Zanzibar Whisper

The brief

A mysterious image from the shores of Zanzibar has surfaced. Locals say it carries a hidden message, a whisper from the Spice Island. Can you uncover its secret?

• zanzibar-whisper.zip, 141 KB

In short

A single JPEG from Zanzibar carried a steghide payload. The payload was encrypted, but its passphrase was empty, so the flag came out in under half a minute.

A photo with a clean surface

The zip holds one JPEG, 1024 by 683 pixels. It has no metadata beyond a plain JFIF header, no comment, and nothing after the end of image marker. Whatever is hidden sits inside the image data.

Three ways to hide data in a JPEG

The lab checked the three common schemes in one pass. One reads a hidden length of 57,782 bytes where only 18,851 fit, so it holds nothing. One finds no data at all. Steghide, asked with an empty passphrase, answers.

Encrypted, with nothing as the key

Steghide spreads data over the image's compressed coefficients and encrypts it with a key made from the passphrase. Here there is room for 6.4 KB and one 28 byte file, Rijndael 128 in CBC mode, compressed. The key was made from nothing.

Flag out in under half a minute

Extracting wrote zanzibar_flag2.txt, 28 bytes, the flag and a line break. A second extraction gave the same bytes. The whole solve took under half a minute.

The insight

Encryption is only as strong as its passphrase. An empty one makes the cipher decoration, because anyone who asks with nothing gets everything.

The flag

hiCTF{sp1c3_1sl4nd_s3cr3ts}