GCHQ Code Breaking Challenge Solved Through Googling

Outsmart Malicious Hackers


This is quite an amusing story, I’m sure many of you have read about the ‘hacking challenge’ set up by GCHQ and that they are looking to hire hackers cyber-security specialists through non-traditional channels.

The thing that tickled me was, well there were two things actually..one that the challenge site was coded in ASP and the second was that you could avoid the whole cracking thing and find the solution page via Google by using the site: operand (O HAI).

Ok and another…the .css files aren’t absolute and don’t work outside of the home directory. I’m not surprised they are only paying £25,446 if this is the kind of talent they are hiring.

The GCHQ-set code-breaking puzzle was solved over the weekend.

The signals intelligence agency last week set a puzzle at canyoucrackit.co.uk in its attempt to unearth potential recruits beyond its traditional graduate programme. Late last week it emerged that the successful completion page for the puzzle was available by a simple Google search.

Many people have since cracked the code properly including Dr Gareth Owen, a computer scientist and senior lecturer at the University of Greenwich in England. Owen has posted a full video explanation of how to solve the three-part puzzle here.

Would-be code-breakers were presented with a 16×10 grid of paired hexadecimal numbers. The first stage involves recognising executable code as well as unpicking some steganography.

Stage two involves developing a virtual machine to execute code.

The challenge itself isn’t too bad, but it’s rather narrow in it’s scope – if you’re a x86 assembly kind of dude – you’ll be fine. If that aint your bag, you might struggle a bit with this – honestly it doesn’t fill me with hope for the future of the talent pool in GCHQ.

All negativity aside I personally applaud them for trying to do something different and trying to hire through different channels, it may well turn up some talent they wouldn’t normally be able to hire.


The final stage involves constructing a file with ‘gchqcyberwinAAAABBBBCCCC’ where A, B, C are the codes from earlier in the challenge. This code, when run, generates a web address which has the keyword (the web address is wrong if you put the wrong a,b,c in).

“The last stage contains a deliberate security hole, which GCHQ emailed me to say was deliberate to make solving the problem easier – but it turns out I took a short cut instead and bypassed this bit,” Owen explained.

Reaching the successful completion page was a “rather disappointing end to quite a lot of work,” as he puts it.

GCHQ is offering would/be applicants who crack the code a starting salary of just £25k, very low for a skilled job, as the Daily Telegraph notes.

Owen summed up the feelings of many when he told El Reg: “Why are we paying world-class cyber security experts what we pay passport-stampers at the border-control-agency?”

Anyway if you want to go directly to the job application, it’s here:

CYBER SECURITY SPECIALIST

Closing date for applications is 12 December 2011, so you’ve still got a little bit of time if you’re itching to earn £25K a year.

Source: The Register

Posted in: Legal Issues, Privacy


Latest Posts:


DAST vs SAST - Dynamic Application Security Testing vs Static DAST vs SAST – Dynamic Application Security Testing vs Static
In security testing, much like most things technical there are two very contrary methods, Dynamic Application Security Testing or DAST and Static or SAST.
Cr3dOv3r - Credential Reuse Attack Tool Cr3dOv3r – Credential Reuse Attack Tool
Cr3dOv3r is a fairly simple Python-based set of functions that carry out the prelimary work as a credential reuse attack tool.
Mr.SIP - SIP Attack And Audit Tool Mr.SIP – SIP Attack And Audit Tool
Mr.SIP was developed in Python as a SIP Attack and audit tool which can emulate SIP-based attacks. Originally it was developed to be used in academic work.
Uber Paid Hacker To Hide 57 Million User Data Breach Uber Paid Hackers To Hide 57 Million User Data Breach
Uber is not known for it's high level of ethics, but it turns out Uber paid hackers to not go public with the fact they'd breached 57 Million accounts.
RDPY - RDP Security Tool For Hacking Remote Desktop Protocol RDPY – RDP Security Tool For Hacking Remote Desktop Protocol
RDPY is an RDP Security Tool in Twisted Python with RDP Man in the Middle proxy support which can record sessions and Honeypot functionality.
Terabytes Of US Military Social Media Spying S3 Data Exposed Terabytes Of US Military Social Media Spying S3 Data Exposed
Once again the old, default Amazon AWS S3 settings are catching people out, the US Military has left terabytes of social media spying S3 data exposed.


