Packet Guru

This year I entered the MWR Challenge 2013 and won a place at Hackfu! Unfortunately, I was unable to attend due to a scheduling conflict, but I did still get a free T-shirt. I had a blast completing the challenge, and thought I'd share my solution. There is a great narrative that accompanies these challenges, but I'll not mention that here so as to not give away any spoilers! Challenge 1 You're given a zip file that contains an image file and a text file explaining how the image file can be mounted. The mounted image file contains a TrueCrypt volume and a text file stating that the password to this volume is very secure - unlike the password for the previous (now deleted) TrueCrypt volume, which was "password1". Using Autopsy, a GUI for TSK (The Sleuth Kit), it was possible to recover deleted files on the image. A file called old-zip was recovered. This zip file contained a TrueCrypt volume called truecrypt-volume-old. This volume can then be mounted...

Another BSides London 2013 challenge! I didn't enter as I had already managed to get my hands on a ticket at the time this one was released. I did, with the help of some colleagues, complete the challenge to fill some spare time I had at the weekend. There was no back story associated with this challenge. You were simply provided with a PDF document , and told to follow the clues until you came across a secret code, a subject line and an email address to which these could be sent . I should also add that although this post shows the most direct route to the final answer, we did find ourselves following a few red herrings and banging our heads against a few proverbial brick walls. Stage 1: The text of the PDF document give clues as to how to complete this stage. Within the seemingly random text is this string: guvfgrkgvfwhfgnqvfgenpgvbasebzgurernypunyyratr When decoded using ROT13 this becomes: th istextisjustadistractionfromtherealchallenge There is also thi...

Determined to win a ticket to Security BSides London 2013 and undeterred by my previous failure , I completed the third challenge posted by MWR Labs. I wasn't successful, but I learnt a little about hacking Android apps and decided to share my answer so that others might learn something too. The premise of this challenge is that you are hired by BigCorp to assist in acquiring evidence to prove that an employee is guilty of attacking their IT systems. They have discovered that the employee is using an Android app called Evil Planner, and they want you to find any vulnerabilities that might allow them to access and decrypt any incriminating information stored within the app. Ultimately, the IT wizards at BigCorp will use any vulnerabilities to compromise the employee's device to install a piece of custom malware to extract and decrypt data stored within the Evil Planner app. Below is my submission: The .apk file containing the app was downloaded from the MWR website  and...

Earlier this year I completed a challenge to win tickets to Security BSides London 2013. The challenge can be found here . Unfortunately, I wasn't one of the first three to submit a correct answer, I didn't write the best submission and I wasn't even lucky enough to win the prize draw. I had a great time figuring this out anyway, and figured I'd post my solution online. The premise is simple. Fat Dex owns a diner and he believes that the owner of a rival eatery, Iggy, has stolen his secret recipe for cheese on toast. He has acquired a USB stick from one of her employees, Jamie, that contains an encrypted file that he believes will prove Iggy's guilt. Dex has employed Packet Tracy, a private investigator, to decrypt the file and discover who stole the recipe. It's a classic whodunit with a computer forensics twist!  Below is my submission: My name is Oleg McNolegs. I work as a sleuthhound - a private investigator specialising  in computer forensics. I was ...