0%

Kase Scenarios – Dark Waters

April 16, 2023 - CTF
Back

So if you haven’t heard of it already, this is my write up for the Kase Scenarios OSINT challenge called Dark Waters.

To give you a bit of background information, this is the offical intro..

Welcome to Dark Waters, a scenario that allows you to take on the role of Investigative Journalist Alec Wolfe as he uncovers deadly secrets about a small town in Pennsylvania.

Through Alec, you will experience first-hand what it’s like to collect, analyze, and verify a breaking news piece for a newspaper. This scenario is designed to challenge and encourage you throughout the story to implement Open Source Intelligence and digital investigation techniques including:

  1. Social media analysis
  2. Visually extracting key data points from an image or video
  3. Applying tools, methods, and resources to answer contextual questions to uncover the truth.

When you have completed this scenario you should be comfortable applying tools and methodologies frequently used in digital investigations including journalism. You learn to pivot from key data points and collect information used to answer investigative questions.

Hints:

If you’re stuck on a question you will have the option to receive a hint. Remember there’s a lot to learn from being stuck on challenges. Before taking a hint, be sure you have explored all options, resources, and tools at your disposal. Take a hint when you’re absolutely sure you have tried everything in your toolset.

 

So lets get started.

But before I do I’d also like to say, I have omitted parts of the storyline and visual creativity as this is what makes this challenge so much fun. Where possible I don’t want to spoil the drama Kase Scenarios have worked so hard to create and I want to try and focus only on whats important for my learning journey. If you like what you see, definitely sign up to experience it in person at https://courses.kasescenarios.com/courses/dark-waters

 

With that said, lets really get started.

The scene is set with Alec and his boss George after the following letter is received.. it seems there might be something dark happening in Glen Rock.

Cut to a video showing our arrival in the small town of Glen Rock in Pennsylvania. Once there we meet Lisa who works at the bar and arrange accomodation during our stay and we also notice a girl outside, a local biology student protesting about the quality of the local drinking water.

Form this interaction we can add some items of interest to our list

  • Cars following the protester are all registered to the GRPC
  • Her family have been in Glen Rock for a long time
  • Her mothers great-grandfather bought land in Glen Rock back in 1837
  • Her great-grandfather refused to give up his land to the GRPC plant

GRPC: The Company That Cares About Nature

We’re presented with a short promotional video about the GRPC and at the end of the video is a link to their website https://www.kaseportal.com/grpc. I took some to to read though the website and what it contained. At this point i didn’t make specific notes, but just a mental note of the content should I need to refer to it later.

Getting To Know The Town

At this point we are presented with our first section of questions to investigate and solve. Let the game begin!

 

[Question] What is the name of the protestors relative that was the first to own land on what is now Glen Rock?

For this question we just have to do some simple research. A quick google for Glen Rock, Pennsylvania and our old friend Wikipedia is top of the list with a link to https://en.wikipedia.org/wiki/Glen_Rock,_Pennsylvania and it doesn’t take long to identify exactly what we’re looking for.

Click here for the answer
Glen Rock was founded on August 29, 1859. It started in 1837 with William Heathcote — a native of Cheshire, England, who moved to Pennsylvania in 1826.

Brilliant! That was nice and easy.. on to the next question.

 

[Question] What is the name of the main Railroad through town?

Again, staying with our Wikipedia page for Glen Rock, we can see a section about the Heritage Rail Trail County Park and from here we can identify the railway line.

Click here for the answer
This trail runs along the active Northern Central Railway line and forms the southernmost part of Route J in the BicyclePA route system.

 

[Question] On the side of the local library, what does the third part of the mural say?

I got stuck on this for a while as I was looking at the wrong library.. oh boy. After a quick readjustment and a slap across the face we’re back on track.
A map search for Glen Rock, PA as a starting point gave me the following location https://www.google.com/maps/place/Glen+Rock

An additional search for libraries  in this location pointed me to the Arthur Hufnagel Public Library of Glen Rock

Looking through the photos directly in google maps I came across this mural painting on the side. This was also confirmed from a google street view

Zooming in on the third panel as per the question. We can see what looks like a historic building and the words “FIRST NATIONAL BA”

A quick image search on google for FIRST NATIONAL BANK in Glen Rock presents us with the following building, which looks very similar to our mural painting.