10 Responses to GCHQ Code Breaking Challenge Solved Through Googling

  1. -jack spicer- December 6, 2011 at 10:40 am #

    man…thats a low paygrade….not easily digetable…u’ve gotta say something has to be worth it…

  2. Yussi December 6, 2011 at 3:04 pm #

    That was disappointing…
    Having spent 2 hours trying to make sense of the number grid, running Caesar cypher on it, dumping it as strings gave the only readable text as something like x=AAAA, Cx=BBBB, trying to do complex matrix operations etc. the thing is, i started by looking at it as an assembler bytecode, but it didn’t look right as the first instruction skips 6 lines, doesn’t really look like a legit program. the only clue about it being assembler was a mov 0xDEADBEEF instruction. Not that i would work at GCHQ, but i would love working at solving puzzles. Oh well, I guess I’m not one of those 25k Britain’s finest!

  3. cyber1 December 7, 2011 at 4:41 pm #

    The “soyoudidit” link was not found on google before the solution was posted on a public blog. They have disallow in their robots.txt so GCHQ did not do anything wrong. Google was just indexing a private blog.

  4. Charles Meaden December 9, 2011 at 12:54 pm #

    As one of the guys who uncovered the simple Google hack last week on our blog

    http://www.alwaysbetesting.co.uk/seo/how-to-crack-the-gchq-code-breaking-competition-using-google/

    I can confirm that last Thursday night at 9pm when we wrote the blog post there was no robots.txt file in place.

    I’d suggest that this was added later once they were suitably embarrassed

    • cyber1 December 9, 2011 at 7:05 pm #

      Actually the robots.txt does not matter if the there is no link to the hidden page from the public site. Googles spiders do not use bruteforce to find hidden links :) it’s only crawling the links that it finds thru the public site. You’re wrong in this case, the “soyoudidit” was not available on Google before is was posted on another page.

      By the way, using Google Analytics on a page is absolutely not recommended if you care about privacy or anonymity.

  5. opsec December 10, 2011 at 8:44 pm #

    I love google, try this one on for size, then reflect that if its so god damned confidential why the hell do they hire idiots who put it up where it can get indexed by a robot.

    Search: “NOT FOR DISTRIBUTION” classified inurl:”armedservices”

    Worthwhile reading material about USCYBERCOM “Sorry what was the Budget Quote?” OMFG a load of marines all armed with Windows XP it wont be vista because vista hasnt been out for 8 years which would be the length of time to be approved. OMG cyber warriors with Windows XP.. phear!

  6. opsec December 11, 2011 at 11:02 am #

    We all love the intelligence community it’s just a sad fact of life we’re still waiting to see any, intelligence that is.

    Graduate Level: We are looking for graduates with a minimum 2:1 degree in a STEM related subject (Science, Technology, Engineering and Mathematics), preferably with a significant IT component.

    Experienced: We are looking for people with specialist knowledge, professional qualifications and/or practical experience gained in a formal or informal setting.

    Yeah, because every hacker worth there salt has a Degree in Maths!

  7. opsec December 11, 2011 at 11:40 am #

    Alan Turing had a Maths Degree && a lot of good it did him working for the intelligence community, look him up and then read about how he died. He poisoned himself with Cyanide, not the intelligence community saw him as a liability and assassinated him.

  8. Bogwitch December 15, 2011 at 12:50 am #

    The puzzle itself was quite convoluted and required a knowledge of assembler rather than cryptography, not impossible and yes, a little disappointing.

    The 25k pay scale was no surprise to me, I have said for many years that civil/crown servants are underpaid and it explains quite clearly why CESG are haemorrhaging staff faster than they can recruit them, most of whom end up back at CESG as contractors on double their pay (but less pension) Don’t forget that although they are contractors, they are employed by companies that provide their services into CESG and charge considerably more, usually in the region of £850-£1000 per day. Still, at least the politicians can say they’ve reduced the civil servant count!