Solving F5’s puzzle on Black Hat USA 2018

Eviatar Gerzi
6 min readSep 14, 2018

--

This year I participated in Black Hat USA 2018. While walking between the booths I noticed the F5 booth and they shared a cool puzzle. The puzzle was already over and I want to share it with you.

The riddle:

The riddle was built from two parts:

  1. Crossword puzzle
  2. T-shirt

If you want to try it by yourself you can look on each part and try to solve it:

Solving the crossword puzzle

This is the crossword puzzle

After filling it we will get:

In the blue squares we received:

  1. keyed
  2. vigenere
  3. rumking

Which a simple search in google will lead us to the following website:

I understood that we need to use this website to decrypt the message but according to the website we still need to find:

  1. Alphabet key
  2. Passphrase
  3. Encrypted message (we have this one !)

In the red squares we received three words:

  1. truths
  2. return
  3. zero

It can only be the passphrase. I wasn’t sure regarding the order but there are not many combinations to play with.

The T-Shirt

The front of the shirt

Front of the t-shirt

On the front of the t-shirt there is a picture of three robots holding flags and the back of the t-shirt contains moons of (almost) each planet in the solar system.

First, I tried to understand what is the meaning of the front of the t-shirt. There are three circles and two flags are being hold by the robots in each of the circles in a different way.

I remembered that I saw the use of such flags in aircrafts or ships. Anyway I searched for this kind of flags and found the term flag semaphore.

Flag semaphore (from the Greek σῆμα, sema, meaning sign and φέρω, phero, meaning to bear; altogether the sign-bearer) is the telegraphy system conveying information at a distance by means of visual signals with hand-held flags, rods, disks, paddles, or occasionally bare or gloved hands

I found that each directions of the flags can represent a different word

Using the above flag semaphore alphabet I decoded the message which was the name of the company: F5

The front of the t-shirt gave us a hint that we will need to use flag semaphore.

The back of the shirt

Back of the t-shirt

Looking again on the back of the shirt, above each name of a moon there is a symbol like a clock

Luna — Earth’s moon

Following the hint on the front of the shirt I understood that this is actually a direction of the flags.

I wrote that letter for each related flags and the name of the planets

We have here all the alphabet which is exactly the alphabet key we need for the Keyed Vigenere Cipher. But how can we know what is the order ?

Finding the order of the alphabet key

I looked again on the scenario:

The last sentence is the one who need to pay attention to it:

If each of the moons transmits one element of the key alphabet simultaneously, and those signals are amplified and rebroadcast by their respective planets, in what order would they be received on Earth ?

What letters will be received first to Earth ? the letters from the closest respective planet. The planets appear on the t-shirt are already ordered by their distance to Earth

But we have planets with number of moons and they both send the alphabet key simultaneously. When the moons sends their keys, it first should be received by their respective planets and “rebroadcast” to Earth. So when we have number of moons, the key that will be sent first to Earth is the key related to moon which is closest to its respective star.

The first alphabet key that will be send is: G. Because it is the key of Luna which is the only moon of Earth.

Earth’s moon (taken from Wikimedia)

The next closest planet to Earth and has alphabet keys is Mars. Two moons appear next to Mars: Phobos (“D”) and Deimos (“P”). I used this map to see the distance of moons from their respective planet. In this case Phobos is closer (10,000 km) to Mars than Deimos (+20,000 km). The key if Phobos will reach first to Mars and then rebroadcast to Earth and it will get first. The keys will reach to Earth in this order: D P

Mars’s moons

With the same logic we will continue on the rest of the planets.

Jupiter alphabet keys: Q W L Z

Jupiter’s moons

Saturn alphabet keys: I H M S O N

Saturn’s moons

Uranus alphabet keys: A K F Y X

Uranus’s moons

Neptune alphabet keys: T V J

Neptune’s moons

Pluto alphabet keys: R B C E U

Pluto’s moons

Summary:

Planets, their moons and related letters orderded by distance

Alphabet key: GDPQWLZIHMSONAKFYXTVJRBCEU

Decrypting the message

We have all the required fields to use the Keyed Vigenere Cipher.

Encrypted message: WVBYTJPYHGPBHBIRYAIBFPQUYBZILI

Alphabet key: GDPQWLZIHMSONAKFYXTVJRBCEU

Passphrase: truthsreturnzero

Result: NECESSITY DISPENSETH WITH DECORUM

Which is a quote by Thomas Carlyle.

Double or nothing

The first idea was to calculate the distance between planets but it is being changed dynamically because the planets are moving all the time.

I decided to check what happen in each sending round. The first round is when a planet receives the alphabet keys from its own moons, 0 jumps. The second round is when a planet receives the alphabet keys from planets near him without planets between them, 1 jump. The third round is when the distance is 2 jumps and the so on.

For example, let’s look on Earth.

First round: 1 key (“G”)from Luna

Second round: 2 keys (“D”, “P”)from Mars

Third round: 4 keys (“Q”, “W”, “L”, “Z”) from Jupiter

On Mars it will be:

First round: 2 keys (“D”, “P”)

Second round: 5 keys (“G”, “Q”, “W”, “L”, “Z”)

After doing it on all the planets we can see that the first planet to receive all the decryption keys is Saturn.

--

--

Eviatar Gerzi
Eviatar Gerzi

Written by Eviatar Gerzi

Security researcher interested in reversing, solving CTFs, malware analysis, penetration testing and DevOps security (docker and Kubernetes)

No responses yet