Arghh.. FIRST NATIONAL BANK gave me the dreaded “Sorry, wrong answer. Would you like a hint? If not, click no to try again”. So what do you think the answer should be?

Click here for the answer
This brings up a good observation that thankfully I had read about in an early review by sector035 over at https://sector035.nl/articles/review-darkwaters. Due to the technical limitations of the testing platform, answers are case sensitive. So while “FIRST NATIONAL BANK” is clearly displayed on the building, the correct and exact answer is First National Bank

There you have it. Another question ticked off.

 

[Question] Which female artist donated her pastel work “under the rainbow” to the library?

Again I fired up the number one OSINT tool (google) and literally just searched for “under the rainbow” “Arthur Hufnagel” Library

The one and only result I got back was from issuu which is a digital publishing platform and is often useful for looking up digital copies of newspapers and magazines. In this case we have a copy of the Southern York County Community Courier from October 23, 2019.

Click here for the answer

On page 6 you can see an article in which a Glen Rock artist donated her painting “Under the Rainbow” to the Arthur Hufnagel Library. Another win! The female artist is none other than Maryanne Smith

The answer can also be found by tweaking the google search and you could have also obtained the answer from https://townlively.com/library-will-display-artwork/

[Question] What is the street name of Maryanne’s studio?

So starting with Google again, I searched for the artists full name and  Glen Rock Artist and thought her LinkedIn profile might be helpful. Unfortunately that contained very little information, so I jumped back into google and I found some results from auction sites selling Maryannes paintings. From here you should be able to identify her studio address.

Click here for the answer

As we can see from above and also reading the item details in the auction, her studio is called Maryanne Smith Studio, at 98 Ronald Street, which makes the answer Ronald Street

 

[Question] Where was this taken in town?

If we run this through a reverse image search, I used Google in this case, we get a variety of generic results around graffiti, but at the bottom of my results I can see a perfect match for the location.

Click here for the answer

So it looks like we have identified the location, but we can also take a look at the facebook page https://www.facebook.com/RuinsHall/ to be sure. And there we have it, on the 13th of November 2022 we have a match on the image to show it is indeed from Ruins Hall

 

[Question] The protester was attending an event there on June 8th 2018 what was it?

Staying on the facebook page for Ruins Hall, we can try to filter down the posts to a particular time.


This is where I got a little lost. I can see this venue hosting an event that weekend, but it’s actually on June the 9th. However, after a bit of digging, I did see a reference to the same event in a post on the 18th of May announcing their first 2018 community movie night for Friday, June 8th. Maybe the date changed.

Click here for the answer

So based on our previous research and looking at the event details which will be shown in my next answer, I gave Outdoor Movie Night a try and it was correct!

 

[Question] Which movie was shown at the event?

Hopefully this is an easy one based on our previous research and observations.

Click here for the answer
The answer is Back to the FutureEven though the dates don’t quite match up…

 

[Question] What was the high temp on that day in Celsius(Only one decimal point is needed)?

There are a number of websites that can provide historical weather information for us. A google search for historical weather “glen Rock” PA returns a long list to chose from.

While i’ve used other sites before, for this question I’ll just use Weather Underground

You can change the dates as required and to change from Fahrenheit to Celsius click the settings icon in the top right corner. Now further down the page you’ll see a summary section where you can see the high temp in Celsius.

Click here for the answer
So for this question, the answer is 28 degrees celsius

And we’ve done it! Well, this section that is. Don’t worry, there’s still lots more to come.

Cocktail Party

Download the flyer for the cocktail party, maybe grab a drink for yourself as we have a long road ahead of us.

It’s only natural that Alec will want to check out the party. He wouldn’t be a good investigator if he didn’t!

While there he makes some observations that are worth keeping in mind. There seems to be a relationship between GlenRocks CEO and a local politician Alexander Ross and possibly the owner of the local paper.

While waiting to enter the party Alec overhears the bouncers chatting. Nothing major, but there is mention of the CEO’s son being familiar with setting up crypto accounts. Maybe something for the memory bank to use later. Unfortunately at this point Alec is stoped at the door and refused entry.

