Today I'm going to share some thoughts about various NAS devices I've considered for my home environment.
Number one objective is to have a power efficient device, since these things will most of the time sit there and contribute to your monthly electricity bill.
Couple of years ago I've decided to try Thecus N2100, it seemed nice and hackable and it had two GigE ports, but it had a really IO subsystem making it really slow. I was hoping that the bugs could be worked out, but it didn't happen. So, I've popped two WD green drives (1TB), replaced the internal fan with a quieter one, upgraded the memory to 512MB. The transfers are still really slow and the included version of BusyBox is pretty outdated and buggy. If you have filenames with some bad characters in them, or lots of files in the folders some services such as the Mediabolic media server would just crash. It's real legacy hardware now, the CPU on the unit is plagued with some serious bugs and the original kernel seems to be much better than most other available. I've tried different things with it, but I wanted to keep it fairly stock, so adding the extra modules was the way to go. But eventually I got tired of it, and I've decided to retire it, after running it for a few months 24/7. I needed a device with an ftp server, and enough storage to be able to serve some content through DLNA and DAAP (iTunes-like).
One of the days I was looking for Raspberry Pi (still waiting for my order to arrive) specs and I've noticed a pink Pogoplug on sale for $25. Once I found out that it has a SATA port on the inside, I thought that I could use this thing to replace functionality of my other NAS. In a way this would be a downgrade, from two SATA ports to one, but on the other hand 4 USB ports and less power hungry device with support for optware seems like a perfect match. Not to mention the initial investment part. So, I've chopped off a little sliver of the back cover to run the 90-degrees-angled SATA to e-sata cable, and it's almost ready. All I need now is a decent e-SATA drive dock or an enclosure and it's ready.
One of the big selling points for me was the 5GB of free cloud storage, that shows up up in the management screen as another drive. I'm trying to keep my ISP costs down, so my link is seriously limited in upstream bandwidth, so I was able to use that to host my pictures for my family members.
Another great feature is the built-in DLNA media server. It's been pretty stable, one of short comings was that it wouldn't index my small 80GB drive for the movies, but then luckily I was able to find the 5GB of the ShmooCon 2012 videos by browsing through folders.
It goes without saying that the thing allows one to turn on the built in ssh server, and mount optware from the USB drive
My final solution to the problem became much simpler than ones listed the above, and it entails a relatively beefy broadband router with an USB port, a few tiny 32GB flash drives, an USB hub, and OpenWRT. It is still having some little issues that I'll have to take time to iron out, but at least it serves a multitude of tasks. So, I have there an VPN server, an ftp server, a samba share, DLNA media server, DAAP (iTunes compatible) server, and I couldn't be happier with it. It allows me to use Wake-on-LAN to turn on my beefier media server based on HP N40L microserver and OpenMediaVault when needed, where I have much more space for my git repositories, family albums, as well as vacation pictures and videos.
2012/05/16
2012/01/04
HexEd code on github.com
I've uploaded the latest version of the HexEd code to github. You can grab it at https://github.com/apolkosnik/HexEd
2011/12/18
Goodies from Santa
With less than a week until Christmas it is the time to get a nice Christmas tree this year. With most of the school related work finished (72 hours without sleep, and taking two days off from work), I feel that I should share whatever I've produced during this crazy race with time this quarter. Shortly, I'll set up a github repository for my gifts to the public, but for now you can grab them off dev-host.org (http://dev-host.org/users/adamp/):
- HexEd - a hex editor that made me loose all that sleep. Incidentally, I intend on developing it further. (Updated with a bit cleaned up version).
- A modified version of Didier Stevens' pdf-parser that extracts media files and more
- Android MIUI ROMs for T-mobile G2x ported over from LG O2x
- HexEd - a hex editor that made me loose all that sleep. Incidentally, I intend on developing it further. (Updated with a bit cleaned up version).
