The solution to the riddle

Preface

SPOILER ALERT: If you want to solve this riddle on your own, don’t read beyond the preface.

During the last year or so I created an on-line riddle out of boredom. I posted a QR code / string to various friends, work colleagues, and on-line forums where I expected people to be able to solve it.

This is the QR code which decodes to:

#QBdg%HGILH&R9vch)NBTAt5.X3oWb\BxMbn5,GR0wTQ*0xuHBc=

Many people have responded jokingly, posting stuff such as “a cat has walked on your keyboard”, indicating they are not taking the challenge seriously and probably thinking that there is no solution. Ignorance is bliss…

Sadly nobody has been able to solve it so far, which I find a bit strange. No way I’m that awesome that I have created the best way to obfuscate data on the Internet? Probably the right person to solve it has not yet come along, or maybe I wasn’t effective enough at spreading the riddle to enough people capable of solving it.

Anyway, here is the solution.

Step 1

By looking at the string a skilled developer should recognize the striking similarity it has with a base64-encoded string, indicated by the “=” character at the end of the string. However there seem to be a bunch of other characters that do not belong in a base64 string.

A closer look will reveal that, starting with the first character, every 6th character after that doesn’t belong in a base64 string. So there is a pattern. Let’s remove every 6th character and see that we have left:

Base 64 string: QBdgHGILHR9vchNBTAt5X3oWbBxMbn5GR0wTQ0xuHBc=
Characters that don’t belong: #%&).\,*

Now we have a valid base64 string! Let’s decode it and see what we get:

@`borALy_zlLn~FGLCLn

Yeah, it doesn’t make much sense. A skilled developer is now supposed to recognize that the base64 string decodes to binary data. Why would that be the case? Let’s go back to the extra chars that don’t make sense, why did we have those chars there? It is highly possible that the binary data is actually encrypted data and the extra chars are the key. What is the simplest cipher for binary data encryption? The XOR cipher. Alright, let’s write a small script to test this hypothesis:

<?php
$string = "QBdgHGILHR9vchNBTAt5X3oWbBxMbn5GR0wTQ0xuHBc=";
$key = "#%&).\,*";

// Base64 decode
$dec = base64_decode($string);

// XOR decode $dec with $key
for ($i = 0; $i < strlen($dec); $i++) {
  $dec{$i} = $dec{$i} ^ $key{$i % strlen($key)};
}

// Echo the result
echo $dec;

Wow it worked, we get something that makes sense:

c2F5LW15LW5hbWUuY3J5b2Rldi5jb20=

Now let’s base64 decode this and see what we get:

say-my-name.cryodev.com

Step 1 completed.

Step 2

Step 1 provided us with a hostname. Let’s open it up in a browser and see what we get:

Those Greeks have concealed my writing, keep looking…

Interesting, not much information here. But wait, “say-my-name” must be a reference to something. Name -> Domain Name System -> DNS. Alright, let’s see if there are any TXT DNS records for this subdomain:

$ host -t TXT say-my-name.cryodev.com
say-my-name.cryodev.com descriptive text "/bobby-tables"

Step 2 completed.

Step 3

Step 2 revealed a TXT DNS record. It returns "/bobby-tables". So let’s append that to the hostname previously found and visit http://say-my-name.cryodev.com/bobby-tables:

An XKCD comic appears… named exploits_of_a_mom.jpg. Is there an SQL injection vulnerability on the site? Maybe, but currently we cannot find any GET/POST variables on the site to exploit. Let’s keep looking… A skilled developer should recognize that the image ends with .jpg. XKCD comics are always .png! Oh wait, one more thing. Do you remember this quote from earlier?

Those Greeks have concealed my writing, keep looking…

A skilled developer is now supposed to think of Steganography. A quick Wikipedia search reveals:

The word steganography comes from New Latin steganographia, which combines the Greek words steganós (στεγανός), meaning “covered or concealed“, and -graphia (γραφή) meaning “writing“.

Got it now? There must be a message steganographically hidden within the .jpg image. A quick Google search reveals that the most common steganography tool in Linux is steghide. Let’s see if that can decode anything:

$ steghide --extract -sf exploits_of_a_mom.jpg 
Enter passphrase: # try without a passphrase
wrote extracted data to "message.txt".
$ cat message.txt 
?mom

Step 3 completed.

Step 4

Step 3 revealed what we desperately needed all along, a GET variable! Let’s visit http://say-my-name.cryodev.com/bobby-tables/?mom and see what we get:

Come on, I’m spoon-feeding you now!

