to be a reference to the movie Hackers. We went to LosT and asked him for the garbage file, and he handed us a single piece of paper. The paper had smiley faces around the border and a picture in the center with some handwritten words:


Tick tock tick tock  from badge to clock

Along with the greek letter Sigma, which is used to represent “sum” in mathematics, and another character that could have been d, p, greek letter Rho, or a musical note, which we never made sense of. With this info in hand we went back to LosT and asked if we could use his clock. He replied that nobody had asked for permission to access the clock correctly yet. A team member noticed a pattern in the smiley faces and went to work deciphering them, discovering them to be morse code a message appeared:


you will turn over in your graves

Returning to LosT once again we were granted access to the clock. From the Garbage File we had a riddle, “sum from badge to clock”, so we figured we need to take the sum we had found earlier and enter it into the clock somehow. The clock had 4 toggle switches, at 5, 7, 10 and 12 o’clock, along with a triangular button at about 8:30, and a plunger directly below that. After some trial and error we found that when you pushed the plunger in an adjacent LCD would output “Chevron locked in”, and display a decreasing number. After you had locked in 4 chevrons the LCD would output “Invalid Input” once for each chevron that was incorrect. We gained access to the clock sometime around 7 PM saturday, and were the only team with access for about an hour, so we were able to try a LOT of combinations. We never got any result except “Invalid Input”. We were keeping track of our inputs to the clock, and we started sensing that maybe something wasn’t right. We had lost two of our team members to the Crash and Compile competition, and other teams were gaining access to the clock, so we appointed one member to do all input, and a rotation was devised so that all teams had equal access to the clock.

LosT's clock

The clock we had to figure out how to enter our code into

We all spent the next several hours trying various methods of entering our answers into the clock, and nobody met with success. We began to suspect that something wasn’t functioning correctly, and LosT took the entire apparatus behind his table to check it out. When he announced that it seemed to be working and set everything back up we re-tried a sequence we had tried earlier in the evening, and were greeted with different message:


Input verified...

The eyes have it...

Then the dolls’ eyes started flashing. Luckily we still had enough time to enter our sequence again and this time had a camera ready to record it. We took the video and started trying to figure out what the eyes were telling us. We came up with some theories pretty quickly, and began working out details, and about that time LosT announced that he was closing down for the night, and we should all go have some fun. (As an aside, we had skipped out on the ninja party up to this point, despite having badges, because we were having so much fun trying to figure out this puzzle. And cheering on our teammates in Crash and Compile…) We decided to sleep on the solution to the dolls’ eyes, and went out seeking fun.

Check back tomorrow for the final installment. Will the cast-aways get off the island? Who is Hubert Humperdink? How much wood would a woodchuck chuck if a woodchuck could chuck wood? Answers to all these questions and more when we wrap up our coverage of this year’s Lost @ Con Mystery Challenge!

Comments Off :, more...

LosT @ Con Mystery Challenge recap, Day 2

by on Aug.07, 2010, under defcon

Welcome back! We have previously covered registration for the Lost @ Con Mystery Challenge, and the first day of the contest. Today we’ll be going over Day 2, the “official” start of the contest. LosT typically likes to kick off his contest at 10:57 Friday morning. Team psychoholics started wandering into the contest area around 10:30, excited to see that LosT was getting everything set up and ready to go. We talked to some of the folks we had met on IRC and wondered where the contest would take us this year. Also around this time the final member of our team met up with us. His name is Brian, and we met him last year while working on the Challenge. He asked if he could join up again, so now we had 10 members total. The appointed time came, and LosT addressed the crowd briefly, stating that the contest had already begun. As soon as we were able we handed him our Golden Ticket (trying to be careful not to let the other teams see us do this…), which we had modified to read “We promise to have fun! roninx”. As a reward, we received a small plastic box with a breadboard in the bottom. On the breadboard was a Basic Stamp 2, a piezo speaker, and 4 LEDs. The LEDs were blinking rapidly in an apparently random sequence. We hid our prize and found a spot where we could congregate and check out our new toy.

small box

This is the little box we got for Stage 1

We sat in the contest area for a while checking out the box and throwing various theories around. We finally decided to take it back to our room and work in a quieter environment. When we got back to the room we hooked the piezo speaker up to the box, and found that the lights flashing sounded just like morse code. We tried a couple different tactics to get the morse code translated, but we settled on recording it, amplifying it, and translating it by hand. Once decoded, the morse code gave us a message:

