Deep Down There's something in the water... — UMass Cybersecurity CTF

Challenge

Provided file: CHALL.gif

This challenge gave a small animated GIF. The important clue was that it was an indexed-color format, so the hidden content could live in palette indices rather than in EXIF, appended data, or classic LSB channels.

Recon

Basic triage showed a normal GIF with no obvious extra payload:

file CHALL.gif
# GIF image data, version 89a, 100 x 70

exiftool CHALL.gif
# GIF Version : 89a
# Image Size  : 100x70
# Frame Count : 12

So the file was a GIF89a, size 100x70, with 12 frames.

Standard file-level checks did not reveal anything useful, which pushed the investigation toward the GIF's indexed-color structure. The task already had extracted frames and helper images under:

• ./tasks/umasscybersec/Deep Down There's something in the water.../frames/
• ./tasks/umasscybersec/Deep Down There's something in the water.../indexviz/
• ./tasks/umasscybersec/Deep Down There's something in the water.../analysis/

The analysis directory included a montage and separated glyph view, which helped confirm that the hidden text sat inside the water region.

Analysis

The key idea is palette-index steganography in a GIF.

In an indexed image, a pixel does not directly store RGB values. It stores a palette index. If two palette entries are visually identical or nearly identical, the picture can look unchanged to the eye while still encoding different information through index choice.

That is exactly what happened here:

• the GIF palette contained duplicate-looking / near-duplicate colors
• those indices were used selectively in the water region
• when one suspicious index was recolored independently, hidden red text appeared

For this kind of task, preserving palette information is critical. A naive RGB conversion destroys the distinction between equal-looking palette entries. Pillow can avoid that problem with:

from PIL import GifImagePlugin
GifImagePlugin.LOADING_STRATEGY = GifImagePlugin.LoadingStrategy.RGB_AFTER_DIFFERENT_PALETTE_ONLY

That loading strategy keeps the frame data usable for palette/index analysis instead of flattening everything too early.

Solution

1. Keep the GIF indexed and inspect frames

The useful workflow was:

#!/usr/bin/env python3
from pathlib import Path
from PIL import Image, ImageSequence, GifImagePlugin

GifImagePlugin.LOADING_STRATEGY = GifImagePlugin.LoadingStrategy.RGB_AFTER_DIFFERENT_PALETTE_ONLY

gif = Image.open("CHALL.gif")
outdir = Path("analysis")
outdir.mkdir(exist_ok=True)

for i, frame in enumerate(ImageSequence.Iterator(gif)):
    idx = frame.copy()
    idx.save(outdir / f"frame_{i:02d}_indexed.png")

Then inspect palette entries and where each index appears in each frame.

2. Recolor suspicious palette indices

The breakthrough was isolating the duplicate-looking palette entries and recoloring them one at a time. In this challenge, index 1 was the meaningful one.

Example snippet:

#!/usr/bin/env python3
from PIL import Image, ImageSequence, GifImagePlugin

GifImagePlugin.LOADING_STRATEGY = GifImagePlugin.LoadingStrategy.RGB_AFTER_DIFFERENT_PALETTE_ONLY

gif = Image.open("CHALL.gif")

for i, frame in enumerate(ImageSequence.Iterator(gif)):
    idx = frame.copy().convert("P")
    w, h = idx.size
    out = Image.new("RGB", (w, h), (0, 0, 0))
    pix = idx.load()
    dst = out.load()
    for y in range(h):
        for x in range(w):
            if pix[x, y] == 1:
                dst[x, y] = (255, 0, 0)
            else:
                dst[x, y] = (20, 20, 20)
    out.save(f"analysis/frame_{i:02d}_idx1.png")

Once index 1 was recolored separately, the hidden text became readable in the water.

3. Use montage / glyph separation to read the flag

The extracted outputs under analysis/ made the text much clearer:

• indexviz_montage_x4.png
• glyphs_separate.png
• several enlarged / sheared crops of the exposed text

The font was ambiguous enough that OCR initially suggested:

UMASS{1N_A_G1FFY}

However, the final answer should be the user-confirmed flag:

UMASS{REDACTED}