Alec did get a photo of GlenRocks CEO, Alexander Ross and the owner of the local paper which we can download. But not sure what we do with it as yet.

 

Okay.. now we get back into the questions.. I hope you’re hydrated and ready to go.

 

The Employees

[Question] Who created this flyer?

There’s nothing specifically noted on the flyer itself, but a good place to check is always in the metadata. Always check the metadata!

There are many tools you can use to do this. Either a locally installed tool which is my preferred method, or one of the many online tools available for free. In this case I’m working off a machine with no tools installed, so i’m relying on online services to get this done. Painful, but you’ve got to use what you have.

Click here for the answer
Uploading the image to https://www.metadata2go.com/ we see a long list of extracted fields. The one we are interested in is creator: Patti Stanton

 

[Question] What is Patti’s favorite thing to do?

Hmm so where do we go with this? Well, remember back at the start we reviewed the GRC website at https://www.kaseportal.com/grpc. It wont be the last time we cast our eyes over it’s content, but for now we’re interested in their Employees of the Month section which gives us a little bit of info about three GRPC employees. Have a read and see what you can find.

Click here for the answer
And as you can see, a lot like the rest of us during Covid, Patti loves staycations

 

[Question] What is Patti’s home SSID?

Now we’re getting tricky. If you’re not familiar, SSID stands for Service Set IDentifier and is your network’s name. If you open the list of Wi-Fi networks on your laptop or phone, you’ll see a list of SSIDs. Wireless router or access points broadcast SSIDs so nearby devices can find and display any available networks.

So how do we find Patti’s? Well the first place to start looking is with https://wigle.net/ which consolidates location and information of wireless networks world-wide to a central database which can then be searched online.

We know that Patti most likely lives in Glen Rock and she loves staycations, so lets see what we can find. You’ll need an account, but the service is free so once you have that, log in and search for Glen Rock, PA, USA to get you in the right location on the map. You should see something like this.

On the left you can search for SSID’s and you can use % or _ as a wild cards. Try searching for words, or parts of words that might be of importance or interest to Patti.

Click here for the answer

So Staycation Wifi is the SSID we’re after. Obviously in the real world we’d need to do a lot more cross-referencing of data to ensure this SSID does in fact belong to Patti. But for this game we can roll with it.In saying that, you’d be surprised how many people near me use identifying features in their home Wifi SSID. Please don’t be that person. Keep it generic. Blend in.

 

[Question] What is the BSSID?

Okay.. what even is a BSSID? Well, BSSID stands for Basic Service Set Identifier, and it’s the MAC physical address of the access point or wireless router that is used to connect to the WiFi.

If you got the last question right, you can definitely get this one.

Click here for the answer

So looking back at what we found on WiGLE, the BSSID and answer to this question is the hexadecimal number 3C:7A:8A:93:D2:5E

 

[Question] What year was this BSSID first seen?

While the dates are shown in these results, using the Advanced Search feature makes it a bit clearer with a First Seen field showing the date we’re looking for.

Click here for the answer

So the answer to this question, the year this BSSID was first seen is, 2021

 

[Question] What is the vendor of this device?

This can easily be obtained from the BSSID. If we put the BSSID into something like https://macaddress.io/ we can see who the vendor is. But how does it know? The first 3 octets of the MAC address are the OUI. An OUI is a unique identifier that identifies an organization.  The IEEE assigns these unique identifiers to companies that need to include them in a product with networking capability.  The IEEE makes this information available to the public, and it is possible to determine what organisations own which OUI.  This is interesting because this is included in a MAC address.

Sorry.. I drifted off for a bit. must have been.. ummm. lack of coffee? Time for a fresh pot and on we go.

Click here for the answer

So, to get back on track, the vendor of this device, based on the OUI of the MAC address is Arris Group, Inc

 

[Question] What is the parent company of Arris Group Inc?

So while initial research for the parent company of Arris Group may point to Commscope, we’ll need to do further research into the company structure. Why? Well, I put that in and the computer said “No!”

What we do know is that the company is US based, so a good place to get detailed documents is somewhere like OpenCorporates.

If we search for Arris Group, Inc and remove all the inactive results, you should come across the following listing – https://opencorporates.com/companies/us_de/5260599

Click here for the answer
Scrolling down, you will see a section dedicated to Parent Companies which shows Arris International Limited as the parent company and as luck will have it, the correct answer to this question.