Hello, have fun. Password is 7557

We quickly took the password to LosT, and received several items in return. Among these items were a piece of black paper, folded in half; a small bottle of what appeared to be water, with a cross on it; a letter with some handwritten numbers at the bottom, and a piece of strange paper with what appeared to be two pictures superimposed on one another; one in red ink, the other in blue. We took these items back to our room and inspected them. Someone pointed out that the superimposed images might be easier to look at with 3D glasses to use as filters, so there was a mission to find some of those. Meanwhile, others were trying to discover the meaning of the letter. At the bottom of the letter was written “Dear Friend, 5, 12 17, 9, 63″. We noticed that if you used the words in the letter associated with those numbers (assuming the first word was position 1) you got the message:

creatures seek the I of

With this info a crack ninja team was dispatched to the contest area, where they took note of a mask on LosT’s table with some letters covering one side, and surrounding the “I”. Pictures were taken, progress of other teams was noted, and the ninja stealthily returned to our secret base.

mask

The mask with cipher text

Meanwhile, our heroes had tracked down some 3D glasses, and work had begun trying to decipher the red/blue picture. Much work went into extracting the numbers from the picture, and shortly we realized that they were digits of pi. There were some oddities which threw us for a loop for quite awhile, for instance the numbers running off the side of the page, and then picking up somewhere else on the page. We noticed there were gaps where this occurred, from 6-9 numbers in length. there was also a string of numbers 5 digits long that didn’t occur anywhere in the first hundred thousand digits of pi. We took various approaches to deciphering the picture, none of which bore fruit, and finally decided we needed to splash some water on the picture to see what would happen. We suspected that either the ink would dissolve, or the paper itself would be destroyed. We were right. We got discreet areas of the picture wet and were greeted with smeared ink and funny, lumpy spots. The paper turned out to be rice paper, though none of us identified it as such at the time.

rice paper picture

This is the picture on rice paper before it was destroyed

Simultaneously another portion of the team was working on the cipher text from the mask. The text was transcribed, and then fed into several scripts to check for Caeser ciphers and other simple ciphers. None of these gave us any useful results. While we were working on this another team took the letter we had received to find a blacklight and inspect it. They returned a short time later with the news that there was indeed writing on the page. The words “poe’s words” appeared at one point when inspected under black light. Soon pieces begun to fall into place. The picture we had destroyed was Kiefer Sutherland from the movie The Lost Boys. One of the Frog brothers from that movie was named Edgar. The writing on the page seemed to point to Edgar Allen Poe. We started looking at Poe’s works, and found several references that seemed to fit with the Challenge. We spent the next several hours chasing red herrings, following each other down blind alleys, and generally running in circles.

One of the things I’ve noticed about the Mystery Challenge over the past few years is that time seems to skew while you’re playing. At one point we would look at the clock and it would be 10 in the morning, and next thing you know it’s 8:30 PM. For this reason I don’t have any idea what time it was when we sent another crack team down to check on other teams’ progress and see if there were any updated hints. LosT was packing up for the evening, and told our operatives that he had intended this to be a stopping point, and that we should chill out for the evening, hit up some parties, and relax. We all agreed that this would be a good place to stop, sleep on it, and do some drinking (this is defcon, after all…) I should also mention that we tried at various points throughout the day to redeem the piece of paper that we had won at the EFF Summit, only to be told that it wasn’t time yet, and to come back later.

We had dinner, had some drinks and then EvilPacket and I left to go to the Spiders Are Fun party in the skyboxes. The others went looking for things to do, and sometime around midnight I got a text message from chaoskitty that said our n00bs had been kicked out of the Riv. We quickly left the party and went downstairs to find out what was going on. The n00bs can tell their own story, suffice it to say that hotel security appears to have dramatically over-reacted to some hackers laughing in the wrong place, and due to other events that were happening simultaneously they chose to be safe rather than sorry. Both n00bs were escorted from the hotel, and told not to return. We met them outside and got their side of the story, and made sure they had somewhere to go for the night, and then decided to head up to bed and try to get it worked out in the morning. Some of the team members stayed up anyway working on both the pi puzzle and the cipher text from the mask.

internet help line

Hello, Internet? My name is flirzan and I have a problem.

Stay tuned, Part 4 coming up tomorrow!

Comments Off :, more...

