The Past weekend I took part solo in the Monthly Hacktoria CTF event. The CTF event featured Geolocating Lidl stores around the world. What follows is the approach I took to solve the challenges.

Location 1

Solution

Location 1 Annotated

  1. End of 30 km/h zone — means there is a 30 km/h road nearby. Also it’s a German road sign.
  2. Forested area
  3. Cell mast
  4. Parking area
  5. Unique architecture of the Lidl
  6. Light post

Steps

First thing I tried was a reverse image search using Google, which did not yield any results. However, using Yandex to do the same resulted in a close match.

Yandex RIS Result

Visiting the site, we find the Lidl under the “Located Nearby” subcategory. Afterwards, just visit the same on Google Maps and find the Street View.

Location 2

Location 2 Challenge Image

Solution

A Google RIS returns many US-based results, suggesting the store is in the US. The slogan “High Quality Low Prices” is mainly associated with US Lidl.

Now that we have the country, narrowing down to the state: if you pay close attention you’ll notice that the approaching car doesn’t have a front license plate. There are states where this is allowed. See here.

I also came across this article about the architectural prototype visible in the image. We learn that it’s mostly on the East Coast. Using the front plate data we remove several states and remain with: North Carolina, South Carolina, Delaware, Georgia, and Florida.

That’s better than the whole country. Looking back at the article, it explicitly mentions South and North Carolina. From here on it was just brute force , going through the Lidls in each state and I eventually found it in North Carolina.

Location 3

Location 3 Challenge Image

Solution

A RIS yields the exact “Big Sofass” store.

Big Sofass RIS Result

Visit their page and find the address of the store.

Location 4

Location 4 Challenge Image

Solution

To locate the state, I looked for this business using what seems like “Cusumano Remodeling”.

Cusumano RIS Result

They are located in New York. Now RIS and adding “New York” brings up a site citing the location.

Location 5

Location 5 Challenge Image

Solution

Location 5 RIS Result

Location 6

Location 6 Challenge Image

Solution

From the image we can tell the store is in Finland, and what’s visible is a self-checkout counter. This challenge was solved by grueling brute force. I searched for all Lidls in Helsinki and went through the photos one after the other. The “inside” filter of Google Maps made it a tad easier, but it was still tiring. I eventually found the image here.

Ideally, this challenge should have been solvable using Overpass Turbo, but since it did not have the appropriate tagging, it wasn’t. I updated the details of the store on OpenStreetMap by adding the self_checkout tag.

The following is the query that geolocates the store:

1
2
3
4
5
6
7
8
9
[out:json][timeout:120];

{{geocodeArea:Finland}}->.searchArea;

(
  nwr["shop"="supermarket"]["name"~"Lidl",i]["self_checkout"="yes"](area.searchArea);
);

out center;

Lidl Pub

Lidl Pub Challenge Image

Solution

The Middle Ale, Dundonald

Source

Lidl Website

Old Lidl Website Challenge Image

Solution

The link to the website lidl-bioness.de is no longer alive. So the first thought was to search for archived snapshots across all the archiving tools. Web Archive was the only one that had archived the site.

Up to a certain point the site serves content, but after some date the site redirects to this URL.

The last date I found that served actual content was 16th October 2008. Here.

Lidl Asian Beginnings

1
What city was the first Lidl Asia office located? And how many employees did it have? And what year did it open? (10 points)

Solution

The site lidl.asia’s about page has this information: https://lidl.asia/about-us

Lidl Mobile

1
Does Lidl have a cellphone plan? If yes, what's it called, and when and where was it launched? (20 points)

Solution

Checking the history of Lidl on Wikipedia, we find out: “The mobile phone brand Lidl Connect was launched in Germany in October 2015.”

Finding the Date

We know it was launched in Germany in October 2015. Using some Google dorks and the German language, we create this dork: "lidl connect" AND "starten" and limit the results to between 1st October and 31st October.

We find this article from 2nd October 2015, where it says “Lidl Connect launched yesterday…”

So the date is 1st October 2015.

Conclusion

If you’re into OSINT, Hacktoria’s Discord server runs challenges around the clock and is well worth joining: https://discord.gg/WyjtaBKGcz