Cyber Investigator CTF - Financial Crime & Signals Intelligence Writeup

This is the second part of my Cyber Investigator CTF writeup, covering the Financial Crime and Signals Intelligence challenges. Cardiff University's Cyber Security Society organized this jeopardy-style CTF for OSINT (Open-Source Intelligence), threat intelligence, and digital forensics enthusiasts.

Financial crime

wallstreetbets

The target is the institutional investor that held the most Gamestop (GME) stock before December 31, 2020. Fintel (opens in a new tab) compiles the public Form 13F filings that institutional firms submit to the SEC each quarter. Searching for "Gamestop", opening "Owners", selecting "Institutional Owners", and setting the effective date to "December 31, 2020" produces the relevant list. The first entry is the flag.

therichestdoge

The challenge asks for the wallet that held the most Dogecoin when it was created. BitInfoCharts (opens in a new tab) lists the 100 richest wallets for several cryptocurrencies, including Dogecoin. The current top wallet is no longer the correct answer because the challenge was created a year earlier. An archived copy of the page in the Wayback Machine shows the data from that time and gives us the right wallet.

herdimmunity

The question asks for the percentage difference between the Pfizer/BioNTech vaccine price on the invoice and the price paid by the European Union. The invoice price appears in the "PER ITEM" column. To find the EU price, we search news articles from late 2020 to early 2021, when the question was likely created.

We divide the invoice price by the EU price, subtract 1, and convert the result to a percentage. That value is the flag.

Signals intelligence

foreigntransmission

The audio file contains a message spoken in Chinese. If you don't understand Chinese, free tools such as veed.io (opens in a new tab) or convertspeech (opens in a new tab) can produce a transcript. These services can make mistakes, so check the result before submitting it.

personalbanker

The audio file records someone pressing numbers on a phone. The tones use Dual-Tone Multi-Frequency (DTMF), so an online DTMF decoder can recover the digits. Searching for "online DTMF decoder" gives several options, and uploading the audio to one of them produces the flag.

faultycassette

The audio file has an unusual sound, which suggests it may be reversed. After reversing the clip with an online audio converter, we can hear a man's voice. Searching for the transcribed words identifies the speaker.

armageddon

The spectrogram image contains speech that we need to recover. Several online converters failed, so we tried Photosounder.

After installing Photosounder and loading the spectrogram, we played the image as audio. The recording contains spoken coordinates. Entering them into Google Maps gives the location used as the flag.

That completes the Financial Crime and Signals Intelligence sections.