Alright alright, let’s assign some value to ?mom e.g. http://say-my-name.cryodev.com/bobby-tables/?mom=1:

Name: Robert

Interesting, a reference to Robert “Bobby Tables” from the comic. Let’s seek for an SQL injection at ?mom, e.g. using something like http://say-my-name.cryodev.com/bobby-tables/?mom=1' OR 'x'='x:

Name: Robert
Name: https://www.youtube.com/watch?v=6Ejga4kJUts
Name: https://www.youtube.com/watch?v=jxjeqCd6Zm0
Name: https://upload.wikimedia.org/wikipedia/en/0/00/Machine_Head_album_cover.jpg

Step 4 completed.

Step 5

In step 4 we injected a GET variable and retrieved a bunch of database entries in the form of various links. The first link points to the Cranberries song “Zombie” with the unforgettable chorus “In your head, in your head“. RIP Dolores :'( The second and third links both refer to a band named “Machine Head“.

Did you get it yet? Yes we have to check the HTTP header! A quick inspection in your favorite browser’s inspection tool reveals the following entries that don’t belong there:

Step 5 completed.

Step 6

Step 5 revealed a telnet server and a telnet key. Let’s make a telnet connection and see what we get:

$ telnet bofh.cryodev.com 666
Trying 83.212.84.234...
Connected to bofh.cryodev.com.
Escape character is '^]'.
OQZaPmlBB1wKIGILaSooGFZRfkk7HnY0CgctVxFIUUcHJmUZBHw8B24rcgsbP2YIKXQnJX0oOlsiaDgWIXMPMXo1eEInIHYBUSoKBHggCXk4fwQJDHNBRjsyKkIBeHoVF1lXEX0wYh0jMGUQAnYZKlBcLk4xdwJLCwcyLGofdE00P2UfaSVPA30kelsoCmEJDHMQQBEDXFM3DGVCBHNfBH0/RAcYW1cEKmQrKlE5UQUxeBYMDGMbIHo1NUQPWmEfVDVCD20NAVsoN1sJMnMURBMiOk0CHAoIHHMgEVEvCRkgMG0WKAEncA==
Connection closed by foreign host.

Very interesting, yet another base64 string. Can we decode it directly?

9Z>iA\
 bi*(VQ~I;v4
-WHQG&e|<n+r?f)t'%}(:["h8!s1z5xB' vQ*
x 	y8	sAF;2*BxzYW}0b#0ev*P\.N1wK2,jtM4?ei%O}$z[(
a	s@\S7eBs_}?D[W*d+*Q9Q1xc z55DZaT5Bm
[(7[	2sD":M
s Q/	 0m('p

It doesn’t seem so, we get binary data again. Oh wait, we have the X-Telnet-Key from earlier! Let’s run the XOR cipher once more with the new key and the new base64 string and see what we get:

<?php
$string = "OQZaPmlBB1wKIGILaSooGFZRfkk7HnY0CgctVxFIUUcHJmUZBHw8B24rcgsbP2YIKXQnJX0oOlsiaDgWIXMPMXo1eEInIHYBUSoKBHggCXk4fwQJDHNBRjsyKkIBeHoVF1lXEX0wYh0jMGUQAnYZKlBcLk4xdwJLCwcyLGofdE00P2UfaSVPA30kelsoCmEJDHMQQBEDXFM3DGVCBHNfBH0/RAcYW1cEKmQrKlE5UQUxeBYMDGMbIHo1NUQPWmEfVDVCD20NAVsoN1sJMnMURBMiOk0CHAoIHHMgEVEvCRkgMG0WKAEncA==";
$key = "h4cK3rM4nh4x0rz";

// Base64 decode
$dec = base64_decode($string);

// XOR decode $dec with $key
for ($i = 0; $i < strlen($dec); $i++) {
  $dec{$i} = $dec{$i} ^ $key{$i % strlen($key)};
}

echo base64_decode($dec);

And the result is:

Congratulations! You solved the riddle! There is no prize, I’m too poor for that, I was just bored and made this. Let me know if you would like to brag: <my email here>

Step 6 completed.

Conclusion

That was the riddle. Do you think it was too involved? I think the first step was the hardest, once you recognize the XOR cipher and the fact that it can be reused in step 6 the riddle is not that complicated.

Anyway, I will leave the infrastructure for this riddle up and running for a few more weeks if anyone wants to verify my solution, but then I will take it down.

Thanks for reading!

