I recently had the opportunity to visit the BSides Montreal cybersecurity conference, and I was fascinated by the talks, the badge design, and the circular white sticker. It must be my hacker instinct that told me they have something in it and could be a flag or treasure, because I have lived that; I myself have done something like that for the cybersecurity meetups and conferences. While I was a part of the OWASP Kathmandu community, our natural approach to making the CTF was to embed the CTF or challenge link in the entry badges, as explained in my other article. So there was a high chance of the same idea on the badges as well.
The BSides badge was themed according to the Montreal Olympic Park stadium and consisted of a PCB, a CR2032 3V lithium cell battery, a switch and 4 resistors, but out of nine LEDs, three of them were flashing while the remaining six were changing colours smoothly, so the initial idea of an advanced challenge is eliminated because I cannot see the exact components like microcontrollers or external timing elements in the badge; this also suggests the LEDs are probably self-colour-changing and probably less chance of Morse code signals here. The badge was developed by Hackerware. My first speculation was a little bit advanced, but it seems to be taking a different direction.
But wait, I am at a conference to enjoy the talks and take in the knowledge not to hack, right? I am very much sick of the old habits; I can’t stop myself out of curiosity, can’t stop hacking and researching at all possible times.
The moment I scanned the NFC sticker- yes, that white circular thing- it took me to a YouTube video we all know what it is, but it is known to very few people that an NFC tag can hold multiple records as long as it has enough storage, and a default scanner looks for the URI/URL on a phone and always picks it first. With a custom NFC scanner app or solution, you can dump all the tag’s records and properties.
They used NTAG215, which can hold up to 540 bytes, but usable is 504 bytes; i.e considering the records are in English, it would be enough info. It’s different for French because à is 2 bytes but only one character; for English, that’s 504 letters of the alphabet. One could probably write poems or something really important on it, but a YouTube link/link isn’t interesting, so I started debugging using multiple apps and got some extra information in the tag.
At this point, I see [en] 384.53 M5929m 2015 as a hidden record. It appeared to be a Dewey Decimal Classification number, a standard for organizing books in libraries. The reference and Google resources say it’s a book, but downloading the ebooks and searching for available resources online yielded nothing; it can be a broken record or nothing at all.
The CyberSecurity conference took place at the Grande Bibliothèque, which is a very famous and large library. At that moment, I started doubting that this could be a book – yeah, a real physical book that you need to read and solve the challenge? I felt too lazy to do it, but yeah, it was highly possible. I paused for a while to enjoy the conference talks, promising to solve the mystery.
After the first conference talk, I learned that the sponsor booths held clues about the challenges, and I had to explore them to move forward. Since I had already solved some parts of the Badge challenge by myself, it was time to collect the clues and get the right direction.
But I saw something at the sponsor’s booth where the ISC2 Booth says, “You carry a hidden guest with you.” So yeah, they are talking about the second record in the NFC sticker that definitely has or leads to, a flag. I really don’t want to visit the library, so I tried an easy way.
To submit the flag, the correct channel was SMS, which you also have to discover through the clues. The posters near the emergency exit and the washroom included a lost dog and a phone number. I submitted the flag, but it seemed to require some physical effort to uncover. Need some walking now !!!
Visited the library; it took a while to spot the book on the shelves. It was related to mobile NFC and in French. It could be obscure; I don’t necessarily have to deep-dive into the protocol.
I explored the book for a while and found that the last page has an NFC sticker too. After scanning the tag, the data was encoded in Base64, and it took a few seconds to uncover that the passphrase is passphrase.
Initially, it seemed to be linked to another challenge where I saw the Wireless configurations provided to connect to the Wi-Fi. My next goal was to connect this part of the passphrase to a hidden Wi-Fi network, as explained in some posters about the wireless details, but this was a flag, and I didn’t proceed further.
Deuxième défi (Second Challenge)
There were ten different clues to collect from the sponsors’ booths, one by one; some were visible on the table, but for others you had to be brave enough to ask for the clue.
It all started when a clue from the sponsor Propolys booth said something like, “Nobody ships code without a coffee. or 3.” It is related to the hacker’s best friend: caffeine. The source can be a faucet, an ocean, or a simple coffee machine, so without further ado, I started scanning the perimeter around me.
While exploring the perimeter for a coffee/breakfast place, something really caught my attention: the coffee cup sleeves/cupholders stuck in the wall. When I read something unusual in them, my instinct said, This is something that will lead me to the flag. There were 3 different types of cupholders/cupsleeves, numbered 1/3, 2/3, and 3/3, that matched the clue description too.
I checked the header BOB BEMER ROASTER – est. 1963. After Googling it, I learned that Bob Bemer is the Father of ASCII because he helped to establish the ASCII standard, which was officially published in 1963. Now, below the header, we have this information.
| Sleeve #1 – Escape Sequence dark roast |
| Sleeve #2 – Backslash blonde roast |
| Sleeve #3 – Curly Brace house blend |
So the brand name is a person, the founding year is a standard established date, and the listed properties like Escape Sequence, Backslash and Curly Brace are the exact contributions made by Bob Bemer. At this moment, thinking of the curly braces, I was already constructing the standard CTF flag format in my head: FLAG{XXX-YYY}, but I wasn’t quite right.
No, there has to be something with the Nutrition Facts too? When I observed them and arranged the data for better visual intake, it looked like this. The decimal data represents something because it was in the standard character range for lowercase letters (i.e., 97-122). The calories on the right are 666, 808, and 911, and the percent daily values are 420, 512, 999, 1337, etc., and need to be discarded.
| Sleeves | Nutrition Facts | Decoded |
|---|---|---|
| #1 – Escape Sequence dark roast | Fat: 100g Saturated Fat: 101g Trans Fat: 97g Cholesterol: 116mg Sodium: 104mg | d e a t h |
| #2 – Backslash blonde roast | Total Carbohydrate: 98g Dietary Fibre: 121g | b y |
| #3 – Curly Brace house blend | Total Sugars: 99g Added Sugars: 111g Protein: 102g Vitamin D: 102g Potassium: 101g Caffeine: 101g | c o f f e e |
By converting the decimal to a character, you can see it builds sensible words, and you can construct the final flag: deathbycoffee, a pinnacle of caffeine intake.
I was able to solve a few more challenges, which led me to win a ticket to another well-renowned cybersecurity conference known as HackFest. I probably won’t be able to attend due to time constraints, but if you need the ticket, I am willing to give it away.
I am willing to contribute to the next BSides MTL conference; if someone from the organizing team is reading this, I am happy to help.
Takeaways
- Don’t burn yourself out on CTF challenges if you plan to enjoy the talks and meet people, even if they seem easy.
Resources
NTAG: https://www.nxp.com/products/NTAG213_215_216
ASCII Table: https://www.scaler.com/topics/convert-ascii-to-char/
