Past Challenges: 2011
Grandma Got All Hax0red by a Reindeer... Or Did She?
By Ed Skoudis & Tom Hessman
"And I will now demonstrate, ladies and gentlemen of the jury, beyond a shadow of a doubt, that the defendant, Mr. Rudolph T. Reindeer, is guilty of the heinous act of... CRIMINAL HOMICIDE!" boldly announced the prosecutor. The courtroom was in an uproar. Santa buried his face in his hands as Mrs. Claus began to weep. Rudolph stared ahead in stunned silence. I'll never forget that tumultuous day. If the jury accepted the attorney's conclusion and convicted him, Rudolph... with his nose so bright... wouldn't be guiding any sleighs any Christmas nights, for a very long time indeed.
This tragic set of circumstances all began on Christmas Eve during our family's festive holiday get-together in New York City. Shortly after 9:00 PM, Grandma realized she had forgotten her medication back in her apartment. Worried that she was a wee bit tipsy from rather too much eggnog, we begged her not to go. But she staggered out the door, saying, "I'll take Cousin Mel along."
In truth, Mel wasn't actually our cousin. Grandma had only recently met Mel, who was working as a repairman in her apartment building. They became fast friends. Because he was Grandma's friend, we all wanted to call him "Grandpa Mel" or "Uncle Mel". However, Grandma insisted that we call him "Cousin Mel" because he was so much closer in age to us kids.
The roundtrip walk to Grandma's house through Central Park should have taken less than 45 minutes, even at Grandma's slow pace. But, with our wild family Christmas soiree really cranking into high gear when the Rockettes arrived before midnight, we all forgot about Grandma and Cousin Mel.
It wasn't until 9:00 AM on a groggy Christmas morning that Little Timmy noticed that Grandma and Mel never returned. We tried calling Grandma on her cell phone and at her apartment, but got no answer. Alarmed, Dad called the police to file a "Missing Grandma" report.
Within an hour, the police called back and told us to meet them in Central Park near the bridge closest to Grandma's apartment. When we arrived, we were horrified. Cousin Mel was seated on a park bench, disheveled and crying, repeating, "The reindeer... that red nose... the jingle bells... Oh, the humanity!" Grandma was nowhere to be seen. The police showed us the only sign she left behind: her winter coat, which they had found at the scene of the attack with incriminating hoof prints on the back. The crime scene photographer snapped a photo of this crucial evidence:
Our diligent local police agents quickly contacted the authorities at the North Pole, who obtained a court order to seize Rudolph's belongings immediately, including the computer he kept in his stable. Using that evidence, along with the eyewitness testimony of Cousin Mel, the prosecutor carefully built his case against Rudolph.
Based on Mel's description of the violent attack, after several weeks with no sign of Grandma, the authorities officially presumed that our dear Grandma had met her demise, a tragic victim of a reckless, renegade reindeer bent on destruction.
And that brings us back to today, here in the courthouse for the criminal prosecution of Rudolph the Red Nosed Reindeer. The prosecuting attorney summarized the evidence, "The defendant's own computer system included geo-location data transferred from a cell phone showing that Mr. Reindeer was at the scene of the attack at the exact time that it occurred. Further, we have hoof prints on poor Grandma's coat that match the defendant. And, finally, we have the eye witness testimony of Cousin Mel, who witnessed the gruesome event."
With such detailed evidence and a carefully presented case against him, things were looking pretty grim for Rudolph.
And then, it happened. Suddenly and quite dramatically, Little Timmy burst into the courtroom, arms flailing, waving a USB thumb drive in his hands. He shouted, "Your honor! I'm so sorry for the interruption, but I just discovered some potentially important evidence for this case."
"I object to this interruption," declared the annoyed prosecutor.
"Objection overruled, counselor," said the judge, "I am obligated by the official rules of Christmas-Special Courtroom Cliches to hear what this youth has to say. Go on, young man."
Timmy explained, "My dear Grandma really loved computers. Whenever we visited her apartment, we'd almost always see her blue and silver wig silhouetted by the soft glow of her computer screen. Cyber attacks and defenses - she was a wizard at that stuff. This morning, as we went to her apartment to collect her belongings, I noticed this USB token connected to her computer. When I looked at its contents, I found a packet capture file that appears to have been created and updated Christmas morning... the very morning of the attack and Grandma's disappearance. She always liked to keep track of her computer activity for troubleshooting purposes, so Grandma must have been running a sniffer that fateful night and following day. I haven't been able to make any sense of the data in those packets, but I just know that something here will help us determine conclusively Rudolph's role in the attack and perhaps even Grandma's location!"
"Those are pretty serious statements, young man. I'll dismiss the court temporarily while our technical experts analyze the evidence in more detail to help us get to the bottom of this case."
And that, dear reader, is where you get involved. Fire up your favorite packet analysis tool, analyze this packet capture file, and answer the following questions to help determine Rudolph's guilt or innocence:
- According to the packet capture file, what was Grandma's grand plan for Christmas day?
- Why did the geo-location information on Rudolph's computer, synced from his cell phone, show that Rudolph was in Central Park during the attack? Please describe each technical step that lead to this "evidence" presented in court.
- Where should the authorities look for Grandma?
- Based on the evidence in the packet capture file, who is guilty in this story?
Send your results to GrandmaChallenge (at) counterhackchallenges.com with a subject of "Grandma Challenge"
Rudolph needs your help to sort out this matter and see that justice is done.
Merry Christmas!
- Ed Skoudis & Tom Hessman