22
$\begingroup$

John and Jane are married and keep a joint account at ABC Bank. They agreed that all of their income should go into the joint account. In early 2014, John started a new job at a software company, and after the first, second, and third quarters he received a cash bonus. In early December though, he told Jane that his company wasn't giving out a bonus for the fourth quarter. Jane found that hard to believe, and she thought that John might try to divert a bonus into another bank account. But she hid her suspicions from John.

Jane didn't know much about computers, so she talked to her tech-savvy friend Alex about how she might find out if John had another bank account. He gave her a DVD and told her to put it into their home computer and run the setup.exe file. He said it would install a keylogger that would email him daily logs that he could inspect. Jane inserted the DVD into their home computer while John was at work. A popup appeared asking her what to do, and she selected the "Run setup.exe" option. That installed the keylogger and it began recording all keystrokes on the computer.

Jane was right to be suspicious. In mid-December, John's company gave everyone a larger than usual cash bonus for the holidays. John wanted to spend that money on himself, although not immediately, so he decided to open an account at another bank to hold the money for the time being. One day while he was at home, he went to www.xyzbank.com and opened up an account there. Little did he know that everything he typed was being recorded.

The next day, Alex checked the keylogger logs and saw the following from the previous day:

www.xyzbank.com[Enter]JohnDoe11144999950 First StreetNew York100012125550104johndoe9876@emaildomain.comjohn9876BROKEBROKE

The logs also showed the following a few minutes after that:

secretpasswords.txt[Enter]AASDRESS[Backspace][Backspace][Backspace][Backspace][Backspace][Backspace][Backspace][Backspace][Backspace][Backspace][Backspace]ADDRESS                      USERNAEM[Backspace][Backspace]ME             PASSWORD[Enter]----------------------------------------------------------[Enter]www.s[Backspace]xyzbank.com              john9876             BROKE

He called Jane and told her that it looked like John opened an account at XYZ Bank, since he went to their web site and typed in his name, social security number, address, phone number, and email address, along with the username john9876 and password BROKE. He also said it looked like he created a text file named secretpasswords.txt and put his username and password for XYZ Bank in there. Jane wasn't surprised by the password BROKE, since John always used dictionary words for his passwords, and he always used all capital letters. She also wasn't surprised that he kept the password in a text file, as his memory wasn't very good. John kept a passwords.txt file on the computer's desktop that contained all of his usernames and passwords, including the username and password for their joint account at ABC Bank. Jane checked their home computer and didn't see a secretpasswords.txt file on the desktop, so John must have hidden it somewhere in the file system. She tried logging in to www.xyzbank.com with username john9876 and password BROKE and it worked. The account was empty and showed no activity, however, so John must not have deposited his bonus into the account yet. Jane decided she would check the account periodically and not immediately reveal to John that she knew about the secret account.

On Dec. 31, while John was at work, Jane logged into the secret account and there was still no balance or activity. Later that day, John finally got around to depositing his bonus into the account. Then on Jan. 2, right after John left for work, Jane logged into the secret account and it said it was requiring all customers to change their passwords before they could proceed into their accounts. She closed the browser without doing anything. After he got to work, John logged into www.xyzbank.com and saw the same message about changing his password, so he changed it. He used a dictionary word with all capital letters for his new password, as he always does. Later that day, Jane tried logging into the secret account and got an "Invalid password" message, so she knew that John had changed the password at work. She was pretty sure that John would update the secretpasswords.txt file with the new password when he got home. Sure enough, when John got home, he updated the password for www.xyzbank.com in the secretpasswords.txt file. The keylogger recorded the update.

The next day, Jane called Alex and asked him to check the keylogger logs to see what was typed in the previous evening. Alex said only one thing was typed in the entire evening - the word GARAGE. Jane was certain that GARAGE was John's new password for XYZ Bank, since it was a dictionary word with all capital letters. She went to www.xyzbank.com and tried logging in with username john9876 and password GARAGE and got an "Invalid password" message. She tried again while typing everything in slowly to make sure she didn't mistype anything, and she still got an "Invalid password" message. She checked the passwords.txt file on the desktop and didn't see an entry for www.xyzbank.com, and she didn't know how to find the secretpasswords.txt file. Alex said he would have to help her find that file at another time, so in the meantime Jane was stumped.

What was John's new password for XYZ Bank?

