Completely Normal Picture

Task description

Ana decided to combine two of her great loves, the film The Da Vinci Code and steganography, by hiding some useful information inside a picture. Don’t worry, you won’t need to know anything about the film to solve this task, but knowing about steganography will help!

The original was in Croatian; this is my translation.

The picture

The task gives slika.png: the logo of CERT.hr, the national computer emergency response team that ran the competition, on a white band between two mustard-yellow stripes. It really does look completely normal.

How computers store colour

Each pixel in an image is stored as three numbers: how much red, green and blue light it has, each from 0 to 255. Pure white is 255, 255, 255 and pure black is 0, 0, 0.

Two colours a couple of steps apart look identical to the eye. Checking the white band pixel by pixel shows it isn’t all pure white. Some pixels are 253, 253, 253, and together they form text. That’s less than a 1% difference, so the text is effectively invisible. It’s also drawn behind the logo, so the logo’s letters cover parts of it.

Making it visible

The team opened the image in Photoshop and filled the visible areas with strong colours, so anything that didn’t get filled stood out. Any image editor can do the same with less effort:

• Use a paint bucket or magic wand with the tolerance set to 0 on the white area. Only the exact 255, 255, 255 pixels get selected, and the 253 ones show up as the gap in the selection.
• Or push the contrast up as far as it goes (in most editors, Levels or Curves). Small differences near white get stretched into big ones.

Here’s the left end of the text, before and after. Everything that isn’t the hidden text is faded back so the text stands out:

Filling in the gaps

With the text visible, most of it can be read: CTF2021[ followed by 12 digits. Two of the digits sit behind the logo’s letters, and only their edges show. From those edges, each one could be a 3 or an 8.

Two uncertain digits with two options each makes four possible flags. We submitted them one at a time until the scoreboard accepted one.