kybr-git/dc30-badge-challenge-writeupWriteup for the DEF CON 30 badge challenge
Hello there! I'm Pete - aka Kybr - and this is my writeup for the DEF CON 30 badge challenge.
This year's challenge was heavily focused on music and hacker pop culture, which (I think) made it more widely accessible than some previous badge challenges. We had a huge crew of hackers in person and on Discord working on the badge challenge from the moment they started handing out the badges Thursday morning all the way through Sunday afternoon, when we finally finished the last challenge just four hours before DEF CON ended. Big thanks go out to Mike, redactd, and crew at MKFactor for the truly unique and beautiful badge, and also for the many hours of pain and suffering fun!
We divided the challenge into 3 parts: gathering notes, gathering friends, and the final thread. You can look over our documentation here:
https://dc30badge.fandom.com/wiki/DC30Badge_Wiki
Our notes are available here:
https://docs.google.com/spreadsheets/d/1MdZgv_O3ogv4JDS07iobh5rhoDYXCsF7QVExuG08txA/edit#gid=0
Finally, if you enjoy this sort of thing, I encourage you to join us in Discord for next year's challenge here:
https://discord.com/channels/867438418212683796/867438418212683799
Thanks for reading!
The first challenge can be found by selecting the "Challenge" option on the main menu. We are presented the following text:
Collect the Measusres
Break the Silence
Continue the Journey
NOTE: The misspelling of the word Measures was accidental and not relevant to the challenges.
This is a reference to the musical measures found on the faceplate of the badge itself. There are 9 different colored badge types at DEF CON, and each type had something different on the faceplate.
Gathering photos of all 9, we find that 8 have music and 1 (the grey CFP badge) has letters spelling POWWYGBR
That's our key to ordering the other 8 badges by color: Purple, Orange, White, White, Yellow, Green, Blue, Red.
Once in this order, the measures form the beginning of the song "Peer Gynt Suite No.1".
Playing these notes on the badge in "Play" mode unlocks Challenge Part 2:
ANSWER: in Play mode, play these notes at any speed:
GEDCDE GEDCDE GEGAEA GEDC GEDCDE GEDCDEDE GEGAEA B G# F# E
NOTE: You must be on the default "4" octave for this to work, if you hit left or right to change octave you will not unlock part 2!
After playing Peer Gynt Suite, the Challenge option on the badge now shows us the message Call YИИEႱ and our keyboard now plays dial tones instead of notes. "YИИEႱ" is a reference to the song "867-5309 / Jenny" by Tommy Tutone, and since Jenny is written backwards, we're meant to dial her number backwards: 903-5768. Dialing this number on the badge itself does nothing, there were physical telephones in the Contests area of the convention that needed to be used for the remainder of these challenges.
Calling 903-5768 on these phones gave us a series of 5 clues about 5 missing friends:
Alice - Was last seen shopping for a new water pipe
Bob - Little Bobby turn tables, dropped himself
Carol - Went to her favorite arcade
Dan - Greenwich manhattan
Eve - Cerebrum data link
The message also told us that for the remainder of these challenges, each answer will be a URL starting at https://defcon.org/badge/30/
So we submit our answers by adding it to the end of that URL. If we're right we find a new webpage with the next challenge, and if we're wrong we just get a standard 404 "not found" error. We have 5 threads to follow now, one for each of the 5 missing friends.
YИИEႱ's message said "Alice was last seen shopping for a new water pipe"
This was our easiest question which introduced us to the challenge format. "Water pipe" here is a simple reference to a hookah, and we found our next challenge by adding "hookah" to the given URL.
ANSWER: https://defcon.org/badge/30/hookah/
Solid blue screen
The hookah URL presents us with a solid blue screen, with nothing interesting in the code or website traffic. Between the name "Alice", the reference to a hookah, and the color blue, the question is a reference to Alice in Wonderland where Alice meets a caterpillar smoking a hookah. We add "caterpillar" to the end of the URL to find our next challenge.
ANSWER: https://defcon.org/badge/30/hookah/caterpillar
Image of the caterpillar
We are given a picture of the hookah-smoking-caterpillar from Alice in Wonderland. Upon downloading the image and inspecting it's metadata, we find that the "OwnerName" attribute has a curious value of 9dFDfOi_-ss.
This is a video reference for a YouTube URL, so we browse to https://www.youtube.com/watch?v=9dFDfOi_-ss which gives us a video of our smoking caterpillar reciting the poem "How Doth the Little Crocodile"
ANSWER: https://defcon.org/badge/30/hookah/caterpillar/howdoththelittlecrocodile
Poetry
We are given the text When is a measure not for science? double the common form.
This is a reference to the Common Measure, a poetic metre consisting of four lines that alternates between iambic tetrameter (four metrical feet per line) and iambic trimeter (three metrical feet per line). The poem "How Doth the Little Crocodile" is written in this meter. The poem consists of 8 lines, and counting the feet per line gives us 4,3,4,3,4,3,4,3, so doubling that form gives us 8,6,8,6,8,6,8,6. Since 86868686 was not a valid URL, we called that number on the contest phones and were given the unlock code for Alice (who now appears under the "Friends" menu option on the badge!)
FINAL ANSWER: Call the number "86868686" on the contest phones to find Alice.
ANSWER: https://defcon.org/badge/30/logic