Magnet Weekly CTF Challenge Week 3 Writeup

The following is the week 3 writeup for the Magnet Weekly CTF Challenge and this week's challenge looked like this:

Seeing the words "Which exit did the device user pass by" and "Cargo" made me wonder if I should look for a sign that has an exit ID on it. Despite that, none of the Photos found from the Android image showed nothing like a sign:

Magnet Forensic Staff normally would give some hints on this week's challenge on their YouTube channel on Monday 11ET and so did they last week. 

I had to say Jessica Hyde's hint was instrumental for me to crack this challenge quickly. With some Google searches, the webminar mentioned by Jessica could be found. This webminar was delivered by Jessica Hyde and Christopher Vance and the topic was about the comparison of artifacts between Android and iOS.

The highlighted part from the above screenshot immediately caught my attention and I suddenly realized I had to look at the Motion Photos on the Android image. "Motion Photo" is  a function offered by Google on Pixel phones starting from Pixel 2, which could be toggled on/off from the Google Camera interface shown below:

The Motion Photo files should have their file names started with "MVIMG" prefixes. Therefore, the first order of business would be exporting all image files that had :MVIMG" prefixes in their file names for analysis.

After that, there were at least two possible ways to solve this challenge:

The Quick Fix

By default, Windows could only view the exported Motion Photo files as static JPEG files. As I have had experience using the Motion Photo feature before, I know the Google Photos mobile app could view the Motion Photo properly. Therefore, I imported all found Motion Photo files into my own Pixel 3 and used the Google Photos app to view them. Most motion photos did not contain the information needed, until I came across MVIMG_20200307_130326.jpg.

Clicking on the top-right encircled play button would start playing the motion photo, which would look like this:

From the captured GIF, you might very well saw a traffic sign was passed by in the blink of an eye. In reality, the clip was played in an higher speed than this GIF did. So a way had to be found in order to spot the text on the sign. Google Photos has a handy function that allowed users to see the motion photo in a frame-to-frame manner, such that they got to choose the best shot from the motion photo. This function indeed helped a lot in spotting the best shot where the text on sign was actually readable.

From the screenshot above, the texts "Sør-Gardermoen", "Cargo", "Gardermoen vest", "Kulturpark" and an exit ID look-alike "F16" could be identified from the sign. Thus, I submitted the answer of this challenge as "F16".

However, this isn't the end of this writeup.

The Geolocation data showed that the photo was taken near the Oslo airport. Is it possible to find the actual sign?

As seen in the GIF above, a series of orange-colored structure could be seen from the Android device owner's viewpoint. They are part of the Approach Lighting System (ALS) used in airports to allow the aircraft pilots to visually identify the runway environment and align the aircraft with the runway upon arriving at a prescribed point on an approach. Moreover, ALS is usually installed on the approach end of an airport runway. 

By using Google Maps in satellite view and searching around the Oslo airport runways, a match could be found:

Google Street View was then used to verify if the sign shown on the satellite view was indeed the sign seen in the motion photo.

Clearly, the sign should be the one observed in the motion photo. However, the actual exit ID was not "F16", instead it should be "E16". 😂

The Conventional Way

The structure of the motion photo was rather simple. Fernando García Álvarez has written a detailed write-up about the structure of the motion photo. In short, the motion photo is basically an MP4 file appended to the end of a JPEG file. GitHub contributor Keith Turner had written a shell script to extract the MP4 file from the motion photo. This script could be used to obtain all the MP4 files from the motion photos. By inspecting all MP4 files, the same highway sign could be found in this way.

So this marks the actual end of the week 3 write-up of the Magnet Weekly CTF Challenge. I hope you enjoyed this week's write-up and see you next week!