For those who are not aware, I'm a member of the Searchlight team (Twitter/Discord). And if you were again unaware, Searchlight published a TryHackMe room for IMINT in late 2020. I recently completed taking all my notes, screenshots, etc. for this room. That means it is time for a clean, well-polished write-up!
It should be noted that many things involving intelligence of any kind can have a large number of potential solutions, so please do not interpret this guide as a definitive manual for solving these challenges. There are many ways to get your answers, and they are no less valid that the methods I used.
Task #1
This is quite literally just checking to make sure you understand the flag format. Not much to say here.
Task #2
This task should also be fairly obvious. The name of the street is right on the sign itself.
Task #3
For this task, we are given the below image and set of questions:
Which city is the tube station located in?
Which tube station do these stairs lead to?
Which year did this station open?
How many platforms are there in this station?
Firstly, let's determine the country in which this "tube station" is located. If the name "tube" or the logo for the Underground aren't immediately recognizable to you, searching Google for "public subway underground" and looking through the results should very quickly lead you to the fact that it is, in fact, in London.
That's an easy answer for our first question. Sometimes just googling words you see in the photo can pay dividends if you take the time to comb through query results.
Now, we need to find which station we're looking at. Once again, I turn to the text in the image itself, this time adding in the context I've discovered thus far. I can clearly see a "CIRCUS STA" on the blue sign above the stairs. Since we're talking about stations, I expand that out to "circus station" and add in "london", since we've determined that's where we're currently located.
We see "Picadilly Circus Station" as a top result, and it does look like the same blue sign has an "LLY" on it, so we'll pivot to that location in Google Maps and drop into Street View to check out findings.
Comparing the original image (left) and an approximate Street View (right), we can pick out a few distinguishing characteristics to determine that, in fact, Picadilly Circus is the name of the station to which these stairs lead.
Next, we need to determine what year this station opened and how many platforms it has. I grouped these questions together because if we find one answer, we may very likely be able to find the other at the same time.
Adjusting our Google query to "Picadilly Circus station", we immediately see a useful card (as well as a link) to Wikipedia for the station. If we check out the Wikipedia entry, we'll notice answers to both our questions in short order.
Task #4
On to the fourth task. Here is our picture and the associated questions:
Which building is this photo taken in?
Which country is this building located in?
Which city is this building located in?
Once again, I start by parsing any written text in the image. We've got a few things we could look at and research, but the thing that stands out to me right away is a domain name in the bottom-right of the "YVR Connects" sign, "yvr.ca".
Well, this effectively answers two of our questions. It's Vancouver International Airport. However, in the event that you didn't know that Vancouver is the name of a place in Canada, you can google "Vancouver International Airport", and you'll find out that not only is it in Canada, the city in which it resides is Richmond.
By the way, I knew this was a Canadian airport immediately upon opening the image thanks to the song "YYZ" by Rush, a Canadian band. The song title is a reference to Toronto Pearson International Airport.
Task #5
For the fifth task, we're given two pictures:
Which city is this coffee shop located in?
Which street is this coffee shop located in?
What is their phone number?
What is their email address?
What is the surname of the owners?
And we're off again to look for clues inside of the images themselves. Nothing in particular leaps out at me as a starting point in the second picture with all of the food, but in the first picture, I do see what looks like the name of a business across the street. From what I can make it, it says "The Edinburgh Woollen M". I head off to Google with this potential partial phrase, knowing from the task description that we are looking for some place in Scotland. Thankfully, Google autocompletes the query for us.
The Edinburgh Woollen Mill is a chain establishment with a large number of locations throughout Scotland and beyond. In fact, you can search their locations via their website.
Conceivably, one could check every single location on this map and eventually find the answer, but that seems very time consuming. Instead, I turn to Google Maps.
When in Google Maps, your queries automatically adjust based on your zoom level. To that end, I focused my window on Scotland only and entered my search term, "The Edinburgh Woollen Mill".
That's a much smaller list than the locations listed on the website. However, we can help speed our search along even further if we examine some specific characteristics of the store in the original picture.
The sign and the street appear to be curved. This leads me to believe we can narrow down our search by zooming in to each location on the map just far enough to see the layout of the street. If it isn't curved and doesn't have a building approximately opposite of it, it's not our store.
With those parameters in mind, we get busy checking each store one-by-one.
In less than five minutes, we come to a store on a street with a layout that looks strikingly similar to our source image. As always, let's drop into Street View and compare against our source image.
Yeah, there is no way that this isn't our shop. Perfect. Now we can answer some questions.
There it is. According to the Google entry for this particular location, it is in Blairgowrie. To answer the next question, we'll need to look across the street and determine the exact location and name of the coffee shop.
The Wee Coffee Shop is on Allan St. That's two questions down and three more to go.
Now that we have some more details, we can return to Google. After a quick Google search of the business name and city, I landed on their Facebook page, and this gave me the answer to the third question regarding their phone number.
