NPST 09. Kronolokalisering: shadow geolocation OSINT

Task description

Gjennom et beslag har vi fått tak i et papirark. På den ene siden står det “Oppmøtested for den topphemmelige sydpolinfiltrasjonen 2023, rekognosering 23. november”. På den andre siden av arket er det et bilde. For å kunne hente inn overvåkingsbilder og identifisere hvem som har planlagt arrangementet trenger vi det nøyaktige tidspunktet bildet er tatt.

Send meg svar på denne eposten som KRIPOS{tidspunkt}, f.eks. KRIPOS{23:35}, rundet av til nærmeste fem minutter.

- Mellomleder

bilde.jpeg

Notes

At first I wasn’t sure what this challenge was really about. I uploaded the image to aperisolve.fr to see if any exif data revealed the timestamp the image was captured. The only thing exif data told me was that the image was uploaded to supabase (NPST backend) at 11:00 UTC time (which is not useful).

It was only after searching for what “kronolokalisering” / “chronolocation” meant that I understood what I had to do: https://duckduckgo.com/?q=chronolocation&ia=web. The first result is “Using the Sun and the Shadows for Geolocation - bellingcat”. So, by using the shadows cast by the sun we should be able to find the correct timestamp rounded to the closest 5 minutes.

Solution

We should first figure out where this picture is taken to determine the cardinal direction of the shadows/sun. Google’s reverse image search reveals that it is the Europol building in The Hague, Netherlands. Here’s a more high resolution image of the same building from the same angle:

wikimedia-europol-building.jpg

Here’s the building on a map:

Here’s approximately where the image was taken from:

Map showing the approximate spot the photo was taken from

With this information we can determine the camera was facing NNW (north-north-west) when capturing the image. We also see that the shadows in the original image are cast towards the north. In the task description we get a very important piece of information: the day the image was taken, which is “23. november” (2023).

With shademap I can display what the shadows looked like on that day at any time of day.

https://shademap.app/@52.09303,4.28189,18.54544z,1700742500921t,-18.79675b,62.58971p,0m

By simulating the shadows at some timestamps with the site above, I can determine that the time the picture was taken is between 13:00 and 14:00. After a few attempts I get the correct flag.

Flag: KRIPOS{13:20}