Ross Campaign Funding

No time to dilly-dally, we’re straight into it..

 

[Question] How much money has GRPC donated to Alexander Ross?

So going back to the GRPC website (I told you we would), there’s a section related to Company News. It’s in this section you can download a copy of the 2022 Annual Report for Shareholders

It’s exciting reading so I did spend quite a bit of time picking through these reports, first looking for obvious transactions listed as ‘donations’ and then I tried looking for items that may be hiding the donations. Up and down I went. Multiple times.

Don’t be me.

Go back to the website and read the information listed near the annual report link. This is where you will find your answer.

Click here for the answer

And there it is right there in black and white. The amount donated to Alexander Ross is $1,214,000

 

[Question] What is the GRPC campaign phone number for Alexander Ross?

This one is an easy one if you reviewed the website. Make sure you read everything.. all the way to the end.

Click here for the answer

At the very very bottom of the site, the very last line says Text MONEY to (931) 532-0554 to donate to the Alexander Ross Campaign.

This ones not a cunning weasel. The answer we all want is (931) 532-0554

 

[Question] How much did Glen Rock Paper Company spend on PR services in 2022?

Right, this time we do actually want to refer to the annual report. And I can safely say I know it inside and out.. because.. research. You will see a line that documents Public Relations Fees which I think we can assume relates to PR services. Here you will find how much was spent in 2022.

Click here for the answer

In this case we see a figure of 11,576 and in the top left it states “In thousands” so I could assume the dollar amount would be $11,576,000.

The correct answer is literally just 11,576 as it appears on the report. Like I said, you sometimes just have to try a couple of variations of the answer just to get it to slot into place.

 

Lab Test Cancelled

Nothing to answer in here.. just a bit of context for future questions. The images speak for themselves.

Rock the Socks

[Question] What is the full name of the owner of this email address?

Right, we know the email address is rockthesocks1982@fastmail.com so what can we do with this?

Often people reuse the same alias across multiple services so we can start by searching for accounts using the same name using something like https://blackbird-osint.herokuapp.com/ which at the time of writing checks against 574 platforms. There are other great options, but this is one I wanted to try out recently.

We get two matches off the bat which we’ll focus on for this challenge. One on facebook and the other on Reddit.

Facebook gives me nothing easily accessible.

However Reddit on the other hand points to https://www.reddit.com/user/rockthesocks1982 which looks interesting. We can see a number of posts and interactions from this user which we can read to gain further information about the user, profiling and so on.

One thing that stands out, is a post from rockthesocks1982 inviting others over to their Steam account to play games.

Pivoting to this Steam profile https://steamcommunity.com/profiles/76561199478297066/ we not only see their Steam alias, but also a list of others they have previously used. Super helpful.

Now I wont lie. I did a bunch of google-fu trying to pull useful information relating to all of these listed aliases with little to no luck. So after a much needed needed break and two Red Bulls I started to focus on the Steam ID 76561199478297066.

It was purely by accident I made the following discovery. I found this API that pulled additional information using the SteamID.. I do know in hindsight now that I could have gone to  https://findsteamid.com/en/home and plugged the SteamID directly in there. It’s much prettier on the eyes and screenshots would have looked better in the writeup.. but it’s not how my life played out. So instead you’re going to see my accidental, boring API results.. which to be fair made me VERY happy at the time.

https://api.findsteamid.com/steam/api/summary/76561199478297066

So using the unexciting api link we can see the following account information.

 

[{“id”:3404171,”steamid”:”76561199478297066″,”communityvisibilitystate”:3,”profilestate”:true,”personaname”:”sloppyfpsgamer1982″,”lastlogoff”:null,”profileurl”:”https://steamcommunity.com/profiles/76561199478297066/”,”profilestring”:”76561199478297066″,”avatarfull”:”https://avatars.akamai.steamstatic.com/eacdad43d2cfcf1ec09eb4997e1e8c21a332290c_full.jpg”,”personastate”:0,“realname”:”John B”,”timecreated”:1676146430,”gameid”:null,”gameserverip”:null,”createdAt”:”2023-02-25T06:02:33.000Z”,”updatedAt”:”2023-04-09T12:05:05.000Z”}]

 

The highlight for me here is “realname”:”John B

Okay, that helps.. but there’s a lot of Johns in this world. So what do we know and where can we go from here. We know John is located in Pennsylvania, most likely Glen Rock. So lets start searching.