PS: Don’t try to hack my server using the intentionally created SQL injection, it will not work ;)

Mollymawk tests

Yes, I am alive. I know I haven’t posted anything in three years. There are many reasons behind this, but I will leave this for another time.

As I mentioned in an earlier post, I got into this aviation thing back in 2015. Since then, I have taken it further and completed a commercial pilot’s license with multiple engine and instrument ratings, and some other stuff. What does this all mean? I can now fly the big birds for money if an operator decides to hire me. But to the big question, how do you get an operator to hire you?

It is not a simple task, you have to submit countless applications and be prepared to never hear back from anyone. They say there is a pilot shortage, hmm…? If you are lucky you might be called to an assessment. What? You don’t know what an assessment is? Don’t worry I got you covered.

In the aviation industry assessments are what jobs interviews are in any other field of work. But since pilots are rich, (we are rich right? somebody please confirm?) assessments have to be complicated money and time consuming processes. I was partially lucky and got called to an assessment for an operator called SunExpress. Spoiler alert: I didn’t get the job. I have nothing but good things to say about SunExpress. They are very professional in what they are doing and have high standards for their pilots. The reason I didn’t succeed in my assessment is purely my own fault.

It basically works like this: You get a phone call which is some kind of unofficial first interview. If they are happy with you after the phone call you get invited to do an online ITEP English proficiency test. If you pass the ITEP test you get invited to do some psychometric tests at SunExpress’ own premises. If you pass the psychometric tests you get invited to do a simulator test flying a full motion Boeing 737-800 simulator. The simulator was a lot of fun to fly but this is as far as I got. If you unlike me pass the simulator test, you get invited to a formal interview and if you pass the interview you get the job! Phew…

Boeing 737-800 Simulator
Boeing 737-800 Full Motion Simulator

So what are the psychometric tests? They are the Mollymawk psychometric tests, also used by other operators like CargoLux and Pegasus Airlines. They are split in two categories: skill tests and aptitude tests. The skill tests test your knowledge in math, science and English. Those were the easy ones for me. The aptitude tests test your memory, orientation skills and ability to multitask, divided in three computer “games” named “Working Memory”, “Spatial Orientation” and “Time Sharing”.

In order to do the Mollymawk tests you have to purchase two packages, one for the skill and one for the aptitude tests. Each package costs 150€ and if you fail one subject or game in one package you have to re-purchase the whole package to do the failed test again. The first time I did the Mollymawk tests I passed the skill tests but failed the aptitude tests, thus I had to re-purchase the aptitudes package in order to do the tests a second time. Luckily the second time I passed. You only get one second chance. In total I spent 450€, not counting travel expenses, as a part of what essentially is a job interview for a job that I didn’t get.

I felt that more practice would give me a better chance to pass the aptitude tests on the first go. The aptitude tests are essentially a form of primitive computer games. When you purchase the aptitudes package they give you 10 practice runs in each game, which you can play at home. They argue that the learning curve is logarithmic, and that after 10 practice runs you have asymptotically reached your optimum ability in playing the games, but I doubt that. As anyone knows, practice makes perfect. So I decided to code my own version of the games and help other pilots truly reach the optimum before they do the final tests.

I have created a website for Mollymawk test practice, where I have implemented my own version of the Mollymawk games. A user can register an account and purchase one of the three time limited packages for playing the games. The games may be played unlimited times!

I have also implemented an interface for the users to track their progress as they are getting better:

You may ask, why do I ask for money and not put it out for free if I truly care about the other pilots? Well, somehow I have to make back the money I lost on my earlier “job interviews”. After-all pilots are rich, right? We rich guys, right? We have no problems paying 19€ instead of 150€ for doing the tests a second time?

Anyhow, if you are a pilot and in need of my services I truly hope I helped and wish you the best of luck!

And remember, when in doubt go around! (preferably above 1000 feet GND in IMC, unlike me).

The BlackWing

BlackWing is a Swedish light sport aircraft manufacturer. They are based in Eslöv, Sweden and currently have a couple of models available for purchase, one is registered as an Ultralight and the other one as Experimental. When paperwork is ready they will also offer the BlackWing as a CS-LSA.

The development of the BlackWing has been focused on creating a very efficient aircraft, with great flying characteristics and high safety standards while still using modern cutting edge technology. And did I mention that the whole thing is made in pre-preg carbon fiber?

