Neoquest 2018: “Find Ichthyandra”

Recently ended the next NeoQuest . Under the cut analysis of the third task relating to the field of OSINT .
All who are interested in steganography and search for information about a person, welcome under cat.

The text of the task contains a link to a special form, correctly filling out which, you can get the key:

Begin to look for information. All we know is the nickname andr_ihtiandr . Let's try to see the profile of a person with such a nickname in the most obvious database of personal data - Vkontakte: https://vk.com/andr_ihtiandr . Such a profile really exists and many interesting information is found there, for example, such a picture:

Here is the first parameter to get the key. The organization in which andr_ihtiandr works is AtlanticNeoSecurity .

Also attracted the attention of information "About":

I only use encrypted messenger.
And sometimes I write interesting things on text storage site =)

Encrypted messenger is obviously Telegram. There was a user @andr_ihtiandr in it, he did not react to the invitation to talk :) But in his profile one more interesting picture was found:

The picture has the logo of the known ask.fm question and answer service. And of course it reveals the profile of the mysterious ichthyander: https://ask.fm/andr_ihtiandr . Scrolling through the list of questions, we see one more parameter needed to get the key. The name of the founder was Nobody .

Let's return to the data from Vkontakte. Ichthyander reports that he writes interesting things on text storage site. The most famous representative of such services is Pastebin. We study the user profile with the nickname andr_ihtiandr: https://pastebin.com/u/andr_ihtiandr and find the only entry https://pastebin.com/fifeAE1q . The entry contains a picture encoded in Base64:

Here it is worth remembering the simplest method of steganography , when inside the jpg images hide the rar archive. The picture really successfully opened by the archiver. The resulting archive contained a text file with a hint:

Ok, you found the image. It shows one story about Atlantis.
What is next?
What exactly do you need from this story? Look inside!

and a strange picture:


')

Look inside so look inside. Open the image in the notebook and after the jpeg container we find the next hint:



You need to find a year, it will be the year the company was founded, which is another parameter for getting the key.

Next will help us search for images on Google. It turns out that the strange blue picture is connected with the news that in 2009, thanks to Google Ocean, the remains of Atlantis were allegedly found. Bingo! Year of foundation of the company - 2009.

The last step of the task is to find a photo of someone who hid in an almost black and white picture. We return to the profile of Ikhtiandra Vkontakte. There just is a suitable picture:

It would seem nothing unusual, but if you look closely, you will notice that the letters of some signs are highlighted in yellow:

Well, ok, then you need to upload a photo of a cat into the form. For example, from wikipedia .



Key received!