- A modified version of Didier Stevens' pdf-parser that extracts media files and more
- Android MIUI ROMs for T-mobile G2x ported over from LG O2x
2010/09/29
The things that the defenders tend to forget
This is by no means a complete list nor anything that will fit into every-one's situation. I'm jotting down some things that I ran across in my experience as a security professional that, I think, would make things easier to handle scenarios when the proverbial "shit hits the fan". I merely started scratching the surface of this, and I intend to update it on a semi-regular basis. If you have something to add, please do post it in the comments.
First things first
The first and the foremost thing is to know what you must protect on your network.
Once you know, you can start gathering the threat data that is relevant to your business. Remember, you are protecting the business, so they have to talk to the business and make sure that you are not creating an unworkable environment for them. After all, they have to generate the profit that allows you to function.
Policies
Everyone has to adhere to them. The trick is to be able to use them to your advantage. Yet, keep in mind that the auditors will rip you apart for not following them to the letter. Remember what was said in the previous paragraph about the business... you cannot forget to let your users breathe.
Patience and attention to detail
Securing an environment is a continuous process, it takes time, it requires adjustments, it requires tons of dedication and attention to detail.
Compartmentalization
Design the perimeters with the knowledge of the activities and processes involved. Knowing the types of activities gives you a tactical advantage. Find commonalities, and use that to design what kind of defenses are needed for these areas. Not all areas require equal protection, and equal supervision, often times the business areas will give you push-backs because the protections might be too aggressive. Don't segment too much, it is like with the databases that were normalized too much, the key is finding the right balance.
Completeness and preparing for the worst case scenario
Once you are done with the segmentation or compartmentalization, make sure that you got all your OSI layers covered and then some by appropriate monitoring, blocking and the methods of mitigation. Ensure that the defenses that you've put in place are granular, and allow you to quickly and efficiently isolate compromised devices or applications. Make sure that you have accounted for all the ingress and egress points in your environment, and you have your taps there. Enumerate your weak spots, and determine how you can provide additional protection in those areas. Make sure that you know your security devices inside-out, it might be able to give you an edge against the intruders.
Real time software/hardware inventory, internal software repository, and hashes
You need to have a detailed knowledge of all the software in your environment. Even more, you need to know all the version and revision data. This is essential, yet mundane task. There is a hope if you can have a group to host an internal repository of all the software used, and then you can gather all the hashes of the known good files in your environment. This in turn can allow you for ad-hoc integrity testing against known good.
Changes
Configuration changes are best presented in diff output form, when it comes to teal-colored networking equipment and other devices that support textual configurations. Changes should happen inside of change management windows, unless you can make your SIEM has a ticketing system that can correlate the requested devices and requested change windows. Keep in mind that verifying what changed is also important.
Crash dumps
Programs crash for various reasons, knowing what crashed, where, when, and why will prove beneficial on that Friday afternoon, when you get hit by semi-pros.
Trust but verify
People, people tend to get sloppy. Whatever your process, make sure that you’ve done your due-diligence. Automating testing and verification goes a long way, and reduces the time wasted, and people annoyed. If you can streamline some process, it is usually worth it. make sure you QA everything. In many cases, when something goes wrong, people will try to blame it on your devices, agents, software, you name it.
Baselines
Baselining and usage patterns are many of the low-tech techniques you can leverage to search for anomalies. Sometimes you can as far as using the statistical methods such as an empirical rule to define what is normal and what is not. These methods can give you the pieces that don't fit the puzzle for free. On top, you'd be able to find design problems or bottlenecks in your environment. Your engineers will thank you later.
Hardening
Make sure that you harden the devices before they go into production or your hair will go grey early. It’s good to have some notification measures built in, e.g. when admin account is used send a notification to your system. It usually requires lots of hand holding, and testing to get it right. The goal is to closely work with the admins, to make sure that the solution actually works, and has minimal performance impact. With the hardening step, it is absolutely essential to set up all your devices to perform NTP synchronization (with keys), or else you’ll have problems with temporal chaos, that will kill your SIEM’s database.