We have a couple of options from here. I did try Linked in as it has quite good filters for people, locations and so on but with no initial luck I moved to our other social favourite, Facebook.

See how you get on over there.

Click here for the answer

Searching for people, I searched for “John B” and set the location to “Glen Rock” and low and behold. The very top result is for a John Banks who happens to be a Senior Safety & Security Consultant at Glen Rock Paper Company! That feels like a very hot lead when you put it in context.

So who do we think is the owner of the rockthesocks1982@fastmail.com email address, the correct answer is John Banks.

 

[Question] What year was he born?

Given a number of his usernames contain 82 or 1982 I think that’s a safe bet. Public announcement: please please please don’t use your birth year, or ANY personal information in usernames. Thank you.

Click here for the answer

To collaborate our deductions, facebook to the rescue. 1982 is indeed the year John Banks was born.

 

[Question] Which city is John from?

This one should be a walk in the park, and a great example why not to overshare on social media.

Click here for the answer

According to Facebook, he’s originally from Las Vegas

 

What is the Cache

 

[Question] What is the name of the cache?

Lets see what we’ve got to work with and take a look at r/glenrockresistance on Reddit https://www.reddit.com/r/glenrockresistance/

The linked image looks like some sort of encrypted message.

If you’re as old as me, these were all we had before emojis were even a twinkle in their fathers eye. These my friends are webdings born in the dark ages of 1997. So our best bet is to try and decode these using a reference sheet like the one below (Google is your friend).

Or if you’re lazy you can use a snazzy online tool such as https://www.dcode.fr/webdings-font. To be honest i’m slow at everything so prefer to do it by hand.

Click here for an early answer to a later question

So it seems our mysterious encoded message translates to Incoming cache drop.Sloppyfpsgamer

So we now have a couple of pieces of information. We know there’s some sort of cache drop being placed, and it’s most likely for Sloppyfpsgamer, which name we have come across earlier as an alias used by John Banks (refer back to the Steam accounts). So lets do some digging.

We know this is a cache of some sorts and if we search Google for geocaching sites we get a number of results. The top one being https://www.geocaching.com which I assume is one of the bigger players. Note to criminals: Don’t post details of criminal activity on public sites. Or do.

I definitely feel there’s a better way to do this, so i’ll be keeping an eye on other write ups. I created an account and logged in and then searched for caches in Glen Rock, PA. I’m too lazy to trawl through all the results even though there’s only 217.

I managed to find an option to find friends at https://www.geocaching.com/find/default.aspx which could be helpful. Given the information we already have, I searched for Sloppyfpsgamer and got the following:

https://www.geocaching.com/play/results/

Take a close look at the geocaching users activity and you’ll find what you need to know.

Click here for the answer

This user owns one geocache in Pennsylvania – https://www.geocaching.com/geocache/GCA4XH5 and the name of that cache and answer to this question is GRPC Recon. As Bruce Willis once said.. yippee ki-yay..

 

[Question] What are the coordinates of the cache?

As shown in the cache screenshot above, I hope the co-ordinates are N 39° 48.185′ W 076° 53.772′

But I was wrong. They’re not. Don’t copy this answer.

Click here for the answer

While technically it is correct, we have to do a bit of playing to get it right. I had to use the same co-ordinates, but without the ‘ symbols.
And the working co-ordinates are actually N 39° 48.185 W 076° 53.772

The reason I had the slight difference in syntax, is I had clicked the edit button and copied the co-ordinates from the “Original” setting, which you can see below.

 

[Question] What did the encrypted text say that was posted on the conspiracy forum?

This goes back to the initial encrypted Webding message posted on Reddit, which I did the ground work earlier. I like to be prepared for the future.

Click here for the answer

That decoded message and answer is  Incoming cache drop.Sloppyfpsgamer

 

Finding the Cache

So it looks like we found the sneaky little cache. Well done detective! But what now?

 

Interesting Communication Technique

[Question] What does the text translate to?

