Write-up of the challenge “Steganalysis – Stegano Sound” of Nuit du Hack 2016 CTF qualifications.
The weekend of 04/01/2016 is pre-qualification for the Nuit du Hack 2016 as a Jeopardy CTF. Having had the opportunity and the time to participate with some colleagues and friends, here’s a write-up resolution of the challenges which we could participate.
- Category: Steganalysis
- Name: Stegano-Sound
- Description : Homer Simpson is being looked after by the cops, following a bank robbery. We intercepted a conversation between him and Marge Simpson, but the quality is very bad. We believe they exchanged about a secret related to some “ndh” event.
- URL : http://static.quals.nuitduhack.com/simpsons.wav
- Points : 150
Listening to the wav file, the voices of the Simpsons are audible and understandable. There is noise, however, in the background, which seem to be repeated periodically.
We can choose our best tool for audio file analysis, particularly for spectral data visualization. In this context, the free tool “Sonic Visualiser” (currently version 2.5) allows these spectrals analysis better than Audacity, especially for audio steganography.
We open “Sonic Visualiser” and we load our file “simpsons.wav”. It appears thereafter spectrum via “Pane / Add Spectrogram / Mixed”
Spectral visualisation
Oh ! A cute smiley!
But what follows our smiley? These small bars that seem to repeat almost all along the trail, would that cause noise that periodically is meant to listen to the sound clip?
Zoom a bit on the spectrum:
Zoom spectral
This looks suspiciously like an alphabet … Yes, but which? In what language these symbols in the form of “points” must be translated?
Could this be the braille? It would be this, especially as the smiley wear glasses which is a strong indication! Seek a correspondence table of the alphabet in Braille:
Alphabet Braille
Promising! Let’s start translating our spectral track:
Traduction braille
String translated :
#6634428777744499577744499568833
Given this number string prefixed with # (indicating a number), the link is quickly made with the era before the smartphone including SMS. Yes, this code corresponds to an SMS. It’s time to get out our good old Nokia 3210:
Win ! Flag : #NDHATSIXJRIXJMUE
Greeting to nj8, St0rn, Emiya, Mido, downg(r)ade, Ryuk@n and rikelm, ? // Gr3etZ
Sources & ressources :
