OSINT Challenge: Gralhix Challenge 005

This blog will focus on solving an OSINT (Open-Source Intelligence) challenge put out by Sofia Santos (“Gralhix”), a very skilled OSINT practitioner and contributor at the Center for Information Resilience (CIR). CIR is a non-profit organization focused on combating human rights abuses. Gralhix posts OSINT challenges of varying difficulty on her website and then provides walkthroughs on her YouTube channel.

Also, I wrote a previous blog post on OSINT/GEOINT challenges – if you find this interesting, see if you can crack that one with me too!

Gralhix Challenge 005

For this blog post, I did not watch the walkthrough beforehand, but attempted the challenge without any preconceptions. The following writeup is the process I used to solve it.

The task in question is Challenge 005, which is rated Medium-Hard for beginners, Easy-Medium for Experts. The task is an IMINT/GEOINT style challenge involving examining a reference image and discovering specific information about it.

The photo in question is of two polar bears in an enclosure:

Two bears lie in their zoo enclosure, white oak security experts locate the zoo, pinpoint the temperature, and coordinates of the bears themselves as part off the gralhix hack challenge 005.

The task consists of three parts:

Identify the zoo where the bears are located.
What was the temperature at the time of the photo?
What are the exact coordinates of where the bears are lying?

We’re also given some additional information, such as when the photo was taken: “January 15, 2023 at around 2pm local time” and that the image is a still from a zoo live cam.

Breaking down the information we have, we know:

The image was taken from a zoo live camera
The zoo has polar bears (which is likely a much rarer instance than a regular bear, limiting candidate institutions)
The climate is warm, given the greenery in the image and the fact that the image was taken from a live camera in January with a lack of snow or ice
There are distinctive structures in the image which can help us identify the location if we are able to collect candidates

Challenge 005 Location

A Google image search for “polar bear zoo cam” results in a number of images, one of which has similar structural materials to our candidate bear enclosure:

Google search of two bears in a zoo, white oak security provides an arrow at one of the images that looks close to the reference photo.

The zoo mentioned in the Google Image preview is the San Diego Zoo. Further image searches for this zoo result in a very similar-looking enclosure:

Another polar bear in zoo cam google search image similar to our challenge reference photo. Screen shot has an arrow to the image, provided by white oak security.

Given that San Diego is in a warm state in the US (California), this aligns with our established information about the image.

If we take a look at the website for the San Diego Zoo “Polar Cam” we notice that the camera rotates through a set of locations and is not currently on the bears themselves. However, we do notice the exact same icon as in our reference image, which is an excellent sign we’re on the right track:

look at the website for the San Diego Zoo "Polar Cam" we notice that the camera rotates through a set of locations and is not currently on the bears themselves. However, we do notice the exact same icon as in our reference image, which is an excellent sign we're on the right track: Arrow provided on screenshot by white oak security.

After viewing the cam for a while, we can see the same structures as shown in our reference image, confirming that this is indeed the same zoo and polar bear enclosure:

we can see the same structures as shown in our reference image, confirming that this is indeed the same zoo and polar bear enclosure: white oak security shared screenshot

At this point we have answered the first part of the task and determined that the zoo is the San Diego Zoo.

Challenge 005 Temperature

Our next step is to identify the temperature at the time of the photo. To do this, we can use the Weather Underground website.

This will allow us to search for historical temperature records for a specific location, in this case via zip code. First, we’ll find the zip code of the San Diego Zoo itself:

White oak security’s Google search screenshot of the San Diego zoo zip code for the gralhix challenge 005

Next, we’ll search in Weather Underground for historical temperature data for the specific date we have for our reference image:

White oak security’s weather underground screenshot of historical temperature data for specific dates in zip code we found.

This provides us with an hourly breakdown of temperatures for the location, indicating that the temperature at the time of the photo was 63F:

White oak security’s weather underground screenshot of historical temperature data for specific dates in zip code we found with arrow that shows 63°F.

At this point, we’ve solved the first two parts of our task. Now we need to find the exact location of where the bears are lying in the photo.