Arkg sylbire: Ynxr Zneohet uses a Caesar cipher and to be honest I usually just try to wing it if i’m not 100% sure or familiar. I’d be lying if I said I knew exactly what type without testing it.

My go to site for ciphers is one of the following online tools:
https://www.dcode.fr/caesar-cipher
https://gchq.github.io/CyberChef

For the decode.fr site, just add the cipher text we want to decode and smash that bruteforce button.

Click here for the answer

It’s also worth mentioning that there was a very big clue on how to decode this when we were looking at the GRPC Recon geocache entry at https://www.geocaching.com/geocache/GCA4XH5

On that page you would have seen the following Decryption key.

So using either of these methods we know that the decrypted text is Next flyover: Lake Marburg which was encoded using rot13.

 

[Question] What does N1822H reference?

N1822H is an aircraft registration and you can search and view full registration details at https://flightaware.com . Once you’ve seen a few of these you have a pretty good idea straight away that it’s an aircraft registration.

Click here for the answer

So what does it reference.. well, put simply it’s an Aircraft

 

[Question] What type of aircraft is N1822H?

Using the FlightAware site again, you can find more details about an aircraft under summary.

Click here for the answer

Lets see what we need to put in for this question.. You need to do a bit of jiggery pokery, but I finally got there with tweaking the answer to Piper PA-28-181

 

Getting some Flight Data

At this point in the investigation, Alec has requested some flight data relating to N1822H from the 8th of January 2023 to which we are supplied with a .kml file.

What’s a .kml file you say? It’s Keyhole Markup Language “KML” which is an XML notation for expressing geographic annotation and visualisation within two-dimensional maps and three-dimensional Earth browsers. KML was developed for use with Google Earth.

So what will I do? Open it in Google Earth Pro (Free) of course and I can now see a visualisation of the requested flight path (below)

 

Come Fly With Me

[Question] Which airport did this aircraft fly out of on January 8th 2023?

Reviewing the flight data, either as a text file or with the geographic visualisation above, you’ll be able to determine the airport in question. I know you can do it.

Click here for the answer

We can see KFDK – Frederick Municipal Airport as the flight origin on that day, or more specifically for this question KFDK Airport

 

[Question] Which lake did the plane fly over on January the 8th?

Reviewing the visualisation in Google Earth Pro, we can see a large body of water under the flight path as outlined in green.. You can enable this in the Google Earth Pro layers by ticking the Water Body Outlines.

A google search of Cordorus State Park states it is a 3,500-acre Pennsylvania state park in Heidelberg, Manheim, Penn, and West Manheim Townships in southwestern York County, Pennsylvania in the United States. The park was created around the lake in question, an artificial lake covering 1,275 acres, and is named for Codorus Creek, which forms the lake.

Click here for the answer

So it looks like the plane flew over Lake Marburg which would also correlate with the earlier encrypted geocache which said “Next flyover: Lake Marburg”

 

Unknown Phone Number

[Question] Who is the owner of the phone number?

So at this point in the storyline we receive a threatening call from the following number.

So who does this number belong to? Lets find out.

A number search on google returns very little other than it being a voip number serviced by google. Aren’t they all these days. So I wanted to cast my net and revisit LinkedIn and Facebook again to see if I could identify any other contacts or associates to GRPC and possibly a connection to this number.

I reviewed what I have so far which was the employee from GRPC, John Banks. Unfortunately he didn’t have any listed friends so I reviewed his posts to see if there were any connections, likes from other users, comments etc.. then I found an interesting post.

Click here for the answer

So it looks like this number belongs to the GRPC Admin Assistant.. and who is that? Back to the GRPC website and we can see Aleigha Brooks with this title that matches the comment from John Banks.

The owner of this number is the GRPC Admin Assistant, who is none other than Aleigha Brooks

 

Image Exploration

So we’ve now been provided with the following image as part of the story and told it could be of importance. Lets see what we can find.

 

[Question] 0x?

Well.. this is cryptic. A zero and an x.. To the familiar, this looks like a prefix for a hexadecimal number. Lets look at the image to see if we can make some connections because at the moment I feel like a goldfish out of water. Gulp!

Looking at the back of the photo, it definitely looks like we have some sort of username/alias and a logo or stamp of some sorts.