For the email address, I returned once again to Google, relying as usual on operators to ensure I get the most relevant results.
NOTE: Surrounding a word or phrase in double-quotes in Google tells Google to only return results that contain that word/phrase.
The second-listed result gives us the answer to not only the question regarding the businesses email address (hover over the "Email Business" button to see their email address), but also gives us the surname of the business owners.
Task #6
Task number six is much breezier than its predecessor. In this task, we are given a single image and two questions, and the task revolves around reverse image searches.
Which restaurant was this picture taken at?
What is the name of the Bon Appétit editor that worked 24 hours at this restaurant?
Well, since it is a reverse image task, let's just go to Google Images and upload our image.
Easy victory on the first question. This is Katz's Deli in New York. Now that we have that answered, we can look into the Bon Appétit editor question. We turn once again to Google. First, I decided to look for the website of Bon Appétit. Once I found that, I used the site: search operator in Google to ensure that the results I received were only from bonappetit.com. Beyond that, I included the full name of Katz's Deli in the search with double-quotes.
And with a single, well-crafted Google query, we have our answer.
Oh, and as a New Yorker, do you have any idea how many films/television shows have been shot in Katz's Deli? "When Harry Met Sally..." may be the one many people think of first, but there's actually a whole list.
Task #7
We've arrived at the seventh task. This time, we have a single image and only two questions (well, sort of.)
What is the name of this statue?
Who took this image?
Since I have a photo, the first thing I am going to try is dropping it into various reverse image search tools (Google, Yandex, TinEye, etc.) There are pros and cons to each (Yandex has a built-in cropping tool and is better at identifying architecture, but primarily returns non-English results, for example), so trying them all is generally a good idea. In this particular case, I had the most luck with Yandex. I also had to resize the original file for it to upload properly, which I've never had to do, so just be aware of that.
Remember when I said that we "sort of" have two questions to answer? Well, in order to actually answer those two questions, we may have to answer a couple more questions along the way. That may not necessarily be true for you, but in my case it was.
Thanks to Yandex, I now know that this statue is in Tjuvholmen Sculpture Park in Oslo, Norway. That will be helpful later on. For now, we keep looking through the results.
Okay, "motor deer sculpture" isn't our answer (believe me, I tried), but perhaps it will get us closer, especially if we tack the word "oslo" onto our Google query.
"Rudolph", eh? Let's click through this Alamy image.
And there we have our first answer, "Rudolph the Chrome Nosed Reindeer". On to the next question: who took the original picutre?
I got very, very stuck here. I tried so many variations of reverse image searches, pivots, cropping, Google search queries, etc. I ended up using the hint, but I reverse engineered how I should have gotten the answer without it, and I am very mad this wasn't my first action.
...I just ended up googling "Rudolph the Chrome Nosed Reindeer oslo".
If we check the results one at a time, the second result for Visit Oslo will yield us an interactive map of all the outdoor sculptures in the area. There aren't too many, so if we check them one-by-one, we'll eventually find our original photo, along with the photographer.
Task #8
Task #8 is the pentultimate challenge for this room. For this room we're given a single picture:
Wait, no! Not that picture!
Much better. Now, for the questions.
What is the name of the character that the statue depicts?
Where is this statue located?
What is the name of the building opposite from this statue?
In the event the James Hetfield meme I included above didn't give it away, the name of this task ("...and Justice For All") is a reference to Metallica's 1988 album of the same name. To that end, I knew the answer to the first question right away, but just in case you didn't grow up listening to thrash metal and skateboarding, let me show you a different way to get the answer. But first, what happens if we try to reverse this image on, say, Google?
Yeah, we're not going to get any useful results with an image that has been seen so many times on the Internet. Trust me, I looked through the results for a while.
So, what should we do instead? Well, how about we just try to describe the statue we see in the image? We may get lucky.
Sometimes, it really is that simple. "Lady Justice" is the name of this statue. That should make finding it super easy, right?
Well, no, actually. Lady Justice is a figure, and there are many statues of her throughout the world. So, what can we do? What's the next step?
The first thing I did was note unique characteristics in this picture. Firstly, that this Lady Justice has scales in each hand, whereas others have a set of scales in one hand and a sword in the other. Secondly, there is a reflection of a brick building in the window. Those are both good to note. If we upload the image to Yandex instead of Google, though, we actually get a ton of hits for the same statue from different angles!
With photos like the one above, I started trying a bunch of different Google queries, such as...
"lady justice scales both hands"
"lady justice brick building"
"lady justice united states court"
"lady justice floating feet"
...but to no avail. As I realized how narrow my chances of success were by just picking the right query and then taking the time to dig through all the results, I went back to my Yandex results and took a different approach.
Most professional journalistic outfits will provide credit for any photos used in their article. It stood to reason, at least to me, that if I kept checking Yandex results belonging to English news sites I would eventually find a pivot point. I was right, at least to a degree. None of the Yandex results directly worked for me, but eventually I started right-clicking all the different angles of the statue in my Yandex results and searching for them via Google Images in Chrome. After a few tries, I got a good hit.