Visit their website for more information and watch my video review below.

http://www.blackwing.aero/

Flying airplanes and living life

So I haven’t written anything on this website for quite some time. Nothing much has happened since my last post, besides one little thing. I took my private pilot’s license (PPL), which I am very proud of. I am certified to fly small single engine piston (SEP) airplanes up to 5700 kg and land them on land, not water. This happened in the end of June 2015, so it has actually been a while. Since then I have logged a little more than 70 hours of flight time, mainly on Cessnas 172 and 152. In September 2015 I started working on my night rating (NQ) so I can also fly during the night. I still have one hour of flight left before I get this rating but the school, some school in south Sweden (ha!) that I went to, had their teaching permission revoked due to some administrative hurdles. Hopefully they will get it back some time in March and I will finish my rating.

One more thing that I have been doing is studying ATPL theory at TFHS, the aviation school of Lund University (can’t seem to be able to detach my self from this university). I’m still at the stage where I’m doing my school exams, before moving on the EASA exams. Those should be finished some time in early summer (ha-ha summer in Sweden) and then I should attempt the EASA exams. A really nice tool helping me in my ATPL studies is aviation exam. They are not paying me anything for writting about them here, I just really find them useful and I want to share my experience with other students.

So long people, be happy and enjoy life!

Oh and by the way, here is a video of the first flight of the year in snowy Sweden:

First solo and first cross-country solo flight

My 30th hour in the air is approaching. The required hours for a PPL license are 45. I really like flying, it’s something that grows on you. So far I have performed a few hours of solo flight, which means that you are alone in the cockpit flying the airplane. The cross-country solo flight is a little longer version of a longer flight where you navigate to a nearby airport. Enjoy the videos!

12th hour in the air =)

Finally the weather got better and I had time for a flight lesson. The aircraft was without a radio but it is OK since we where flying in G-class airspace. We just had to be extra cautious when looking out for airplanes. In the beginning I did a few stalls and later my instructor simulated engine failures where I should find a field for landing. Before landing we also did a touch-and-go.

Flight lessons

Last year in September I started taking lessons towards a private pilots license (PPL) for aeroplanes. There is an aviation club nearby (http://www.eslovsflygklubb.se/) that also works as a pilot academy. It is a great feeling seeing the earth from above =)

Here come some videos from my first few flight lessons. More will come, subscribe to my YouTube channel if you want to get updates immediately.


Continue reading

Dirty Filthy PCBs

I just received 10 PCBs that ordered from dirtypcbs.com a couple of weeks ago. I have to say that the quality is amazing. For $14 they are not dirty at all! The lack gold plated pads, unlike PCBs from OSHpark, but if that is none of your concerns then it’s a go! I don’t claim that OSHpark is obsolete now, but for simple prototyping when you want to be allowed to make mistakes, dirtypcbs are filthy enough to allow you to do that.

image

Mooltipass compile and flash guide for MacOSX

Mooltipass

Mooltipass is an open source offline password keeper that started off at Hackaday as an idea from Mathieu Stephan. I am one of the few lucky beta-testers and as such I would like to explain in this guide how to compile and flash its firmware from source. This guide is written for Mac OSX 10.9.

1. First of all: I DO NOT TAKE RESPONSIBILITY IF YOUR MOOLTIPASS AND/OR DVD PLAYER EXPLODES AND/OR YOUR WIFE DUMPS YOU! FOLLOW THIS GUIDE AT YOUR OWN RISK, IT REPRESENTS THE UNOFFICIAL VIEW OF THE VOICES IN MY HEAD.

2. Second, get the required tools. If you don’t already have MacPorts, download and install it from their website.

3. Once this is done, install git, binutils, gcc, avr-gcc, avr-libc and dfu-programmer from MacPorts. Just a note: I already had xcode installed on my mac, so this did it for me. If you install all of these tools and still have problems at compiling, try installing the Command Line Tools.

sudo port install git binutils gcc48 avr-gcc avr-libc dfu-programmer

4. Get the latest source code from github:

git clone https://github.com/limpkin/mooltipass.git

5. Define that you are a beta-tester ;) and compile the source code:

cd mooltipass/source_code
sed -i "" "s/XXXXXXX/BETATESTERS_SETUP/" src/defines.h
make

6. Set your mooltipass in DFU mode:

  1. Disconnect your mooltipass (if connected).
  2. Insert your smartcard upside down, with the chip-side up.
  3. Connect your mooltipass.

7. Flash your newly compiled firmware:

sudo dfu-programmer atmega32u4 erase
sudo dfu-programmer atmega32u4 flash mooltipass.hex

8. Disconnect your mooltipass, remove the smartcard, connect your mooltipass and insert the smart card.

9. Profit?