Detecting Audio Steganography - Cal Poly FAST CTF Question 1

The following is the first in a series of blog posts going over Cal Poly Pomona's security Capture-the-Flag event, hosted by Cal Poly FAST (Forensics and Security Technology). I made the questions for the club for fun and a good learning exercise. The CTF used some Facebook server with a map of the world with each country representing a challenge. Most challenges were simple multiple choice or short answer questions, but I decided to go above and beyond and create interactive file challenges. The files can be downloaded from my GitHub.
_________________________________________________________________


Forensic/Cryptograpy Challenge 1:
File: file1.wav https://github.com/mfput/CTF-Questions/raw/master/file1.wav
Question: We've sent the following secret message on a secret channel on your Pokegear.
Hint: I can't believe you have the audacity to ask for a hint.
Answer: morsecodeftw

For those who attempted this first challenge, I am sure I caused great confusion. I have no regrets. A WAV file is given and a secret message is inside it. Using strings or trying to find evidence of steganography (the practice of concealing files and messages) was useless. So was steganography being used? Of course it was! But not by using tools like steghide. If you listened to the WAV file, it would not sound to out of the ordinary, it plays the continue theme from Pokemon Gold and Silver. To examine this file, let’s take a look at it in Audacity (https://www.audacityteam.org/download/), a popular free audio editing tool which the hint recommended.


Clearly something looks strange about this file. If you listened to this on a laptop speaker it would be difficult to tell, but only the left channel is playing Pokemon music while the right channel is playing something else very softly. In Audacity we can mute the left channel audio, and increase the volume on the right channel audio. When you hear it, you will know immediately it is Morse code. This is the secret channel referenced in the question.

Taking a closer look we can actually see the individual dots and dashes, and decode it without having to constantly replay the file to hear it.



Wikipedia has a info-graphic with English alphabet translations to Morse here: https://en.wikipedia.org/wiki/Morse_code#/media/File:International_Morse_Code.svg.
When translated, it is decoded to “morsecodeftw”. This file was created by deleting the original right channel to the Pokemon song and replacing it with a Morse code sound bite created at https://morsecode.scphillips.com/translator.html.

Like my work? Donate here: https://buymeacoffee.com/forensicnoobsecurity