"Photo by Dan4th Nicholas at flickr.com". Well, let's take a look at Dan4th's most popular works on Flickr, shall we?
That first photo definitely looks like our lady.
Wow! We got both a map of where in the world the photo was taken and Dan4th's description, which places this statue precisely at the Albert V. Bryan Courthouse in Alexandria, Virginia (the city and state are our answer to the second question, by the way.)
All we have to do now is find the courthouse on Google Maps and find out what building is across the street. You don't have to drop into Street View here, but I did it anyway because I wanted to demonstrate something.
Remember earlier when we saw the "United States Court" in one of the Yandex results? Well, here we are in Street View, and there it is! That's a good bit of confirmation that we've got the right place. Now, to the building across the way!
The Westin is our answer—well, that's what the sign on the building says, but it helps to click the icon on the building itself to get the full name, which is our third answer.
Task #9
And so we've arrived at the ninth and final task. This time, we're given a video to inspect instead of a still photo. We're also given a single question to answer.
What is the name of the hotel that my friend is staying in?
Now, I did not personally need to extract frame-by-frame images from this video in order to solve the challenge, but I did it anyway so I could demonstrate a few things—and so I could have some images to drop into this write-up.
NOTE: This is also part of a technique for making custom .GIF files from a video clip. You can extract the frame-by-frame images, then select "Open as Layers" in GIMP and output them as a .GIF file!
If you don't already have it, grab a copy of ffmpeg. Once you've got it, run the following command to convert the video into individual frames:
ffmpeg -i "C:\Users\prescomm\Downloads\task9.mp4" -r 29.97 -f image2 "C:\Users\prescomm\Downloads\task9-images\image-%07d.png"
Explanations:
-i - This specifies the input file, in this case our task #9 video file.
-r - This specifies the framerate of the input file. You can check the video file's properties to determine this.
-f image2 - This specifies the output file format for our images. For this task, we've selected image2.
%07d - This specifies a variable part of the output file names. In this case, we are numbering them incrementally with a seven-digit integer.
If everything turns out correctly, you should have 1426 output files. That's the total number of frames in the entire video, and if the video is running at 29.97 frames per second, we can say that 1426/29.97 is equal to 47.58. Since our video is 47 seconds long, our math checks out.
As we watch the video or progress through our frames, we're looking for anything that might narrow down where in the world this video might have been taken, however vague. At the 15 second mark (or approximately frame 449), I spot something that may offer us a clue.
I see a place called "Riverside Point", and I see some vessels in the water that I suppose to be ferries. With that knowledge in mind, I turn once again to Google, this time with the query "Riverside Point ferry".
The top result looks promising, so I click through.
That looks an awful lot like the same Riverside Point we located in our video, so it's worth our effort to check it out on Google Maps.
Assuming we have the right River Point, based on the angle of the video, I have drawn a line from where I think we need to drop into Street View. Once we're there, I start "walking" toward River Point so I can orient myself in relation to frame 449. I come to a stopping point when I notice a familiar set of buildings.
Where have we seen this before? Why, none other than the first frame of our video!
Okay, between River Point and this set of buildings, we're starting to build a list of reference points to build out some angles. In fact, here's a shot from that exact same spot on Google maps, but with our backs turned to the set of buildings in the first frame:
There's River Point. I'm confident that from where we are "standing", we may be able to see the target of our investigation. Let's return to the video and look for more clues now that we have some angular context.
This is frame 361. Those odd umbrella canopy structures look like the things we were standing under in Street View. Good, good. Let's keep looking.
And this is frame 285. Back in Street View, let's see if we can locate them. They look familiar.
Oh, they were visible from our Street View standing position. In the video, the camera had just swung down to look at the street, and these building were basically directly beneath the balcony on which our cameraperson is positioned. All we really need to do is find something with the relative height and distance that could look directly down and see these buildings while also catching the set of buildings in the horizon and River Point further to the right from those first two shots.
Well, that building looks very promising. I had actually taken this screenshot earlier as I was approaching the general vicinty of River Point. Turns out, it's the same building on the left side of the photo containing the colorful buildings on the street below. This building has the word "Novotel" emblazoned vertically on it's facade, but that is not our answer. Let's go back to Google! I type in "Novotel Singapore" and submit my query.
Well, there are two Novotels in Singapore. So, which one are we looking at for this challenge? Incidentally, I already captured the answer to that in one of the earlier pictures.
Yep. Novotel Singapore Clarke Quay is the building from which our video was shot, making it our final answer for not only this task but also the entire room.
I sincerely hope you enjoyed both this write-up and the room (if you've done it). I look forward to tackling further challenges from the Searchlight team. In the meantime, be sure to hit myself and/or the team up on Twitter or Discord. It would be our pleasure to chat with you.
See ya soon!
No comments:
Post a Comment