LosT @ Con Mystery Challenge recap, Day 1

by on Aug.06, 2010, under defcon

In our last installment we covered the steps it took to get registered for the LosT @ Con Mystery Challenge. In this issue we will be discussing Day 1 of the challenge, also known as Thursday. We woke up early Thursday morning and went downstairs to register for defcon. Upon getting our programs we immediately began going over the book with a fine tooth comb, as LosT is known to have hidden clues in the program in past contests. Our search proved fruitful when we found a page with LosT’s picture on it, and a series of numbers that we assumed was some sort of cipher text. We received our registration goodies about 8:30 in the morning. By 9:45 PunkAB had cracked the cipher text while on a conference call. The numbers from the book were:

16 1  11 1  7  4  17 13 24 24 11 6  20 21 0  23 21 16 7  5  17 4  1  6  6  20 21 4  6  17 17 0
16 10 15 2  17 10 3  15 16 22 0  23 18 5  10 7  13 3  12 2  17 14 23 24 20 23 23 10 11 0  7  0
11 1  7  15 13 0  6  14 17 5  17 4  21 1  7  5  21 25 17 13 0  6  20 21 5  21 5  25 11 5  6  17
16 13 13 4  6  7  24 3  23 14 2  3  13 16 12 25 9  14 2  20 8  7  12 6  15 24 21 19 13 9  14 19
4  11 15 20 13 24 24 17 0  19 17 6  20 21 0  23 1  18 21 6  13 5  20 13 15 23 21 0  19 6  20 17
9  3  7  19 1  21 6  4  4  24 7  13 13 13 13 9  7  0  5  12 21 14 24 17 15 15 23 8  25 14 21 24
19 21 14 5  1  0  11 1  7  23 0  1  9  17 24 21 6  17 4  1  6  6  20 21 4  6  17 17 0  25 13 11
21 23 16 19 13 20 11 25 6  22 19 13 6  20 2  3  6  7  2  25 6  24 21 22 10 6  17 1  4  20 1  22
14 17 18 7  0  14 7  6  21 6  21 5  0  17 8  17 4  17 24 21 6  17 10 17 10 15 17 2  6  9  20 17
12 4  12 24 20 25 19 7  8  16 9  23 0  22 24 13 15 1  21 5  11 2  20 12 25 5  1  17 0  25 1  13
0  7  5  17 16 24 21 23 17 6  20 21 5  14 17 15 13 7  5  17 21 6  5  0  1  6  4  21 19 20 6  10
12 23 19 23 4  19 11 17 20 23 10 18 14 20 11 21 17 12 10 9  23 12 17 14 16 23 13 19 20 14 7  13

He tried simple substitution with A=1, then checked it for ROT13, and got a funny message from LosT:

DO YOU REALLY THINK ID USE ROT THIRTEEN
DXCPEXQCDJNKFSXUAQZPEBKLHKKXYNUN
YOU CANT BE SERIOUS I MEAN THIS IS MYSTE
DAARTULQKBPQADZMWBPHVUZTCLIGAWBG
RY CHALLENGE THINK OF IT AS HACKING THE
WQUGOITRRLUAAAAWUNSZIBLECCKVMBIL
GIBSON YOU KNOW ELITE ROT THIRTEEN MAY
IKDGAHYMTJGATHPQTUPMTLIJXTEORHOJ
BE FUN BUT IT IS NEVER ELITE X EXCEPT WHE
ZRZLHMGUVDWKNJLACOISYPHZMSOENMOA
N USED LIKE THIS BECAUSE ITS NOT RIGHT X
ZKGKRGYEHKXFBHYIEZXWKZEBDKAGHBUA

He then used the odd rows as the key for a One Time Pad using the even lines as the cipher text. This yielded immediate results, and we came up with the following:

glad you could make it this year sorry about the rot thirteen thing but as
you know not everything is as it seems I suppose you want to play my game
promise to have fun and we can get started just give me your golden ticket
password roninx

Knowing LosT’s penchant for movies we began fabricating a golden ticket to write the password on. We made some excellent progress on this step, and then went to eat lunch. When we returned from lunch it was almost time for DC101, so we trooped down to Track 1. Previous to defcon LosT had let us know that we should have at least one team member at the DC101 talk to be given Thursday afternoon. DC101 is generally geared toward first timers to defcon, affectionately referred to as n00bs, and covers the basics, such as “have a good hacker handle”, “wear deodorant”, “don’t be a fucktard”, and other gems that will help new people blend in better. The second portion of the talk was a series of minigames, one of which was run by LosT. LosT’s game was a question and answer session. Only the n00bs could answer, and each n00b who correctly answered a question was given a black envelope. The Mystery Challenge teams had the opportunity to grab the n00bs as they came back from the stage and press-gang them onto their teams. Team Psychoholics took two n00bs, who we decided to call “sugartits” and “fargo!” respectively. Sugartits was quickly shortened to “stits”, since it was a palindrome, and easier to say when you’ve been drinking. Little did we know there was already a stits at the con, this will be important later.

