Neoquest 2018: Find Ichthyander

Recently ended another NeoQuest . Under kat analysis of the third task relating to the OSINT area .
Anyone interested in steganography and searching for information about a person, welcome to cat.

The text of the task contains a link to a special form, correctly filling in which, you can get the key:

We begin to search for information. All we know is nickname andr_ihtiandr . Let's try to see the profile of a person with such a nickname in the most obvious database of personal data - Vkontakte: https://vk.com/andr_ihtiandr . Such a profile really exists and a lot of interesting information is found there, for example, such a picture:

Here is the first parameter to get the key. The organization where andr_ihtiandr works is AtlanticNeoSecurity .

Information “About Me” also attracts attention:

If you want to write to me, you should know that I use only encrypted messenger.
And sometimes I write interesting things on text storage site =)

Encrypted messenger is obviously Telegram. User @andr_ihtiandr was found in him , he did not respond to the invitation to chat :) But in his profile, another interesting picture was found:

The picture shows the logo of the famous ask.fm question and answer service. And of course, it reveals a profile of the mysterious ichthyander: https://ask.fm/andr_ihtiandr . Scrolling through the list of questions, we see another parameter needed to obtain the key. The surname of the founder turned out to be Nobody .

Back to the data from Vkontakte. Ichthyander reports that it writes interesting things on text storage site. The most famous representative of such services is Pastebin. We study the user profile with the nickname andr_ihtiandr: https://pastebin.com/u/andr_ihtiandr and find the only entry https://pastebin.com/fifeAE1q . The record contains a picture encoded in Base64:

Here it is worth recalling the simplest method of steganography , when the rar archive is hidden inside the jpg image. The picture was really successfully opened by the archiver. The resulting archive contained a text file with a hint:

Ok, you found the image. It shows one story about Atlantis.
What is next?
What exactly do you need from this story? Look inside!

and a strange picture:

Look inside so look inside. We open the picture in the notebook and after the jpeg container we find another clue:



We need to find some year, this will be the year the company was founded, which is the next parameter to get the key.

Next, we’ll be able to search through pictures on Google. It turns out that the strange blue picture is connected with the news that in 2009, thanks to Google Ocean, the remains of Atlantis were allegedly found. Bingo! Year of foundation of the company - 2009.

The last step of the assignment is to find a photograph of the one who hid in an almost black and white picture. We return to the profile of ichthyander Vkontakte. There is just a suitable photo:

It would seem nothing unusual, but if you look closely, you can see that the letters of some signs are highlighted in yellow:

Well, ok, so you need to upload a photo of a cat into the form. For example, from Wikipedia .



The key is received!