Cyber Investigator CTF - Covert Operations Writeup

This is the third part of my Cyber Investigator CTF writeup, covering the Covert Operations challenges. Cardiff University's Cyber Security Society organized this jeopardy-style CTF for OSINT (Open-Source Intelligence), threat intelligence, and digital forensics enthusiasts.

thermalentry

The thermal image of a PIN pad contains enough information to recover the code. Each press transfers heat from a finger to a button, which then cools over time. Comparing the temperatures reveals the order: the coolest button was pressed first and the warmest last.

nightclub

The audio file contains a song we need to identify. Playing it for Shazam returns the title, which is the answer.

orientalnavigator

The Chinese characters in the bottom-right corner of the road sign reveal the driver's location. Searching those characters leads to a Wikipedia page about a major road in China and the town it passes through. That town is the answer.

telemanipulation

The image shows a SKY remote and a TOSHIBA TV. Searching Google for "toshiba sky remote code" leads to a website (opens in a new tab) with a list of compatible codes. The first code is the answer.

armsdealer

We need the gun's length and height in millimeters. Its side markings suggest the Google search "19 austria gun," which leads to a matching model on the Glock website (opens in a new tab). The listed dimensions provide the answer.

disembark

The video has blurry license plates, so I couldn't use them to identify the country. A large building in the background gave me another lead. A reverse image search identified it.

Searching the building's name gives the country.

aviator

The video shows two planes, one from American Airlines and another from LASER Airlines. I need the latest date on which they could have appeared together. Searching for LASER Airlines in Venezuela didn't help, but "American Airlines Venezuela" led to an article stating when American Airlines stopped flying there. Its final service date is the latest possible recording date.

That completes the Covert Operations section.