Golden Ticket

LosT's Golden Ticket

Upon opening the black envelope that each of the n00bs received, we discovered a golden ticket and an LED. We quickly wrote our password “roninx” on the back of the ticket and went and tried to give it to LosT. He laughed and told us to wait until the next day. We all agreed to meet up later for dinner to get to know the new guys, and spent the rest of the day getting some rest, getting settled into our rooms, and whatnot. That night we went to dinner with stits and fargo!. Much beer was consumed, good times were had, and soon it was time for the EFF Summit party thrown by Vegas 2.0. In the past LosT has been known to auction items at the Summit so fargo!, EvilPacket and I decided to go. Sure enough LosT showed up and told us he only had one item up for auction this year, that it was somehow useful in the challenge, and that we would not be able to take delivery of the item until it was “in play”. EvilPacket and I conferred and decided that we wanted to bid on this item. I looked around and didn’t notice anyone I recognized from other teams, so I felt confident we would be able to win it. I was almost wrong, and there was a 4 way bidding war going on for quite a while. We did wind up winning, though, and LosT gave us a piece of paper with some Korean writing, and the words “sometime friday” at the bottom.

We decided to call it a night a little while later and looked forward to the “official” start of the contest the next morning. Stay tuned for Part 3, where our heroes translate morse code with one ear tied behind their backs!

1 Comment :, more...

LosT @ Con Mystery Challenge recap, Registration

by on Aug.05, 2010, under defcon

Here it is the beginning of August, and another defcon has come and gone. Once again this year a few members of dc509 competed in the LosT @ Con Mystery Challenge. EvilPacket and flirzan were re-joined this year by PunkAB, chaoskitty, and krux, and welcomed a few new members to the team as well. krux’s friend fish joined up, as did VoltageSpike, whom we met on IRC during registration. Together we came to be known as Team 0, aka Team psychoholics. Previous to registration LosT had mentioned that this might be the last year for the Mystery Challenge, so we were very motivated to make a good showing this year.

Speaking of registration, it started all the way back in May, May 7, 2010, to be exact. If you write this date down in the common European format it becomes 10/5/7, or 1057, which happens to be the handle of the guy who runs the Mystery Challenge. On this date LosT^ came on irc, to the #mysterychallenge channel on efnet, and played a game with those of us who were there. a partial transcript follows:

<LosT^>	I really enjoy robots
LosT^ is now known as GuessWho
<GuessWho>	Hello
<GuessWho>	1981 wasn't a very good year for me :(
<GuessWho>	I was a heck of an engineer though
<GuessWho>	Any of you ride motorcycles?
<GuessWho>	Just curious.
<GuessWho>	Yeah, I can't anymore.
<GuessWho>	Sucks.
<GuessWho>	I used to build them though.
<GuessWho>	LOL
<GuessWho>	you guys are awesome
<GuessWho>	That idiot Bob had to go and steal all my thunder
                though. Jerk

This series of hints led us to find a facebook page for Kenji Urada, one of the first humans to be killed by a robot. Most of our team memebers quickly sent him a friend request, and waited patiently to see what would come next. The answer was an image, using a long dead alphabet to encipher a message. By assigning letters to the symbols, and then using frequency analysis on the letters, we were able to decipher the message rather quickly. Once deciphered the message read:

If you want to register for the mystery challenge you are on the right
path. I really like movies though. Hit me up on email, we'll talk.
image size = awesome!

We noticed that Kenji had an email address listed on his facebook page, so we emailed him, and waited to hear back. We got a message back in the form of a note from Kenji on facebook indicating we were on the right path, and more details would be revealed soon. Over the next week or so we hung out on IRC and got to know several of the people frequenting #mysterychallenge. On the 15th of May Kenji posted another note:

"In the first place (contrary to what Randall thinks) title

dictates behavior. (So you're asking yourself, "What's in a name?") Ask

on YouTube. From (the first time I saw) movies like Pump Up The Volume,
I knew the key

to my finding happiness was not only enjoying movies like that sometimes
25 times, but

(to watch) through movies like Repo. Summing it up,

I always have reasons for my actions, or at least try 3.14 times before
giving up.

Look at all the pieces, they're *almost* the same coming or going- but
you can fix them!

I know that sum of you like to try (OR IGNORE) what I say, so

check some (of your work). I'll give you a hint: I was born in the
desert of Phoenix ;) 

Send me a fix (Gmail is fine), and we'll meet in the city of sin..."