Googling for Hoagie215, I started with “Hoagie” for some context as it’s a new word to me. Not sure if it’s important but a Hoagie is a large, long sandwich, or a submarine sandwich. Now i’m getting hungry!

Google gave me very little, but a search of that username on Blackbird matched a number of sites. I’ll need to check each one so don’t get excited just yet!

Still no luck.. or i’m missing something. For now I’l pivot to the logo and see if we can make some connections. Sometimes it’s best to take a step back, or sideways to clear the mind. The number of times i’ve spent hours over-analysing something when the answer was under my nose the whole time. I think that’s par for the course in OSINT.

I uploaded the full image from the back of the photo, and then reduced the selection to just isolate the ship logo. Nothing interesting came back initially, so I cropped the image manually and uploaded to google image search.

Using many many additional search terms with the image, along the lines of “ocean”, “boat”, “sailor” and so on got me nothing until I eventually got lucky with “open sea”.

Connecting to the https://opensea.io website I searched for Hoagie215 and discovered an account with the same name and 3 NFT images.

The answer you are looking for can be found within Hoagie215’s profile.

Click here for the answer

Reviewing Hoagie215’s profile https://opensea.io/Hoagie215, we can see they have an Ethereum wallet which is 0x446eEB480516B7824C4D938740A5a410CA0cdB34 and that also happens to be the answer to this question.

 

[Question] Image 1

Not much context here, vague and cryptic. What we can see is Hoagie215 has three NFT images listed under his account so lets take a look at image 1 to see what we can find out.

Image 1 is named Cool Robot 1.  Maybe it is.. and maybe it isn’t. NFT’s are not my Jam so I wont argue the naming choice.. Young people today.

I uploaded this image to the photo forensics site https://29a.ch/photo-forensics and after adjusting the Error level analysis a bit (I played around with everything – don’t be confused. I have no idea what i’m doing here) I found what we’re all looking for. You should do the same.

Click here for the answer

Also playing with the luminance gradient I see the following.

Zooming in closer the answer is 15.03.2023

 

[Question] Image 2

Moving on to image number 2 which is also known as Cool Robot 2 I’ll take a similar approach and upload to https://29a.ch/photo-forensics to review the image.

This one came out quite clear from the start. I didn’t event need to tweak much, but I adjusted the settings below to make me feel better and improve my self-worth.

Click here for the answer

And there you have it, the sneaky text is LU YANG SHUN

 

[Question] Image 3

On to the third and final image. Yet another cool robot, but i’m sure R2D2 would disagree. This time I adjusted the Error Level Analysis as below.

Click here for the answer

And this is What I get.

So it looks like we have our answer, and we have some co-ordinates. 39.264969. -76.598633

Arghhh.. Well that didn’t work.. yet I was so sure. A quick google on the format of co-ordinates reminded me that it should be a comma after the 9 and not a period. So the actual answer is.. 39.264969, -76.598633

Based on the data extracted from the self proclaimed “cool” robots, all of the information points to the ocean vessel LU YANG SHUN being in the port of Baltimore on the 15.03.2023.

 

[Question] Final Pivot Chart

So I have to admit.. I spent a lot of time on this last question, as i’m sure some of you would have too. I did all sorts of OSINT on the ship and the port. Looking for clues in all the wrong places. Looking at google street view for clues. And you should 100% do this too. Don’t leave any stone unturned. Don’t let me be the only one.

You did read my write up didn’t you? When I said I often found myself  “over-analysing something when the answer was under my nose”. Well this is one of those times.

I went back through the previous questions and answers and reminded myself to look at all the information presented. Never assume anything. And once I completed all the answers again. I let out a deep sigh, smiled and clicked Continue. Where did I find the password to unlock the pivot chart? You’ll have to find this one on your own..

 

I hope you can learn something from this write up, as I will also learn from others. I also look forward to reading how others solved particular challenges. Learning from our mistakes and our successes.

I really enjoyed this challenge and I cant wait for the next.

PS – Thanks for the badge!

 

 

 

Well.. you know what that means. Time for a slice of accomplishment. Until next time.

pizza party time

Tagged as:  /  /  / 

Play Cover Track Title
Track Authors