Previously: The Police and the investigators raided the COATIS headquarter and found huge evidence of their cyber crime activities. An official arrest warrant have been issued for everyone involved. Is everything solved now? Is Mr. Wright found or arrested?
You feel proud as you have just cracked a password hash. But you noticed something strange!
The password "Warthog_Smith" is an anagram of "Thomas_Wright". Can this mean something? Does some mystery remain unravelled even now?
The next day, early morning, you get another assignment - an encrypted report.
A G I L I n v e s t i g a t i o n I n c .
Spellborough, U.K.
19 May, 2009
Assignment #12
OBJECTIVE: Decrypt the Message.
DESCRIPTION: Great Job! The password that you cracked indeed helped us and the Police to reach the server room in time, and stop the remote execution of virus on hundreds of computers worldwide. That server room was their Command and Control (C&C) Center, and used mutliple servers in parallel to hack encrypt the remote files of victims. The RSA private key to decrypt victims' files was also found there; and has now been successfully retrieved and sent to all the victims to restore their files. You did a wonderful job of aiding us to find and catch such dangerous criminals. You will be definitely rewarded for this soon.
Another point needs to be made here. And that is the connection of Mr. Wright with this case. Firstly: In retrospect, the early riddles left by Mr. Wright and the morse code stranger make perfect sense now. It seems as they were legitimate warnings against the Cyber ransom criminals. Secondly: Since the disappearance of Mr. Wright, the trail of clues that we received, played a crucial role in taking us closer to the cyber crime group COATIS. Thirdly: Mr. Wright's name itself, was alleged in the private emails of COATIS as one of their members. These all facts sound a little paradoxical. Anyway, since, an arrest warrant has been issued for him as well, we sent one of our investigator yesterday to his home for another survey and his capture, if found.
He was expected to reply to us simply by call or by a plaintext message, but unusually, he has sent a report encrypted using DES in CBC mode. As one of your last assignments, please decrypt that report, and submit soon. We can't wait to read his findings.
CODE INFO: DES, Mode-of-operation: CBC (Cipher Block Chaining)
Encl. (1)
- DES Ciphertext, the Key and the Initialization String.
REPORT
TYPE: DES Ciphertext, the Key and the Initialization String
FROM: The Investigator who went to Mr. Wright's house
Date: 19 May, 2009
TYPE: DES Ciphertext, the Key and the Initialization String
FROM: The Investigator who went to Mr. Wright's house
Date: 19 May, 2009
Ciphertext:
roX+H5rKHJvKkqZK++hRaBBpdxLxoQpiPHgOC12xG/fFgTUT9GTpX8bBw5jK41+rpWtt5yeMyyZOOj3wiyFURf5xeNUn7qB02y4r5PMFOicx8DsGrbcwN3PX8oxvzX2fYMriIy2psN/C4lmU10eSEeM4x2OgUZ13n0fHMhviPEx7kGPoEfcoVwtiaLsJy3UcCFihpZbG00b+wdmv3RkZhM9fYlGw97Gl6ExVI4zVhQfArF0FRFMQSc37Rkd/NmtaWFyp34kWP0qXATgnCh8hyC4X1j7c52Vv2YtnWBekGGzbHkckmygTAXCxjRdU+0M4IpTOc4pKaGjzDJ6lZrWVB9z99roDmI7Jh8DVjrGNc74ye7+v0nlnfY3w+Ps6tlo3ng0jfJkxJn8CYbPALChPMEL7NVLbqlTZj67o+MBV/c/Vf8WR6k2m2MSEe8fn6XXaHkLm1lzzIlE6foVjs3V9qW/P3mYkx37BTBRaXLASwcrbMtKAT8xgenn7cwlt1PJx+0YrrCrRFA6/PPM3NBcS2TogXO1s4KivxAbPhD+/rgNrNpJuARHtW8kdAvOxWX8I0f1shgzfYrWkml5b1+3DcOGxM2o0ebSp/IG0tZyGs0ErRXX6zQLvOCQqYTUyqqfBqD+lh/O559/oqWwWz5SrdTk99O3h0ncC6woAVG9M9O2JcyxavNNFzKexPce1qEuHeyFo1+RsqmChBdQ9ZVOvdxeW3NOdyR82Qpffbcmoycd4GMaWb0kQ4HOKsunrKtZL8XDs4c/p36cQvfmR+uyyi7BHADgoa1RKqDFEd4Q3qRmSLR96MGSotpfd0EvJmpIgZ6XLjiC1ywInP2R59GaSUf6+bHe/pRF9BOlKmYGrHcXSmZWVRrgfWdkKarvFwm6GVMimeu6QNgRREqZ1HQMQi6dfgO3W6aQdqCjQdCdOqzfWG3EwHwe9YghWPGChy72Plk9nrT4R1FtHD97srJZLZ7aIJX89q7L2I6SHp1c8x9E2qu4g+4qS915B0fa4JmLZ+UE2Dps9tLLNfAxtqol7QQLbfX/g1mpnfywPUYDoLdynKloy1wdGZ2dKj/ewCmA5vhQ/Iw8KtwvunPaJdt1nNaSFgBDXBvg3InrCyGvGrCe1uzr3w/cVuFzWncKfqmmjQRcvzbdtdhLRpi0lpd6npEPohpkf4xty+wZBINdIL9u2vq/5fuiMyDqie+svmMMPQzrBYl48wm7ZHBKRK4y+GQnlC8E3AHHdFfgR404NwXrwgKwU1XBYn3Tp/ojChEtbiTNfB/TQ+mIVlcgNn5bbWzWQBwRhnvjP4e/THC5A5iXhkWZy+v1NdrqijcRjgUWT
Key:
2HgOYMqX
Initialization String (required in CBC mode):
eYonRFhG
One of the last assignments! Exciting!
And, why did the investigator encrypt his report? Is there something shocking underneath?
Let's find out.
And, why did the investigator encrypt his report? Is there something shocking underneath?
Let's find out.