SEC 3400 Computer Forenics Technology

Operation Stop Hack: Hidden Messages

Introduction

The answers become a chain of communication. Download and submit this assignment worksheet [DOCX] for credit.

1. List the answers to all five ciphers, numbered 1–5.
2. Each answer is worth five points.

The FBI recently found some hidden files and messages on the hard drive of the hacker from Operation Stop Hack. They are enlisting your help to determine the content of these hidden messages. They want you to have the following Intel to help with your investigation:

INTEL

• It appears as if the criminals were using cipher techniques to communicate with their other members about targets and operations. We found a message that appear to be encoded using various number bases, substitution and ciphers.
• We think the following web tools will help in your investigation:
  • Rapid Tables.
  • Rumkin’s Cipher Tools.
• Number bases; include base2 (binary), base10 (decimal), and base64.

Binary is represented by two numbers ones (1) and zero (0), hence the base2, which means that base 10 would be represented by 10 numbers, 0–9 (always start with zero).

• We were able to figure out the first message, which was encoded using binary:
  01001101 01100101 01100101 01110100 01101001 01101110 01100111 00100000 01110011 01100101 01110100 00100000 01100110 01101111 01110010 00100000 00110001 01110000 01101101 00100000 01100001 01110100 00100000 01110100 01101000 01100101 00100000 01001000 01101111 01110100 01000100 01101111 01100111 00100000 01010011 01101000 01100001 01100011 01101011
• We determined that the first message read: Meeting set for 1pm at the HotDog Shack.
• We used the Rapid Tables converter to figure the meaning of this code. The binary was copied into the textbox that reads binary and the text answer is shown in the box labeled ASCII.

We have tried to evaluate each message to determine the type of cipher; now we ask that you finish the task and crack the codes. Please return them to us quickly in case they can help capture other members.

1. This message appears to be encoded using hexadecimal:
   Ox 57 65 20 6E 65 65 64 20 74 6F 20 6D 65 65 74 2C 20 74 68 65 20 70 6F 6C 69 63 65 20 61 72 65 20 62 65 63 6F 6D 69 6E 67 20 73 75 73 70 69 63 69 6F 75 73
2. The next message appears to be base64:
   U3RvcCB3b3JyeWluZywgdGhlIGpvYiBpcyBhbG1vc3QgZG9uZSBhbmQgeW91IHdpbGwgZ2V0IGEgbGFyZ2UgcGF5b3V0
3. The next missive appears to be encoded using ROT13, so we suggest using the Rumkin Tools:
   Jung’f gur arkg wbo?
4. This e-mail was found and it appears to be Atbash:
   Dv ziv tlrmt gl szxp gsv hsrkbziw hl dv xzm ivwrivxg z hsrknvmg lu wrznlmwh
5. The FBI are stumped: a double cipher was used to encode a message. It looks like hexadecimal, but the ASCII text does not look like English. They also found the passphrase: secret.  The message appears to be a sort of polyalphabetic substitution.
   1. Determine what cipher is considered a polyalphabetic substitution cipher:
      Ox 4C 6C 67 20 72 78 6D 73 67 6D 20 6E 6D 65 64 20 78 63 62 69 20 69 64 65 65 76 20 73 67 20 58 76 6B 75 65 72 20 45 65 61 20 39 6B 6C 20 78 70 65 65 6B 70 72 20 73 78 20 31 30 63 64 2E 20 43 68 6D 20 61 6B 63 70 20 6D 73 6F 67 20 6B 6C 78 61 76 20 67 64 65 62 64 20 77 61 6A 78 78 65 20 68 71 6E 72 2C 20 70 7A 6D 6E 76 20 4D 20 62 66 6E 67 74 78 20 6D 7A 69 20 75 70 77 6D 77 71 20 79 7A 78 61 20 73 20 67 71 75 69 20 6D 7A 65 76 20 6E 6D 65 64 20 76 67 69 73 6E 6C 69 20 76 79 69 20 6C 7A 6D 72 64 69 67 6C 2E