BSides Cape Town 2019 Goose Hunter Challenge

For BSides Cape Town 2017, MTN kindly gave us a set of prizes to give away to the winners of our challenges. For that year the badge team had two physical challenges, both based around ‘unbreakable’ boxes – one with a custom rf lock and the other with some fairly difficult locks to pick. Both boxes were opened in ways that weren’t part of the challenges!

This year the badge team had three prizes from MTN – two top of the range phones and a high spec laptop. The phones went to the teams that won the two badge challenges, and the laptop went to the team that hacked everything (scoreboard, firmware, and the Goose Hunter challenge).

These fine specimens left golden eggs in hidden spots around the conference, and for some unknown reason fitted them with BTLE beacons! Luckily the ESP32 on the badge has a BTLE stack and we were able to write some software to track them.

It turns out our Golden Goose Christo also laid an egg and kept it in his pocket for the day.

(Pictures from Wikipedia)

After ordering the messages using the first column, the second column seems more like English!

fEdvb3NlfExlZ2VufGlkWSBm:|Goose|Legen|idY f
fCBpcyBsfGQgaXMgfHJwak1t:| is l|d is |rpjMm
fG9vc2UgfEBmbHVmfGUgUFhv:|oose |@fluf|e PXo 
fFRoZXkgfGZ5cG9ufCBRUSBq:|They |fypon| QQ j 
fGhhdmUgfHkgbG9zfENyIFVh:|have |y los|Cr Ua
fHRoZSBrfHQgaGlzfCB0aCBh:|the k|t his| th a
fGV5cyBGfCBwdnQgfHVNSWJl:|eys F| pvt |uMIbe  
fGluZCB0fGtleXMgfCBwSk0g:|ind t|keys | pJM 
fGhlbSBhfGluIGJvfFdhZWxr:|hem a|in bo|Waelk
fG5kIGRlfGF0aW5nfCBkYWdi:|nd de|ating| dagb
fHN0cm95fCBhY2NpfG91ciBY:|stroy| acci|our X
fCB0aGVtfGRlbnQgfGZjVWFp:| them|dent |fcUai

There’s another message in there:

"Legend is @fluffypony lost his pvt keys in boating accident "

Fluffypony? Previous BSides Cape Town badges have been sponsored by him or by MyMonero. Thanks Mr Pony!

Ok so what about the final column?

fEdvb3NlfExlZ2VufGlkWSBm:|Goose|Legen|idY f 
fCBpcyBsfGQgaXMgfHJwak1t:| is l|d is |rpjMm 
fG9vc2UgfEBmbHVmfGUgUFhv:|oose |@fluf|e PXo 
fFRoZXkgfGZ5cG9ufCBRUSBq:|They |fypon| QQ j 
fGhhdmUgfHkgbG9zfENyIFVh:|have |y los|Cr Ua 
fHRoZSBrfHQgaGlzfCB0aCBh:|the k|t his| th a 
fGV5cyBGfCBwdnQgfHVNSWJl:|eys F| pvt |uMIbe 
fGluZCB0fGtleXMgfCBwSk0g:|ind t|keys | pJM 
fGhlbSBhfGluIGJvfFdhZWxr:|hem a|in bo|Waelk 
fG5kIGRlfGF0aW5nfCBkYWdi:|nd de|ating| dagb 
fHN0cm95fCBhY2NpfG91ciBY:|stroy| acci|our X 
fCB0aGVtfGRlbnQgfGZjVWFp:| them|dent |fcUai

Following the pattern of the first and second pieces of text, the final piece can be assembled like so:

"idY frpjMme PXo QQ jCr Ua th auMIbe pJM Waelk dagbour XfcUai"

It looks like it could be ROT-13, ROT-n or some other type of substitution cipher, but none of the online tools decode it – for instance ROT-13 produces the following:

"vqL secwZzr CKb DD wPe Hn gu nhZVor cWZ Jnryx qntobhe KspHnv"

The text is suspiciously English-like in its structure, although the upper-case letters are confusing. Simple letter frequency analysis doesn’t produce useful results… so what could it be?

In cryptography, one of the next steps in evolution after plain substitution ciphers was the introduction of a key. In this case, a it’s effectively ROT-[key], where the plain-text characters are rotated through the alphabet by the index of the corresponding key character. For example: encrypting ‘abc’ (plaintext) using ‘ccc’ (key) and the alphabet [a-zA-Z] results in ‘YZa’. Similarly, ‘abc’ (plaintext) using ‘bbb’ as a key results in ‘Zab’. This is because for example when we move ‘c’ (3) to the left by ‘b’ (2) characters we get ‘a’ (1) as a result (3-2=1). Moving past ‘a’ wraps around to the upper-case characters at the other end of the alphabet.

abc => ( 1  2  3)
---
bbb => ( 2  2  2)
===
Zab => (-1  0  1)

So what could be used as a key? What about the other messages, seeing as they’re the same length let’s try those. The first message doesn’t produce a usable result, but using the second message as a key and calculating the offsets using some python we get:

ROT-k(
    "Legend is @fluffypony lost his pvt keys in boating accident ",
    "idY frpjMme PXo QQ jCr Ua th auMIbe pJM Waelk dagbour XfcUai"
) = "The supreme art of war is to subdue the enemy without fighti"

The final prize! Well done you have defeated the Goose enemy!

Challenges are always hard to set – too easy and it’s solved immediately, too difficult and it doesn’t get solved. The puzzle was designed with three levels to address this problem. While it could be said (by Dale/Ross) that the final level was difficult enough to destroy friendships, in the end they solved it on the day.

This was a fun physical puzzle to run, and the Goose Hunters enthusiastic. Thanks to everyone that played!