SANS Holiday Hack 2015-Part 5

Gnome Configuration Files

Dosis Gnome:
Gnome Serial Number: 20-RNG9731 
Camera monitoring?: YES
Audio monitoring?: YES
Camera update rate: 60min
Gnome mode: Gnome

Gnome 1:
Gnome Serial Number: NCC1701
Current config file: ./tmp/e31faee/cfg/sg.01.v1339.cfg 
Allow new subordinates?: YES
Camera monitoring?: YES
Audio monitoring?: YES
Camera update rate: 60min
Gnome mode: SuperGnome
Gnome name: SG-01
Allow file uploads?: YES
Allowed file formats: .png
Allowed file size: 512kb
Files directory: /gnome/www/files/

Gnome 2:
Gnome Serial Number: XKCD988
Current config file: ./tmp/e31faee/cfg/sg.01.v1339.cfg 
Allow new subordinates?: YES
Camera monitoring?: YES
Audio monitoring?: YES
Camera update rate: 60min 
Gnome mode: SuperGnome 
Gnome name: SG-02
Allow file uploads?: YES
Allowed file formats: .png Allowed file size: 512kb
Files directory: /gnome/www/files/

Gnome 3:
Gnome Serial Number: THX1138
Current config file: ./tmp/e31faee/cfg/sg.01.v1339.cfg 
Allow new subordinates?: YES

Camera monitoring?: YES
Audio monitoring?: YES
Camera update rate: 60min 
Gnome mode: SuperGnome 
Gnome name: SG-03
Allow file uploads?: YES
Allowed file formats: .png 
Allowed file size: 512kb
Files directory: /gnome/www/files/

Gnome 4
Gnome Serial Number: BU22_1729_2716057 Current config file: ./tmp/e31faee/cfg/sg.01.v1339.cfg Allow new subordinates?: YES
Camera monitoring?: YES
Audio monitoring?: YES
Camera update rate: 60min
Gnome mode: SuperGnome
Gnome name: SG-04
Allow file uploads?: YES
Allowed file formats: .png
Allowed file size: 512kb
Files directory: /gnome/www/files/ 

Extras

I like the extra touch if you look at the last page of the camera feed. “Leave the camera feed analysis to the burglars. 12 feeds should be enough to see that the cameras are working. Trust us. There is nothing but 1.99 million more living rooms after this page. We’ve checked." This ensures that millions of images aren't needed. In fact, I spotted that some images were already reused.

The letters of the word Atnas can spell Santa, as well as Satan.

If the hex sent from the gnome to the C&C, in the “IE: Unknown:” sections, is decoded to ASCII, there are the words “something clever”.

The SSID of the Dosis' WAP is December.

I found a non-alchoholic drink recipe in the banner in the etc directory of firmware.

In the www/routes/index.js file, there is a secret variable set to the value, “gnoderules”.

The first secret room was behind the bookshelf on the left in Ed’s room. The second secret room was above the 1st secret room. There was an odd panel in the wall. One of Jo-Mama’s cookies was in the room.

Ed’s room has a painting with peep holes so that people can spy on whoever is in the room.

There is an Easter Egg above the pond, on the left hand side, near Turing Avenue and Boole Way. 

The sign on Sasabune says, “Welcome to Sasabune”.

The sign in the coffee shop says, “Welcome to 'Cuppa Josephine's Coffee”.

The hotel name is the “Grand Hotel”.

I saw 4 Gnome In Your Homes, in game, other than the one that Josh and Jess Dosis were analyzing. The first one was in CounterHack iHQ entrance. The second one was in Ed Skoudis' room in the bookcase, one was in Dan's room, and one was in the NOC in the Intern's backpack.

There is a snow man outside of Counter Hack iHQ.

The street signs can be read. They are Turing Ave, Boole Way, Einstein Boulevard, Lovelace Way, Tesla St, Ritchie St, and Babbage St.

The Dosis name was made by taking the “k” and “u” off of Skoudis, and moving the “d” in Skoudis to the first position and the “s” to the original position of the “d”. Joshua and Jessica are the names of Ed Skoudis' children. (Duke Dosis is an anagram for Ed Skoudis.  I knew that the names were similar, but I didn't realize that it was an anagram until Mr. Skoudis told me via e-mail.)

The signs outside of the NOC, on the gates and the one near the pin pad says, “Authorized Personnel Only”.

Songs

The song playing when wandering around the neighborhood is “Walking In A Winter Wonderland”. The song playing in Cuppa Josephine's Coffee is “Have Yourself A Merry Little Christmas”.
The song playing in Dan's apartment building entrance is “Dominick the Donkey”.
The song playing in Dan's room is a mashup of “God Rest Ye Merry Gentlemen/Carol of the Bells”. The song playing in Counter Hack HQ is “You're a Mean One, Mr. Grinch”.
The song playing in Secret Room #1 (Tom Hessman's room)and Secret Room #2 is “Grandma Got Run Over By a Reindeer”.
The song playing in Josh Dosis' and Jess Dosis' rooms is “Deck the Halls”.
The song playing in the Dosis' kitchen is “Driedel, Driedel, Driedel”.
The song playing in the Grand Hotel entrance is “Wonderful Christmas Time”. The song playing in Sasabune is “Jingle Bells”.
The song in the maze is “Feliz Navidad”.
The song in Tom V's room is “All I Want For Chrismas is You”.

I can't read the sign or any of the button labels in Tom V's room. I guess that the creators don't want anyone making trouble.

The server room is kind of noisy, with the servers running, and all. The only sound in NetWars is computers clacking. (I didn't catch it, but it turns out that there are sounds from a movie in here.)

The NetWars Player says, “I’m not sure what happened. The guy next to me was fine one minute, the next, he stood up and yelled, “Have you SEEN Level 4 yet?” and left. I hope he comes back.”

Ready Player One is a science fiction novel by Ernest Cline.

The Easter Egg in Holiday Hack Quest may be paying tribute to the Easter Egg in Ready Player One. 

There are 87 uses of the word gnome (both singular and plural) in the story.

I believe that everyone in the firmware/gnome websites can be mapped to characters in Whoville.

Auggie: Augustus May Who 
DW: DrewWho
CW; CLW: Cindy Lou Who 
JoJo: JoJo
Louise: Betty Lou Who
Nedford: Ned McDodd
Stuart: Stu Lou Who
Maratha: Maratha May Whovier
Dr. O' Malley: Sally O' Malley
PS: Could be for “Pseudonym Seuss”, who is the creator of the “Whoville” stories. His real name is Theodor Seuss Geisel. He wrote under the psudonym “Dr. Seuss”.