So the dead drop in Amsterdam is now over and I’m pretty sure I won’t be able to stay at a Radisson ever again. The first step was obviously to extract the secret message out of the BMP file. A couple of people actually found an existing tool on Windows that extracted it but at least one person wrote a custom ActionScript solution to get the clear text out of the image. The secret text was as follows:
—-[ GPS location (52.370067, 4.896679) - Wall to the left of room 617 - Need UV ]—-
Once arriving at the 6th floor you needed to illuminate the wall with UV light recover the next piece of information. The text on the wall read:
http://leebrimelow.com/lsb.html
key = doritos1973
You then had to go to that URL and type the key into the Flex application to decrypt the AES-encrypted message. This message was as follows:
It is under the 6th floor ice machine at the same hotel. There may be more than one ice machine. Once found follow the instructions in the note to get the serial number from me.
Now here is where it gets interesting. This morning someone who had gotten the first clue came into the hotel and asked if he could search for the software. The hotel security was having none of it and removed him from the building. Throughout the day there were other people at the hotel who had gotten the first clue but couldn’t find the UV writing. Security was apparently not very amused with this drop.
When I came back from FITC I was looking through my peephole at people walking back and forth across the 6th floor. I went out a little while ago to get something to eat and when I returned I was met outside the hotel by a man who said he had found the software. It wasn’t under the ice machine but rather at the front desk. Apparently the hotel staff or security had somehow found the software during the day. My guess is that once all these people came to the hotel saying that they were here to find something, security did a search because it was very well hidden.
The guy who found it was smart to simply go up to front desk and ask for it. So then we walked upstairs so I could show him the UV writing and while there we ran into a guy who had been here almost all day. He had written a custom ActionScript decrypter for the BMP file, went out and bought a UV light, and used the hotel computer to get the final message. I decided that I had to also give him a copy for his amazing effort.
Thanks to everyone for taking part and if you didn’t win then I hope you at least had a good time. This was by far the best drop yet and the staff finding it added some unexpected complexity.
Update: The co-winner, Bertrand Larrieu, sent along the ActionScript he wrote to retrieve the text. Much cleaner than my code which I’ll also be posting soon.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
| /**
* @author lab9 - Bertrand Larrieu
* @version 1.0
*/
package
{
import flash.display.Sprite;
import flash.events.Event;
import flash.net.*;
import flash.utils.ByteArray;
public class Drop extends Sprite
{
private var loader :URLLoader
private var bytes :ByteArray
private var translate :ByteArray
public function Drop()
{
loader = new URLLoader();
loader.dataFormat = URLLoaderDataFormat.BINARY;
loader.addEventListener(Event.COMPLETE, complete)
loader.load (new URLRequest("stego.bmp"))
}
private function complete(e:Event):void
{
trae ("youpi");
bytes = loader.data as ByteArray;
translate = new ByteArray();
bytes.position = 54;
var dec:int = 7;
var b:int = 0;
var lsb:int;
for (var i:int = 0; i < 857280; i++)
{
lsb = bytes.readByte() & 1;
b = b | ( lsb << dec);
if (dec == 0)
{
translate.writeByte(b);
dec = 8;
b = 0;
}
dec --;
}
trace (translate.length);
translate.position = 0;
trace (translate.readMultiByte(translate.length, "iso-8859-1"));
}
}
} |
London you’re next 
Lee