Challenge 005 Coordinates

To do this, we’ll use the Google Earth Pro software application. But first, we’ll want to discover where exactly within the zoo the polar bear exhibit is located. Most zoos have public maps of their facilities; the San Diego Zoo is no exception. On their website, they have a link to a PDF of the map brochure used at the zoo:

White oak security screenshot of the zoo’s map pdf

Zooming in on the map, we can see the location of the polar bear exhibit (at the top of the image) as well as two unique-looking aviary buildings which will be useful to identify the location on satellite imagery:

White oak security’s screenshot of the zoo’s map pdf with arrow to the polar bear enclosure

Searching in the Google Earth Pro application for “San Diego Zoo”, we can see the overview of the zoo itself. However, we need to orient our view to match that of the zoo map we recovered earlier. To do so, we’ll identify the aviary buildings we saw on the map and rotate the view to match that of the map:

White oak security’s screen grab of Google maps San Diego zoo with arrow to the polar bear enclosure.

We can then zoom in on the polar bear exhibit and examine the overall configuration of the enclosure. To further confirm our findings and take a look at the scene from a ground-level perspective we can utilize Street View:

White oak security’s screen grab of zoomed in Google maps San Diego zoo with arrow to the polar bear enclosure to navigate the foot paths and utilizing street view.

By navigating the footpaths within the enclosure area using Street View, we can see what the enclosure area looks like and confirm that it is indeed the same location as in the reference image. We can see what appears to be similar major structures shown in the reference; the large pillar to the left, the central lean-to, and the stone slab in the far rear of the image:

White oak security’s screen grab of Google maps street view foot paths of San Diego polar bear enclosure with arrow to the polar bear enclosure’s structures.

However, it’s difficult to tell which of these align with the structures in the reference. Additionally, in the Google Earth view, there are canopies which occlude the enclosure and the resolution of the 3D model is not sufficient to differentiate such small structures. Let’s try Google Maps to see if it will improve the result:

White oak security’s screen grab of Google maps arial view of San Diego polar bear enclosure

Not really. The resolution is pretty poor in this area and the structures are not immediately obvious. However, by going back and looking at the live cam, we discover another clue:

One of the live cam screenshots of the polar bear enclosure shows a clue! White oak security adds a arrow to the background person

There is a pedestrian walking behind the bears in the back of the camera scene, fairly close by. This rules out the possibility of the structures in our reference photo being on the left side of the enclosure (as viewed from the glass visitor area). It would need to be on the rightmost side of the enclosure, near the outer wall. Looking back at Google Maps, we can identify several features from the image now that we know the general area to look:

Google maps screenshot has 3 arrows from white oak security pointing to the fallen tree stump, the lean to, and the rock structure

In the above image, we can see the standing dead tree on the left, the fallen tree stump on the top-right and the lean-to structure at the bottom.

Comparing these to our reference image, we can determine that the polar bears are between the standing dead tree and the corner where the platform changes direction closest to the camera. If we compare that to the Google Maps imagery, we can see the exact location:

Two pictures of the polar bear enclosure point to the fall tree stump from two perspectives google maps and the zoos camera provided by white oak security penetration testing company we now know the polar bear coordinates

Right-clicking and copying the coordinates results in the answer to the third part of our task: 32.734447845419396, -117.1545958670987

Challenge 005 Conclusion

After completing my investigation, I reviewed Gralhix’s solution video to confirm my results. The investigation steps were similar for both the first stage and the second. She came up with 62°F as her final answer for the second part; I had 63F. This seems to be the result of her using the graph view at Weather Underground, whereas I used the time listing view which had a close (but not entirely accurate) time of 1:51 pm for sampling. This constitutes a lack of precision on my part.

Additionally, her final location for the bears was slightly different than mine. She identified a location slightly north of the one I selected. I’m unsure in this case which is more accurate, although, according to the distance scale from Google Maps, the difference would be less than 10 feet, which I feel is an acceptable margin of error.

I hope this exercise was interesting and gave a useful process for OSINT investigation. I highly recommend watching Gralhix’s YouTube videos on OSINT investigations to learn more or stay tuned for more pentesting challenge walkthroughs.

Oct 11, 2024 12:55:06 PM | Hack challenge OSINT Challenge: Gralhix Challenge 005