$\endgroup$
  • 12
    $\begingroup$ So Jane set it up for all her husband's keylog records to go to Alex? Presume that John logged into their regular bank, too, Alex can go get himself some money... $\endgroup$ – Engineer Toast Apr 1 '15 at 16:46
  • 1
    $\begingroup$ Why was the Alex character necessary in the story? Couldn't Jane have just been smart enough to install a keylogger herself? $\endgroup$ – Cody Apr 2 '15 at 21:20
  • 5
    $\begingroup$ Sexism! Yay! /sarcasm $\endgroup$ – Ian MacDonald Apr 3 '15 at 11:09
  • 2
    $\begingroup$ @pacoverflow: could rename Alex to Alexandra and the puzzle stays the same, but doesn't perpetuate a stereotype of women being unable to use technology. :) $\endgroup$ – Ian MacDonald Apr 3 '15 at 19:30
  • 2
    $\begingroup$ @IanMacDonald You're right, I actually thought of that today, but then didn't feel like having to change all the Alex-specific "he"/"him" to "she"/"her". $\endgroup$ – pacoverflow Apr 3 '15 at 19:32
36
$\begingroup$

John's new password is:

BROKERAGE

The word keeps in the "money" theme. It is for a bank account (money-themed) and his previous password was BROKE (money-themed).

John's actions were as follows:

Open secretpasswords.txt in vim.
G to go to the last line.
A to begin editing at the end of the current line.
Type RAGE.

Alternate solution:

Click to open secretpasswords.txt.
Use the mouse to position the cursor at the end of BROKE.
Type GA.
Realise the typo and select GA for replacement.
Type RAGE.

Alternate alternate solution:

Type GA into local file search.
Click to open GARBAGE hidden folder that was found.
Click to open secretpasswords.txt.
Use the mouse to position the cursor at the end of BROKE.
Type RAGE.

$\endgroup$
  • 1
    $\begingroup$ I get it now.... When you say select for replacement you are referring to highlighting.... I was picturing selecting from an auto-correct type dictionary... $\endgroup$ – Warlord 099 Apr 1 '15 at 16:31
  • 2
    $\begingroup$ My one nitpick for this answer: If he backspaced out "AASDRESS" completely to retype "ADDRESS", then I feel like he wouldn't highlight two letters to make a change. It's possible, it just seems to go against what little I know of him... $\endgroup$ – Warlord 099 Apr 1 '15 at 16:53
  • 8
    $\begingroup$ Yes, John works at a software company so he's a software developer. His favorite editor is Vim. Also, note that when he mistyped ADDRESS, there were 2 As. The first A was not a typo, but to get into insert mode. Good job. :) $\endgroup$ – pacoverflow Apr 1 '15 at 17:27
  • 4
    $\begingroup$ @CQM: I've definitely installed vim on Windows machines that I have used in the past. I use it instead of a basic editor like Notepad or whatever. $\endgroup$ – Ian MacDonald Apr 1 '15 at 18:50
  • 2
    $\begingroup$ @CQM, If he's using mobile banking, touch ID, a password manager, and 2factor authentication, he's not going to have a file called secretpasswords.txt on his computer. Using vim on any computer is not a stretch for me. In real life. I am a software engineer. Next question. $\endgroup$ – Ian MacDonald Apr 1 '15 at 19:20
13
$\begingroup$

Ian has one of my solutions; the other one is

GARBAGE

because

John typed the first three letters in front of "BROKE", then selected the last four letters and overwrote with "AGE"

and also note that

this is consistent with the general "negative tone" of BROKE.

$\endgroup$
  • $\begingroup$ Yep, this answer is also good. $\endgroup$ – Ian MacDonald Apr 1 '15 at 16:14
2
$\begingroup$

Alternative solutions are:

  • He used the Onscreen Keyboard, so any word is valid. Note that the onscreen keyboard also has the delete button, so he wrote GARAGE then deleted it. Why did he do this? Maybe he was suspecting of her wife too...
  • RAGE. He typed GARAGE, then selected GA with the mouse, right click and delete.
  • He changed the password using another PC, GARAGE was just the password of his pornhub account...

Ok, this post isn't supposed to be the true answer to this nice problem, indeed others already found a brilliant solution. I just tried to lateral-think and let you have some fun :)

$\endgroup$
  • 3
    $\begingroup$ Most keyloggers will also log any keys entered via a virtual keyboard. $\endgroup$ – Ian MacDonald Apr 1 '15 at 17:20
  • $\begingroup$ He changed the password using another PC The description says he also updated secretpasswords.txt, so that must not be the case. $\endgroup$ – EKons Nov 6 '16 at 13:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.