Charlotte’s Web Site

| February 15, 2007

Active Image
Active Image del.icio.us

Discuss in Forums {mos_smf_discuss:Feb 07 – Charlottes Web Site}

Salutations, challenge fans!  This time around, I've weaved a web for you to untangle, set in the after-story of Charlotte's Web.  This book is one of my favorites (my kids love it too!) and features a spider named Charlotte who has to save Wilbur the pig by building spider webs with words like "Terrific" and "Some Pig" in them.  The associated 1973 cartoon movie and 2006 feature film are also both highly entertaining.  In my challenge, you'll get to match wits with Lurvy, the farm hand, and decipher Charlotte's new plan to save Wilbur the pig.  Answers are due by March 31, 2007.  I had a lot of fun working on this one, and hope you will too.

As always, we'll choose three winning entries.  Remember, you don't have to get all of the answers to qualify to win.  We'll give a fine prize to:
 - The best technical answer.
 - The best creative answer that is also technically accurate.
 - A winner chosen at random from all entries, no matter how incomplete or half baked.

We'll announce winners the first week of April.

Thanks… and have fun!

–Ed Skoudis, Intelguardians
SANS Instructor
Author of Counter Hack Reloaded

coreimpact2c.gif
Skillz Sponsored by Core Security Technologies

After Charlotte died and her daughters left, things were pretty grim on Zuckerman's farm.  The economy had taken a serious downturn, and money was scarce.  Just a year before, it would have been unthinkable to sell Wilbur, Zuckerman's famous pig, as a meat product.  Those old webs created by Charlotte the spider last year had secured Wilbur's safety during the good times.  But now, with the recession, things were different.

Lurvy, the farm hand, was trying to squeeze as much cash from that old farm as possible, so he put Wilbur up for auction on Meat-Bay, the premiere site for meat sales on the Internet.  When the other animals in the barn stumbled across the web site Lurvy created to promote the auction, it created quite a stir.

"Lurvy-urvy is even using the phrases from Charlotte's old webs to try to sell Wilbur," said the goose, whose repetitive-speaking idiosyncrasy had grown only more pronounced with time.  "Why, it's unseemly-eemly-eemly."  The contents of Lurvy's original web site are located here.

charwww2The animals were shocked when they noticed that the highest bid so far on Meat-Bay was a staggering $1,618.03.

Templeton, the rat, grew nervous, realizing that losing Wilbur would mean that the trough, with its precious nourishment, would be empty without a pig around.  Knowing that he could live off his significant body fat for a while but would ultimately succumb to the famine, Templeton moaned  "O, I do not enjoy starving progressively!"

The goose responded, "We've got-ot-ot-ot-ot to come up with some way to save the pig-ig-ig-ig-ig-ig-ig.  But, how can we do it without Charlotte-arlotte-arlotte-arlotte-arlotte-arlotte-arlotte-arlotte-arlotte-arlotte-arlotte?"  The goose's speech patterns were obviously getting stuck due to the stress of the situation.

At just that moment, as though the goose had conjured it up, Wilbur heard a familiar voice coming from a crevice in the barn.  "Salutations!" it said.  Wilbur ran to the corner and saw… Charlotte the spider!  In shock, Wilbur uttered, "We all thought you had died, Charlotte.  What happened?"

Charlotte responded, "We had to fake my death, because I was implicated in the shooting of a Chinese diplomat at their consulate in Los Angeles.  The only ones that knew that my death was faked were the little girl Fern, Templeton the rat, and President David Palmer.  But, I'm back now, and we have to save Wilbur again!  I have a plan that my friends here will help me implement."

Suddenly, hundreds of tiny insects emerged from the same crevice in the corner of the barn.  "We're the Geography Ants!  Let's get to work, Charlotte."

As they were speaking, Lurvy entered the barn to feed slop to Wilbur.  He began speaking to himself about a new security solution for his web site advertising the auction, thinking that the "dumb" animals wouldn't understand what he was saying.  "Tomorrow morning, I will activate my new security tool that will alert me if my site is ever defaced.  A script running on my laptop will access the web site every five minutes, pulling down its main page to look for defacements by calculating the MD5 hash of the current page and comparing it with the hash created the first time the script ran."  Lurvy was not a typical farm hand.

After Lurvy left, Charlotte gasped, "We haven't much time!  Let's get to work."  That night, Charlotte and the Geography Ants built spider webs, took photographs, and performed a little web site editing of Lurvy's page.  Just before dawn, they updated Lurvy's site, creating the new page shown here.  In most browsers (except IE7), the new site looked nearly identical to the original.

That morning, as the rooster crowed, Lurvy surfed to his web site to make sure everything appeared OK.  Because everything looked normal, he activated his new integrity-checking script, which spit out the following text when it first downloaded Lurvy's page, as altered by Charlotte:

Original MD5 Hash = e0dbee13c331b6deee2db071c85baf56

With the now-altered website appearing to still offer Wilbur as a fine pork product, a new bid came in, this time for a whopping $ 2,718.28.  Lurvy was confident that his ad was effective, and that his integrity-checking script would guarantee that no one could alter the page.  Every five minutes, the script continued to spit out:

Current MD5 Hash = e0dbee13c331b6deee2db071c85baf56

Current MD5 Hash = e0dbee13c331b6deee2db071c85baf56

Current MD5 Hash = e0dbee13c331b6deee2db071c85baf56

With the plot unfolding as planned, Charlotte made her next move.  She altered Lurvy's web site again, making the site look very different to most browsers (such as IE 6, Firefox 2, and Safari).  This final web site is shown here.

As Wilbur reflected on Charlotte's handiwork, he said to himself with a proud smile, "It is not often that someone comes along who is a true friend, a good writer, and a talented web site manipulator. Charlotte was all three."

Suddenly, Lurvy was astounded as people started revoking their bids on Wilbur!  Every single bid was revoked; no one wanted to buy Wilbur.  Something was definitely up.  However, when Lurvy inspected the output of his integrity-checking script, the same MD5 hash was displayed again and again.  Lurvy needed to investigate the web site in detail, to figure out what was going on.

And that's where you come in.  Answer the following questions to help convince Lurvy not to sell Wilbur.

1) What is the significance of various numbers in the story, including the speech patterns of the goose and Templeton?

2) How had Charlotte and the Geography Ants fooled Lurvy's integrity-checking script?

3) Why did Charlotte have to change the website before the integrity-checking script ran for the first time? Why couldn't she deface it later?

4) How should Lurvy's script have functioned to improve its ability to detect the kinds of alterations made by Charlotte?

5) What was Charlotte's proposal to Lurvy for saving Wilbur?

Please submit your answers to skillz0207@ethicalhacker.net with the Subject: 'Skillz Submission' by March 31, 2007. In the first week of April, we’ll announce three winners, one from each of these categories:

·        Best technical answer
·        Most creative and technically correct answer
·        Random draw from all answers submitted, correct, incorrect, complete, partially complete, etc.

So, even if you can't answer all of the questions, send in what you have. You just might win the prize in the random draw category

Each winner gets a copy of Counter Hack Reloaded, autographed by author Ed Skoudis, congratulating you on your victory and amazing abilities!



- All trademarks, images and rights reserved to their original owners.
- Graphics used include the movie image (Paramount Home Video) and a 3D map of the world wide web.

Category: Skillz

Comments are closed.