IP pool affinity and user mobility
Investigating devices that often change IPs is hard. With rigorous inventory management, it would be possible to assign IPs based on MAC or sometimes assign them based on userid. The longer leases, the better. Unless you got some kind of smart user tracking system, some nice NAC system, or identity management. Sometimes, you’d be able to harvest access card swipe data, and determine user’s locality. Just another trail of crumbs to use to build some smart rules based on event sequencing.
Login/Logoff times
Obviously, tracking user login/logoff times with addition of the location awareness is another very good place to pick up anomalies; it adds some more meta data to your equations. How could someone be in two places at the same time?
Encrypted traffic
The fact of life is that you got encrypted traffic traversing your perimeter. There are a few things you can sometimes do about it. Sometimes you’d encounter people trying to corkscrew ssh sessions through your authenticated web proxies, or even use web shells. Sometimes, you won’t be able to do much about it. In the worst case knowing source, destination, combined size of the transferred data, and frequency will allow you to draw some conclusions.
Firewalls
There are some extra smart firewalls nowadays, that evolved beyond the industry standards. See who’s the biggest visionary, and why. Why use the tried and true, when you can get so much more for your money. Don't forget to set up something to diff the rules every 10 minutes and open a tracking ticket with the diffs.
WebProxies/Mail gateways
They allow you to AV scan content going in and out if you can use ICAP, you can even set up a Flash/PDF/ZIP/Java vault for collecting, scanning, “defusing”, and out-of-band delivering the defused content to the users. On top of that proxies can be be useful in picking up the species of malware that are not proxy aware or that can’t handle authenticated proxies.
IDS/IPS, HIDS/HIPS
Compare the threat data against the coverage your vendors provide, and try to fill in the gaps with custom signatures. Review the signature stats, remove the noisy and irrelevant signatures, tune the parameters, update to reduce false positives, wash, rinse, and repeat.
Logs
Got to have them all, no matter what they are, then have them analyzed, parsed, categorized, correlated, workflow/use-case sequenced, and one-offs reviewed.
Watching it
So, you spent some substantial part of your budget on this shiny new SIEM. You got your firewalls, netflow data, IDS/IPS devices, multiple AVs, web proxies, NAC, mail gateways, you name it, you have them all. Then you realize that all you get is a headache from data overload, false positives coming from diverse sources, and the database in your SIEM is blowing up from the data overload.
Binding it all together
Great, what do I do about all that data? Bah! You need to organize it to make any sense out of it. Divide and conquer is one of the algorithms that you can use. You also need to use the knowledge of your environment to fine tune these massive amounts of events that are worthless or not applicable.
Enter Metadata
So, you need to use metadata, that is the data about the data you are collecting.
To bring some order to the chaos, you need to establish usage patterns, apply the knowledge you have about the business processes, and other events that can cause the anomalies. You want to have all your data available in a single place. Why? Because, you'd be able to derive some conclusions from it later on, and because you'd need to have to compare it to the threat data you're constantly collecting.
Wishful thinking
Yet I have to witness a SIEM system that allows you to feed it with your threat intelligence data, whether CVEs, Bugtraq IDs, or all sorts of advisories from various vendors, and combine that with all the data derived from your different compartments, IDS/IPS signatures, HIDS signatures, AV updates, patch deployment details, and any other inventory related data. With all that at your disposal you should be able to greatly improve signal to noise ratio in your SIEM. On another level, all this data, allows you to identify any deficiencies in your defenses, as well as produce reports that provide meaningful and measurable metrics to the upper management.
First things first
The first and the foremost thing is to know what you must protect on your network.
Once you know, you can start gathering the threat data that is relevant to your business. Remember, you are protecting the business, so they have to talk to the business and make sure that you are not creating an unworkable environment for them. After all, they have to generate the profit that allows you to function.
Policies
Everyone has to adhere to them. The trick is to be able to use them to your advantage. Yet, keep in mind that the auditors will rip you apart for not following them to the letter. Remember what was said in the previous paragraph about the business... you cannot forget to let your users breathe.
Patience and attention to detail
Securing an environment is a continuous process, it takes time, it requires adjustments, it requires tons of dedication and attention to detail.