We decided this note was a reference to several youtube videos that had been posted on the website, We noticed the odd line spacing right away and started digging for more clues. We spent the next 24 hours emailing random things to Kenji. One of the truly fun things about this contest is the fact that once you start looking you can make all SORTS of things fit into a given scenario. This is also one of the really frustrating things, because it happens fairly often that you stumble on the right answer while running in circles, and it can be difficult to know when to stop. For a little while we took the “throw everything at him and see what sticks” tack, and got many messages back telling us to keep at it, and at one point he told us we needed to “simplify”. We took this literally and removed everything inside the parens, and the note started to make more sense. On the 17th, this was posted on ten-five-seven.org:

Hints from above,
and things that you seek-
Together will tell
if you get registered this week.

LosT loves numbers,
and fun little games-
although answers may vary,
some things never change.

Not meant to discourage,
but provide new friends and fun-
Once you get registered…
wait, the contest’s already begun?

Keeping score late at night,
LosT watches them play-
The more teams you get registered,
the better the pay.

So make some new friends for now,
you can fight with them later-
Defcon’s here soon,
kudos to the baiter.

Along with this:

With every city
a code is associated
just don’t phreak out about it

(just a tidbit, didn’t say what actual checksum is ;) 

And just for grins, I never pay attention to how long movies are…

I’d like to take a minute to point out that up to this point LosT had been posting hints fairly regularly, and to archive them all here would be tedious, and wouldn’t lend anything to the story. Suffice it to say that based on the hints you’ve seen above, and a couple smaller nudges in the right direction, we found that we needed to read only the odd lines of the note from Kenji. This told us to take the first letter of each youtube video, and do something with them. We spent quite a while trying different tactics here, and finally decided we needed to convert each letter to a number. We assumed A=1, and added up the resulting numbers, which gave us 199. When converted to binary this was *almost* a palindrome; 11000111. Adding 256 to 199 gets you 111000111 in binary, or 455 in decimal. From the second hint above we knew the checksum was a Phoenix area code, and 455+602 = 1057, we had found the right answer. We quickly sent our answer and our methodology off to Kenji, and a short time later were rewarded by being the first team to register for the Challenge this year.

We then spent the next few weeks hanging out on IRC getting to know many of the people still working on registration, which is what led to VoltageSpike joining our team. We also dropped the occasional hint to try and help some of the people who were still stuck, and were very happy when those teams got registered as well. In part two, we’ll start going over the steps we took once we hit the ground in Las Vegas.

I would also like to take a moment to thank LosT. Without his hard work and twisted mind I wouldn’t have met some of the coolest people I know, and for that I am grateful. For the past 5 years LosT has expended considerable effort, and plenty of his own money, to put on a contest he felt worthy of carrying his name. I have competed for the final three of those years, and I have to say he has provided some of the most frustrating, mind bending, just plain FUN puzzles I’ve ever had the pleasure to tackle. Thank you, LosT, and whatever the future brings know that you have our respect and gratitude.

4 Comments :, more...

Next Meeting: 3.20.2010

by on Mar.08, 2010, under meeting announcements

When: 3.20.2010

Where: Kennewick Coffee Company

What: March DC509 meeting.

Topics: Threat Modeling / Current News and Events (i.e. Full-disclosure rants and stuffs)

Since our groups tend to be 3-6 people the “Elevation of Privilege” card game might be fun to try out and spark discussion on threat modeling. Lynda posted the details on the 3clug list but forgot about the all important DC509ers so I will cross post a snippet here.

Here’s the blog entry: http://blogs.msdn.com/sdl/archive/2010/03/02/announcing-elevation-of-privilege-the-threat-modeling-game.aspx

Also probably some unpublished research to share…

Comments Off :, more...

Next Meeting 1.16.2009

by on Jan.11, 2010, under meeting announcements

Our first meeting of 2010 will be Saturday January 16, 2009. (Noon until we run out of crap to talk about)

Location: Kennewick Coffee Co, For location information visit kennewickcoffee.com.

Adam Baldwin will give a sneaky peak into some previously unreleased research. The exploit demonstrates pulling GPS coordinates from the device without the end users knowledge. Can you say 0day FTW?

Come on by for some coffee and security nerd discussion.

Comments Off :, more...

Looking for something?

Use the form below to search the site:

Still not finding what you're looking for? Drop a comment on a post or contact us so we can take care of it!

Blogroll

A few highly recommended websites...