Welcome to the third part of Cyber Investigator CTF Writeup. Cyber Investigator CTF is a jeopardy style CTF organized by Cyber Security Society of Cardiff University. This CTF is tailored towards enthusiast in OSINT (Open-Source Intelligence), Threat Intelligence, digital forensics, and more. In this writeup, I'll be explaining the Covert Operations section challenges.

thermalentry

We are given a thermal image of a PIN pad and the task is to find the correct PIN code. We can use heat transfer theory to solve the question. When someone presses the buttons, heat from their fingers transfers to the buttons, making them warmer and over time, the buttons cool down. By looking at the thermal image and comparing how warm each button is, we can figure out the order in which the buttons were pressed. The coolest button was pressed first, and the warmest one was pressed last. This sequence gives us the correct PIN code, which is the answer to the challenge.

nightclub

We are given an audio file and need to find the title of the song. To do this, we can use a music identification app like Shazam. By playing the audio file while Shazam is listening, the app can match the sound to its large music database and tell us the name of the song. Once the song is identified, its title is the answer to the challenge.

orientalnavigator

We are given an image of a road sign in Chinese and need to figure out the driver's location. To do this, we look at the Chinese characters in the bottom right corner of the sign. Searching them on Google, we find a Wikipedia page about a major road in China that passes through a specific town. The name of this town is the answer to the challenge.

telemanipulation

We are given an image showing a SKY remote and a TOSHIBA TV. The task is to find the remote code that lets the SKY remote control the TOSHIBA TV. By searching Google for "toshiba sky remote code," we find a website with a list of codes. The first code on that list is the correct answer to the challenge.

armsdealer

We are given an image of a gun and asked to find its length and height in millimeters. To do this, we look at the markings on the side of the gun and use them to search on Google with the keywords "19 austria gun." This leads us to a website that matches the gun in the image. The site includes detailed information, including the gun’s length and height in millimeters. These measurements are the answer to the challenge.

disembark

We are given a video and asked to figure out which country it was recorded in. The challenge is harder because the car license plates are blurry and can’t be used. However, in the background of the video, we spot a large and unique building. This gives us an idea to reverse the image. After reversing it, Google successfully identified the building.

Searching the building's name on Google gives us the answer.

aviator

We are given a video of a plane taking off and asked to find the latest possible date it could have been recorded. To narrow it down, we focus on two planes in the video: one from American Airlines and the other from LASER Airlines. Searching for LASER Airlines in Venezuela doesn’t help much, so we try a different search: "American Airlines Venezuela." This leads us to an article that says American Airlines stopped flying to Venezuela. The date they ended service is the latest possible date the video could have been taken.

And there we have it. Thank you for taking the time to read through this.