Compartmentalization
Design the perimeters with the knowledge of the activities and processes involved. Knowing the types of activities gives you a tactical advantage. Find commonalities, and use that to design what kind of defenses are needed for these areas. Not all areas require equal protection, and equal supervision, often times the business areas will give you push-backs because the protections might be too aggressive. Don't segment too much, it is like with the databases that were normalized too much, the key is finding the right balance.
Completeness and preparing for the worst case scenario
Once you are done with the segmentation or compartmentalization, make sure that you got all your OSI layers covered and then some by appropriate monitoring, blocking and the methods of mitigation. Ensure that the defenses that you've put in place are granular, and allow you to quickly and efficiently isolate compromised devices or applications. Make sure that you have accounted for all the ingress and egress points in your environment, and you have your taps there. Enumerate your weak spots, and determine how you can provide additional protection in those areas. Make sure that you know your security devices inside-out, it might be able to give you an edge against the intruders.
Real time software/hardware inventory, internal software repository, and hashes
You need to have a detailed knowledge of all the software in your environment. Even more, you need to know all the version and revision data. This is essential, yet mundane task. There is a hope if you can have a group to host an internal repository of all the software used, and then you can gather all the hashes of the known good files in your environment. This in turn can allow you for ad-hoc integrity testing against known good.
Changes
Configuration changes are best presented in diff output form, when it comes to teal-colored networking equipment and other devices that support textual configurations. Changes should happen inside of change management windows, unless you can make your SIEM has a ticketing system that can correlate the requested devices and requested change windows. Keep in mind that verifying what changed is also important.
Crash dumps
Programs crash for various reasons, knowing what crashed, where, when, and why will prove beneficial on that Friday afternoon, when you get hit by semi-pros.
Trust but verify
People, people tend to get sloppy. Whatever your process, make sure that you’ve done your due-diligence. Automating testing and verification goes a long way, and reduces the time wasted, and people annoyed. If you can streamline some process, it is usually worth it. make sure you QA everything. In many cases, when something goes wrong, people will try to blame it on your devices, agents, software, you name it.
Baselines
Baselining and usage patterns are many of the low-tech techniques you can leverage to search for anomalies. Sometimes you can as far as using the statistical methods such as an empirical rule to define what is normal and what is not. These methods can give you the pieces that don't fit the puzzle for free. On top, you'd be able to find design problems or bottlenecks in your environment. Your engineers will thank you later.
Hardening
Make sure that you harden the devices before they go into production or your hair will go grey early. It’s good to have some notification measures built in, e.g. when admin account is used send a notification to your system. It usually requires lots of hand holding, and testing to get it right. The goal is to closely work with the admins, to make sure that the solution actually works, and has minimal performance impact. With the hardening step, it is absolutely essential to set up all your devices to perform NTP synchronization (with keys), or else you’ll have problems with temporal chaos, that will kill your SIEM’s database.
IP pool affinity and user mobility
Investigating devices that often change IPs is hard. With rigorous inventory management, it would be possible to assign IPs based on MAC or sometimes assign them based on userid. The longer leases, the better. Unless you got some kind of smart user tracking system, some nice NAC system, or identity management. Sometimes, you’d be able to harvest access card swipe data, and determine user’s locality. Just another trail of crumbs to use to build some smart rules based on event sequencing.
Login/Logoff times
Obviously, tracking user login/logoff times with addition of the location awareness is another very good place to pick up anomalies; it adds some more meta data to your equations. How could someone be in two places at the same time?
Encrypted traffic
The fact of life is that you got encrypted traffic traversing your perimeter. There are a few things you can sometimes do about it. Sometimes you’d encounter people trying to corkscrew ssh sessions through your authenticated web proxies, or even use web shells. Sometimes, you won’t be able to do much about it. In the worst case knowing source, destination, combined size of the transferred data, and frequency will allow you to draw some conclusions.
