Skip to main content
13 of 17
....f*ck. Sorry about that guys, you should now be able to get to the correct version
2012rcampion
  • 18.9k
  • 3
  • 66
  • 98

SIGINT Challenge #1 - Image Steganography

Update

It looks like I made a mistake and uploaded the wrong version of the puzzle. Only green.gpg.asc has changed, although the encrypted contents (green.tar.bz2) remain the same.

Problem

Alice, Bob, Carol, and Dan are playing a card game. After they all show their cards, Bob notes that by exchanging two cards the order of the players would be reversed; that is, the player with the best hand would have the worst hand, and vice versa. Which pair of cards is he thinking of?


Since this puzzle is far too easy on its own, I've hidden the four players' cards in this image. I will only give you one hint, so listen up:

In order to complete this challenge, you must verify every step.

img.png http://googledrive.com/host/0B0VNJlWZGkwNfmlvUjNOQUxoZmVuTWFfeFRnUk5wRVhuRVJWcTA0YjVGaDIwdzhnSUYyNWs/img.png

Download as png (1441k) | tiff (1444k) | bmp (1479k) | ppm (1477k)


Partial Solutions

This puzzle has many layers. To make it easier for newcomers to jump in, here are some of the layers which have been discovered already.

Hieroglyphics (Partially Solved)

Here is an enlargement of the hieroglyphics at the bottom of the image. They have been mostly deciphered, but not completely.

enter image description here

Good luck!

Color Channels (Solved)

LeppyR64 discovered that the bytes of each channel of the image encode a file:

Red Channel (Solved)

The audio file in the red channel contains morse code, which reads as follows:

VVV CLG PUZ CLG PUZ DE RBC = GA VY FB SFR = IF U CNT MAKE KEY SIGN TI83 PUB KEY ES POST SIG, I WL POST KEY = USE PKCS1 N PADDING = 73 ES GL PUZ DE RBC <BK>

I made heavy use of morse-code-specific abbreviations in order to shorten the message, making it a bit challenging to read. Here it is in plain English:

(VVV) [attention] Calling PUZ, calling PUZ, this is RBC. Good afternoon, very fine business [good job] so far. If you can't make the key, then sign the TI83 public key1 and post the signature, I will post the key. Use PKCS#12, but no padding. Best regards and good luck; PUZ, this is RBC, over.

1: The public modulus $n$, see here. Chosen as a large number connected to public-key cryptography and easy to find on the internet.

2: PKCS#1 specifies that $d$ should be computed $\mod \text{LCM}(p-1,\,q-1)$, not $\mod (p-1)(q-1)$, and GPG generates keys that follow this recommendation. To make it easy on you, I won't require you to implement the padding scheme that PCKS#1 defines: you can just sign the raw number.

It also contains a voice reading the words "Echo, Papa, Quebec" (EPQ in the NATO phonetic alphabet), surrounded by Quindar tones (because I'm a huge geek).

The last part is a long series of DTMF tones, encoding the following sequence:

65537#10279922920444758952198236835097069960343622366001203286574422344156143529924117113239897731294792673018741448270384194591460111562322538604975737399705241*11337130627295915340299728600099026395063941250029823456400750546429518737269225761911696211987509755865509636756944318366919520522935654742514845464086299

They are (in decimal) the public exponent $e$ and primes $p$ and $q$ of an RSA secret key.

Green Channel (Partially Solved)

However, it turns out that you don't need follow the instructions now, since jarnbjo successfully decrypted the green channel's PGP stream using the private key values listed above. Here's the private key I used when test-decrypting the stream:

-----BEGIN PGP PRIVATE KEY BLOCK-----

lQHaA1VfT04AAAEEAKX3IOHDBljU7bCSqBGXQBt6fyxiJO9kEbjfJGzMSSbu7Uq7dW3NKUtotZ54
JOa/RpF8E1StBQ8N4L7rYbdTfYNL8hMV4eSxXD6EcV4ezKBv3fiKfROarCLEeWhbg5tG+EZM52bb
6P5OZaTGtucr+sj2st2Qq0Ttnw/1l/ReCMkjABEBAAEAA/0QocRve3jeXBr5z/38d/jaXXCd2l6z
MtxnzMznWPhCaOfqI6vFS4MbkIHAQMVfQ8SRqH/TbjIMln/IV5Rc/TFIVsN/+6thU8ddbuQL6jeE
h+HMKiYmAtnXNfDfb3QVZikh4sYkrOBRws0zE9UVsAtobIppT1gE+INlfpSr6fmFsQIAxEc3b88q
TU8DhAyD9osjIC8IH4VhofApVwPfJYqWuP1syMswdVjWDL1pKkXtJBQ3A0nii63w8YBBn8HfLNh+
mQIA2Ha9fEljuMBvFI2lBNH3x7myCnGaDTeI6sx+/6esucwgDvOhiin7XHM9ReBBBO8+f8d/PshH
UmsMXVBQai9HGwH7BEv1GeXZ6yL4eKC4jBvcdqRM/tuiSZodqIZBSQ8BaQG7X6m1IEL5pH8EXhr7
LWcruhlYtSIMBREid82G/p0SPZ+StQA4U3RhY2sgRXhjaGFuZ2UgVXNlcnMgKGh0dHA6Ly9wdXp6
bGluZy5zdGFja2V4Y2hhbmdlLmNvbSk=
-----END PGP PRIVATE KEY BLOCK-----

This key will decrypt the green channel to a...

.tar.bz2 File (Solved)

Decryption of the PGP stream results in a compressed directory (green.tar.bz2 (480k)) containing three images of cats: allie.jpeg, bitsy.tiff, and porsche.png. Each image also contains one quadrant of an image of playing cards:

  • allie.jpeg (80k) contains the lower-left-hand quadrant as an EXIF thumbnail.
  • bitsy.tiff (138k) contains the upper-left-hand quadrant in a sub-IFD flagged as a low-resolution copy of the parent IFD (interpreted by Windows Explorer as a thumbnail).
  • porsche.png (134k) contains the upper-right-hand quadrant as a .png image simply appended to the main image. Most programs and libraries simply ignore the extra data when displaying the main image.

Hint 2

Note that the .tar.bz2 file containing the pictures is signed as well as encrypted. You'll need to locate my public key to verify the signature.

Blue Channel (Solved)

This audio file contains a voice reading the sentence, "if you haven't found any clues yet, here's what you should be looking for."

This is followed by (as discovered by Leppy64) an SSTV image of the playing cards. Note that due to an apparently insufficient amount of added noise, the cards in the lower-right-hand quadrant of the image can be read, enabling the puzzle to be solved although the hidden version of the quadrant has not yet been discovered.


Note that, unless you're a Real ProgrammerTM, you will need to use some software to complete this challenge. I will only say that you should never have to search for a particular piece of proprietary software: I've only used formats that are open source or whose specs are freely available.

2012rcampion
  • 18.9k
  • 3
  • 66
  • 98