The Magnet Capture The Flag event was held from February 27th to March 7th as part of their Virtual Summit. The CTF questions were divided into three groups, iOS, Android & Ciphers. This challenge will be solved with ArtiFast (Full Version). This is part 1 of 3 the iOS section of the challenge.
Q: On what date did Rocco and Chadwick first meet in person according to their conversations? YYYY-MM-DD format.
According the iOS SMS they met on 2023-12-17. The first highlighted message in red shows his first introduction, the second shows them making plans and the third confirms their meeting.
Q: What subreddit was visited in a browser?
The answer is Twitch. iOS Safari History shows he visited https://www.reddit.com/r/Twitch/comments/ejqcof/good_equipment_for_starting_out_streaming_within/?rdt=39130 titled Good equipment for starting out streaming within my budget? (~$600) : r/Twitch
Q: Chad seemed to be searching for pain relief medicine in a store, how much did it cost?
In iOS Safari Recent Web Searches, 2 searches that happened barely 2 minutes apart standout, “How to avoid bruising” and “where to get arnica”. Arnica is a medication used for pain relief. The hint indicates the answer should be an image. Checking iPhone images for the date the search occurs, which is 2023-12-18, leads to the image of Arnica at a store sold at the answer $10.99
Q: How many total words were typed on the device?
The answer is 1814. The salt hint probably refers to the salt4n6 blog that talks about data relating to iOS Keyboard. The total number of typed words can be found in /private/var/mobile/Library/Keyboard/user_model_database.sqlite.
Q: What is the guild ID of the discord server Chad was in?
136986169563938816
Q: At what time did Chadwick get annoyed at MYAI? YYYY-MM-DD HH:MM:SS UTC. 24 hour formatted timestamp
The answer is 2023-12-26 23:27:45. A search of the word MYAI shows a message sent via snapchat by a ChatBot called MyAI. Filtering the snapchat chat messages to see those of the same Conversaion ID, we find that Chadwick sent the message “I thought u were cool with the Avs but now you’re getting on my nerves” at the time.
Q: What is the current build version?
The build version is 20F75 can be found under iOS Software Information artifact
Q: How many days did it take Chad to be warned about his Data Usage?
We see the welcome message sent by Boost Mobile at 11/29/2023 17:40:02 and the Data Usage warning was sent on 12/17/2023 00:27:48. It took 18 days for Chad to be warned.
Q: What is the name of Chad's streaming channel?
ChadwickGames. It is parsed as a user on iOS Discord Users. Searching for the name on twitch and youtube, returned results on youtube.
Q: What question did Chadwick ask to AI?
A text search of the term “ai” returns results that indicate chatGPT was installed on the device. To find the question, going through the Snapshots under the application data reveals the answer “How to make online friends”
Q: How many kills did Chad have on his CoD Mobile winning game?
7 Kills. The video is posted on his youtube channel
Q: What outdoor activity store did Chadwick Visit?
Neptune Mountaineering. One of the coordinates in iOS Routined Granular Location returns the location of the store, and we can also see from Apple Biome WiFi that he connected to their network.
Q: How many steps did Chad take on 12/3/2023?
Adding the entries of that date in iOS Health Steps yields the answer 968
Q: What Tattoo shop was visited on 12/27/2023?
Checking location related artifacts for the above date, we find that he spent some time in the same area of Boulder, CO 80305. We can see below an image from his device of a cafe in the area, close by is a tattoo place called “Auspicious Tattoo”.
Q: What was the final score of the hockey game Chad went to? (home-away)
Chadwick chatted about the NHL game in his chat with MyAI on Snapchat. The final score was 6-4.
Q: What is the content of the 2nd message that Chad deleted on Dec 18, 2023
In iOS SMS there are 2 messages sent on the 18th but the text fields are emtpty, checking Apple Biome Application Intents (SMS) we can find their contents. The second one starts with “Excuse moi?”. Given the hint above, the answer is “Excuse me?! That's quite a bold statement considering I'm the one who walked away with a black eye and spent $30 last night on products to avoid one!”.
Q: What is the 16 character carrier code?
310240_GID1-6432. The answer is found under iOS Cellular Wireless Information.
Q: When did chad last login to Facebook? YYYY-MM-DD HH:MM:SS UTC
2023-12-27 21:34:55. Checking the facebook data folder, we find the answer in the most recent time_in_app_xxxxxxx.db file within the metadata table.
Q: What game was Chad asking to know the strategy to?
The hint Kelp suggests the game has something to do with the vegetable. Checking the games on the device under iOS Apps iTunes Bundle Metadata artifact, we find the game “Terrarium: Garden Idle”
Q: What is the timestamp of the message Chad sent to Rocco but was never received? YYYY-MM-DD HH:MM:SS UTC
The last text message from Chad to Rocco was sent on 2023-12-21 06:29:36 the entry shows confirmation that it was sent but not delivered and the message is nowhere to be found in the messages database of Rocco’s Android device.
Q: How many times did Chad's keyboard become visible within the Amazon app on 12/24/2023?
The answer is 2. Under iOS Biome Text Input Sessions artifact if we filter with the keyword “amazon” we see that a text input session was detected twice that same day.
Q: What message was sent to Rocco in a video game?
I know youre reading my messages. It was found in the call of duty application data folder called "ChatCache".
Q: What is the ChatGPT userID associated with chadwickmr95@gmail.com
The answer is user-xurgQ0xumvrujH5ESG17Yhcw. Looking through the ChatGPT data folder, its preferences folder would most probably hold that information. The file com.openai.chat.StatsigService.plist held the information. The user ID can also be found in the applications Cache.db
Q: What was the name of the first emoji that was sent to Susan?
The first emoji sent to Susan was a Potted Plant.