Case 08 → Caught a Runner’s High 😶‍🌫️

Background: Krypto got away again and is hiding in plain sight in Barcelona.

Mission: Pinpoint where Krypto starts his runs.

For all the marbles: Where can we catch the suspect?


What we know:

  • Krypto runs 3-4 times a week.
  • Krypto hits 8-12km on every run.
  • The agents deciphered half of the required 16 numbers of the full Barcelona city code.

Let’s first attempt to find the full city code. We use the hints in the training to look through the famous places in the city especially the Sagrada Familia Passion and Nativity facade:

Oh, what is that I see?

A grid I see!

The grid fits perfectly into the half done numbers. Let’s decrypt!

Listen up, esteemed members of Kuanda, for we have encountered a slight hiccup in our grand scheme.
I can sense your concern, as rumors of our true intentions have reached the ears of the KDA.
But fear not, my loyal comrades, for we shall not waver from our path! If anything, we shall intensify our efforts until the KDA crumbles beneath our feet.
I cannot share too much at this time, but rest assured, we are running our "smoke tests", both figuratively and quite literally.
They shall expose the KDA's weaknesses and herald its epic downfall.

Now, let us address the matter of my well-being. I understand that there is a great deal of curiosity regarding my safety. 
Let me assure you, it was all a matter of impeccable timing. No doubt my connecting flight was an experience of a lifetime!
Too bad my luggage failed to join me on this thrilling journey! :)

But fear not, my friends, leaving things to chance is not my style. I have assembled a team of loyal bodyguards,
who move with me like elusive phantoms, ensuring my invincibility. At any given time, at least two of them discreetly
shadow my every move, even during my exhilarating runs through the city. Truly, I feel untouchable. And let me tell you,
this city is a hidden gem! It offers an abundance of marvelous spots where one can indulge in a refreshing shake after
conquering a breathtaking 10K run. It is a perfect blend of mischief and rejuvenation, a delightful concoction that fuels my strength.

So, my fellow rogues, let us keep our eyes fixed on the target. I will reveal more details about our plans in due time. 
Prepare yourselves to witness the spectacular downfall of the KDA, as we relentlessly drill into its core at full speed!
 
Krypto

From the decrypted text we find that Krypto has at least two bodyguards following him during his runs.


We dig through the data.

Runs
| where Distance between (8 .. 10)
| extend week_start = startofweek(Timestamp)
| summarize runsperweek = count() by week_start, RunnerID
| where runsperweek between (3 .. 4)
| distinct RunnerID

These are the runners who fit the profile we are looking for.

Now we need to filter further to runners who run together (starting at the same place, at the same time):

Stumbled on and learnt about H3 here → [Uber H3](H3: Uber’s Hexagonal Hierarchical Spatial Index | Uber Blog)

More about S2 cell → Google’s S2, geometry on the sphere, cells and Hilbert curve | Terra Incognita (christianperone.com)

Runs
| where Distance between (8 .. 12)
| extend start_week = startofweek(Timestamp)
| summarize count() by start_week, RunnerID
| where count_ between (3 .. 4)
| distinct RunnerID
| join kind=rightouter (
    Runs
    | extend cell = geo_point_to_h3cell(StartLon, StartLat, 11)
    | summarize make_set(RunnerID) by cell, startofday(Timestamp)
    | where array_length(set_RunnerID) >= 3
    | extend set_RunnerID=tostring(set_RunnerID)
    | summarize count() by set_RunnerID
    | where count_ > 2
    | mv-expand todynamic(set_RunnerID)
    | extend RunnerID=tostring(set_RunnerID)
    | distinct RunnerID
    ) on $left.RunnerID == $right.RunnerID
| project RunnerID
) on RunnerID
| distinct round(StartLat, 5), round(StartLon, 5)
| extend url = strcat('https://www.google.com/maps/@', StartLat, ',', StartLon, ',3a,75y,252.01h,89.45t/data=!3m6!1e1!3m4!1s-1P!2e0!7i16384!8i8192')

Untitled

Untitled

Appendix

I came across a wonderful blog article with a unique solution of using scan to get groups of runners who run from the same place at around the same time.

Season 2 Case 8 - Catchy Run | Liesel’s Tech Ramblings Blog (lieselhughes.com)

SHCTF23: Veiled Dimensions

Case 07 → Da Vinci’s Birds 🛩️

comments powered by Disqus