Firewalls
There are some extra smart firewalls nowadays, that evolved beyond the industry standards. See who’s the biggest visionary, and why. Why use the tried and true, when you can get so much more for your money. Don't forget to set up something to diff the rules every 10 minutes and open a tracking ticket with the diffs.
WebProxies/Mail gateways
They allow you to AV scan content going in and out if you can use ICAP, you can even set up a Flash/PDF/ZIP/Java vault for collecting, scanning, “defusing”, and out-of-band delivering the defused content to the users. On top of that proxies can be be useful in picking up the species of malware that are not proxy aware or that can’t handle authenticated proxies.
IDS/IPS, HIDS/HIPS
Compare the threat data against the coverage your vendors provide, and try to fill in the gaps with custom signatures. Review the signature stats, remove the noisy and irrelevant signatures, tune the parameters, update to reduce false positives, wash, rinse, and repeat.
Logs
Got to have them all, no matter what they are, then have them analyzed, parsed, categorized, correlated, workflow/use-case sequenced, and one-offs reviewed.
Watching it
So, you spent some substantial part of your budget on this shiny new SIEM. You got your firewalls, netflow data, IDS/IPS devices, multiple AVs, web proxies, NAC, mail gateways, you name it, you have them all. Then you realize that all you get is a headache from data overload, false positives coming from diverse sources, and the database in your SIEM is blowing up from the data overload.
Binding it all together
Great, what do I do about all that data? Bah! You need to organize it to make any sense out of it. Divide and conquer is one of the algorithms that you can use. You also need to use the knowledge of your environment to fine tune these massive amounts of events that are worthless or not applicable.
Enter Metadata
So, you need to use metadata, that is the data about the data you are collecting.
To bring some order to the chaos, you need to establish usage patterns, apply the knowledge you have about the business processes, and other events that can cause the anomalies. You want to have all your data available in a single place. Why? Because, you'd be able to derive some conclusions from it later on, and because you'd need to have to compare it to the threat data you're constantly collecting.
Wishful thinking
Yet I have to witness a SIEM system that allows you to feed it with your threat intelligence data, whether CVEs, Bugtraq IDs, or all sorts of advisories from various vendors, and combine that with all the data derived from your different compartments, IDS/IPS signatures, HIDS signatures, AV updates, patch deployment details, and any other inventory related data. With all that at your disposal you should be able to greatly improve signal to noise ratio in your SIEM. On another level, all this data, allows you to identify any deficiencies in your defenses, as well as produce reports that provide meaningful and measurable metrics to the upper management.
2009/04/19
So, what's on the cover of that Verizon data breach report? part 2
Now search for word "key" in the text of the report or if you prefer to do it the hard way find a nice way to predict the key (I've done it the hard way at first).
Now plugging the key and the ciphertext from before into a vigenere decoder gives us the solution:
CONGRATSFIRSTTOCRACKGETSREWARDGOTOWWWVERIZONBUSINESSCOMSLASH
DBIRHUNTTOCLAIMFOREVERYONEELSEHIGHLVLSTATSFORFINSVCSANDRETAIL
FOLLOWPLSSHAREFINSVCSSOURCESEXTERNALNINETEENINTERNALNINEPARTNER
TWOTHREATSMALWAREELEVENHACKINGFIFTEENDECEITFOURMISUSESIXPHYSICAL
TWOERRORONEERRORSIGCONTRIBUTORINFIFTEENTOPTHREEHACKTYPESSQL
INJECTIONSEVENMISCONFIGACLSSEVENDEFAULTCREDSTWOTOPHACKVECTOR
ISWEBAPPTENTOPASSETISONLINEDATATWENTYSIXANDALLRECORDSTOPTHREED
ATATYPESAUTHCREDELEVENPIITENPYMNTCARDEIGHTPYMNTCARDWASNINETY
EIGHTPCTOFRECORDSTOPUUISUNKNOWNCONNECTIONSSEVENDISCOVERYTAKES
WEEKSTOMONTHSRETAILSOURCESEXTERNALTWENTYTHREEINTERNALONE
PARTNEREIGHTTHREATSMALWARETENHACKINGTWENTYONEDECEITTWOMISUSE
TWOPHYSICALZEROERRORZEROERRORSIGCONTRIBUTORINSIXTEENTOPTWO
HACKTYPESSQLINJECTIONSEVENSTOLENCREDSSEVENTOPHACKVECTORIS
REMACCMGTEIGHTTOPASSETISPOSELEVENANDOVERHALFOFRECORDSTOPTWO
DATATYPESPAYCARDTWENTYTHREEPIININEDISCOVERYTAKESMOSTLYMONTHS
Now plugging the key and the ciphertext from before into a vigenere decoder gives us the solution:
CONGRATSFIRSTTOCRACKGETSREWARDGOTOWWWVERIZONBUSINESSCOMSLASH
DBIRHUNTTOCLAIMFOREVERYONEELSEHIGHLVLSTATSFORFINSVCSANDRETAIL
FOLLOWPLSSHAREFINSVCSSOURCESEXTERNALNINETEENINTERNALNINEPARTNER
TWOTHREATSMALWAREELEVENHACKINGFIFTEENDECEITFOURMISUSESIXPHYSICAL
TWOERRORONEERRORSIGCONTRIBUTORINFIFTEENTOPTHREEHACKTYPESSQL
INJECTIONSEVENMISCONFIGACLSSEVENDEFAULTCREDSTWOTOPHACKVECTOR
ISWEBAPPTENTOPASSETISONLINEDATATWENTYSIXANDALLRECORDSTOPTHREED
ATATYPESAUTHCREDELEVENPIITENPYMNTCARDEIGHTPYMNTCARDWASNINETY
EIGHTPCTOFRECORDSTOPUUISUNKNOWNCONNECTIONSSEVENDISCOVERYTAKES
WEEKSTOMONTHSRETAILSOURCESEXTERNALTWENTYTHREEINTERNALONE
PARTNEREIGHTTHREATSMALWARETENHACKINGTWENTYONEDECEITTWOMISUSE
TWOPHYSICALZEROERRORZEROERRORSIGCONTRIBUTORINSIXTEENTOPTWO
HACKTYPESSQLINJECTIONSEVENSTOLENCREDSSEVENTOPHACKVECTORIS
REMACCMGTEIGHTTOPASSETISPOSELEVENANDOVERHALFOFRECORDSTOPTWO
DATATYPESPAYCARDTWENTYTHREEPIININEDISCOVERYTAKESMOSTLYMONTHS
So, what's on the cover of that Verizon data breach report? part 1
The Verizon data breach report is here.
On the front side you can see bunch of 1s and 0s... After conversion from binary to ASCII you get the following ciphertext:
EVNTXIGYIMWSNEHEIEFOTXBSCWYHRQMWGUZABVYCBBFREYFBVEDKEVMFRIFNG
FNRBFGVKSFPNBUFZJGCEEEWAKHPXEBTZJCZOWGTBSQGTMIAYDPYDRIRYETKCJR
PYHEPWKUOAEKNVTVZHSMZNTTIVIKMMRYSNUIAKBRKQMSTYCGCCRLRRIIREFGYT
JUBUXHEYSGLEYRVHIYXDEYZCJKVTOSOIXJEHOXEVMWJBNZMTKWZEFOFCNBWNC
UWMYFIUVBKWNPWTYOEYQTIRRYRCMNVFVLRSBNTPWPAOCZPEKHLFCEERRVWV
UYBVJPUVPOAYMIKQQNSWZGHZKDGYLAEGWPKESGCYZFVJDMEPQKSSLNVSVPUV
VRVYERHDTUTYYMQGEVWRMQSZFNPNRJIGGWAJNNJLKOEQHNETRPUQYDFZWCZ
KVJEXLMCKCSIFTCTSUTLDRRMIKQTNINPGRPQQXPTZDPAIOTCEUAZFEWDQLLPZR
HXLXQGSLRJTBLZRIRVISNZIWLMVYADVOHFEVNAKKGORRXSYGXPUMVGBOMRJLC
REFCMRQVXTMIYMJJVHXNBTSZMTJEFKFGKURFLNHXPKCWLEXMIYLGYNNRWAKS
EWTHPKGZKKXGAZELLUTAYCIEKWISHUNDKEKWARGBYZFGKEPKQGZZSRIMFLGKA
RTURAINSNGEEUMEXRVEELZXTISUWVZKOYLTPBHZWEOQWNXNPXPKSSXJHPANCV
FPRYADRLROEWEBQEWHZRGATZDGUCEKLFYHZJNNZIJRGNZRVBOCAUYEZGKPSJX
JIASMVFTDWFXBIDHQZEYKDRTDRIOPPKJRPISSKMCZJFZTBVBJUGEYANJIGJTDCPTZ
DEOGUTLZPEKHTNIHTGGUMVGBOMRJLCREFSWFZOCROHEAU
Ugh...
Looking back at the report, there's strange phrase at the bottom of page 48 "yr puvsser vaqrpuvssenoyr" which after quick rot13 reveals a french phrase: le chiffre indechiffrable
A quick google search for the phrase reveals a link to Vigenere cipher.
to be continued...
Once you get it solved there is a webpage that tells you what to do next:
On the front side you can see bunch of 1s and 0s... After conversion from binary to ASCII you get the following ciphertext:
EVNTXIGYIMWSNEHEIEFOTXBSCWYHRQMWGUZABVYCBBFREYFBVEDKEVMFRIFNG
FNRBFGVKSFPNBUFZJGCEEEWAKHPXEBTZJCZOWGTBSQGTMIAYDPYDRIRYETKCJR
PYHEPWKUOAEKNVTVZHSMZNTTIVIKMMRYSNUIAKBRKQMSTYCGCCRLRRIIREFGYT
JUBUXHEYSGLEYRVHIYXDEYZCJKVTOSOIXJEHOXEVMWJBNZMTKWZEFOFCNBWNC
UWMYFIUVBKWNPWTYOEYQTIRRYRCMNVFVLRSBNTPWPAOCZPEKHLFCEERRVWV
UYBVJPUVPOAYMIKQQNSWZGHZKDGYLAEGWPKESGCYZFVJDMEPQKSSLNVSVPUV
VRVYERHDTUTYYMQGEVWRMQSZFNPNRJIGGWAJNNJLKOEQHNETRPUQYDFZWCZ
KVJEXLMCKCSIFTCTSUTLDRRMIKQTNINPGRPQQXPTZDPAIOTCEUAZFEWDQLLPZR
HXLXQGSLRJTBLZRIRVISNZIWLMVYADVOHFEVNAKKGORRXSYGXPUMVGBOMRJLC
REFCMRQVXTMIYMJJVHXNBTSZMTJEFKFGKURFLNHXPKCWLEXMIYLGYNNRWAKS
EWTHPKGZKKXGAZELLUTAYCIEKWISHUNDKEKWARGBYZFGKEPKQGZZSRIMFLGKA
RTURAINSNGEEUMEXRVEELZXTISUWVZKOYLTPBHZWEOQWNXNPXPKSSXJHPANCV
FPRYADRLROEWEBQEWHZRGATZDGUCEKLFYHZJNNZIJRGNZRVBOCAUYEZGKPSJX
JIASMVFTDWFXBIDHQZEYKDRTDRIOPPKJRPISSKMCZJFZTBVBJUGEYANJIGJTDCPTZ
DEOGUTLZPEKHTNIHTGGUMVGBOMRJLCREFSWFZOCROHEAU
Ugh...
Looking back at the report, there's strange phrase at the bottom of page 48 "yr puvsser vaqrpuvssenoyr" which after quick rot13 reveals a french phrase: le chiffre indechiffrable
A quick google search for the phrase reveals a link to Vigenere cipher.
to be continued...
Once you get it solved there is a webpage that tells you what to do next:
Subscribe to:
Posts (Atom)