Didier Stevens

Thursday 27 August 2009

The Brucon WiFi Puzzle Solution

Filed under: Puzzle — Didier Stevens @ 14:16

Here’s one way to solve the Brucon WiFi Puzzle: open the capture file with Wireshark.

The capture file contains one beacon frame for the brucon09wifi network. If you’re a bit familiar with beacon frames, one tag will stand out: the vendor specific tag which Wireshark can’t interpret because it’s from a vendor it doesn’t know.

bruconwifipuzzle-1

The hidden data is inside the vendor specific tag. Select it and export the selected bytes:

bruconwifipuzzle-2b

How do you decode this data? You can try all types of encoding and encryption schemes, but to prevent you from wasting time trying countless possibilities, I’ve given you a hint in the name of the vendor: XortecOy. The data is XOR-encrypted. And the key is tecOy. ;-)

Open the saved bytes with Cryptool:

bruconwifipuzzle-3

And apply XOR-decryption with key tecOy:

bruconwifipuzzle-4

Et voilà!

2 Comments »

  1. […] Get stuck on the Brucon wifi puzzle?  Didier Stevens to the rescue with a fabulous, and illustrated, run down of one way to solve. [The Brucon Wifi Puzzle] […]

    Pingback by Daily Digs – 08.27.2009 « Security Stallions Blog — Friday 28 August 2009 @ 4:18

  2. Great puzzle and challenge. I thought the vendor “xortecoy” sounded suspicious and I immediately tried taking that hex block thats “Not Interpreted” and xor’ing against random strings to guess the key, but didn’t find the answer. I Didn’t think to use “tecoy” in hex as the key. Fun puzzle. Keep them coming!

    Comment by David — Friday 28 August 2009 @ 15:39


RSS feed for comments on this post. TrackBack URI

Leave a Reply (comments are moderated)

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

The Rubric Theme. Blog at WordPress.com.

Follow

Get every new post delivered to your Inbox.

Join 244 other followers

%d bloggers like this: