Haunting Knightmare: The Fog Your Brain Fills In

Happy Halloween. Chess.com's daily puzzle today was called "Haunting Knightmare." Chess.com is my favorite corporation, which is a weird thing to say for a guy who roots for the small business man, but here we are. And I'll be honest, this puzzle got me. The checkmate was sitting right there and my brain would not see it.

It's also the last day of Cybersecurity Awareness Month. When I started in security, a lot of it felt like playing in fog. You can't see who's coming at you, so your brain fills in the gray squares with whatever it assumes is there. This puzzle showed me how wrong those assumptions can be. This past year has shown me you can push the fog back.

Give it a try before you scroll. White has two knights and a king. Black has a bishop, a knight and a whole wall of pawns. Looks like Black has it covered, right?

The solution

The puzzle opens with 1. Nfd5 Nf3, which is where my screenshot picks up. From there it's 2. Nd3 e1=Q 3. Nc3#.

The knight on b4 drops back to d3, where it covers c1 and e1, two squares the Black king would want to run to. Black promotes a pawn to a queen, which feels like a big moment, but it does nothing to help the king. Then the knight on d5 lands on c3, and that's checkmate. Black finishes with a queen, a bishop, a knight and four pawns against two knights, and still loses.

What my brain filled in

When I first looked at this puzzle, my brain told me it was impossible. Two knights against all of that? No way. But that wasn't the position talking. That was me looking too fast and not actually understanding what was in front of me.

It started in the corner. In my head, a1 is where White's rook lives, because that's how every game starts. So when I saw a black bishop sitting on a1, it threw me off right away, and from there I was playing a different game than the one on the board. I was like a blind dog trying to find the treat with just its nose.

The other thing that got me was direction. My pieces always start at the bottom and move up, so my brain assumes the bottom side is pushing upward. In this puzzle Black is at the bottom, and Black's pawns are moving south toward rank 1.

So in the final position, I saw pawns on b2 and d2 sitting right next to the knight on c3 and thought, easy, Black just takes it. But a Black pawn on b2 can only capture on a1 or c1, and the one on d2 can only capture on c1 or e1. That knight is behind them. The queen can't get there either, because its own pawn on d2 is in the way, and the bishop is stuck behind its own pawn on b2. Black boxed in its own king.

Once I opened my eyes, it was so simple. The king gets smothered by its own pieces and the knights finish the job. It's honestly beautiful at the end. Black has the numbers, but White has the plan, and strategy beats numbers.

What I should have done is ask the same three questions I'd ask about any checkmate:

1. Can the king move? c2, d2 and e1 are filled with Black's own pieces, and the knights cover c1 and e2.
2. Can anything take the checking piece? The pawns capture the wrong way, the queen and bishop are blocked, and the knight on f3 can't reach c3.
3. Can the check be blocked? No. You can't block a knight.

I skipped all three because I thought I already knew the answer.

Playing it in the fog

Chess.com has a mode called Fog of War, where you only see the squares your own pieces can reach. Everything else is gray. I ran this puzzle through it, and it's the closest thing I've seen to what security feels like day to day.

As White, I can't even see the king I'm trying to mate. Even right before the winning move, d1 is still gray, and the knight lands on c3 and finishes a king it never actually saw. I don't need to see it. I know how the pieces move and how the position is built, so I can work out where the king has to be.

Attackers work the same way. MITRE ATT&CK calls it reconnaissance: they don't see your whole network, just what you expose, and they fill in the rest from patterns. The bots hitting my Azure honeypots didn't know what was behind the login. They knew what's usually there.

Black's view is the defender's side, and it's rough to look at. A queen, a bishop, a knight and four pawns, and Black can't see either knight about to end the game. I've been there. In my Azure lab, my first brute-force detection rule missed an attacker guessing one password every 12 minutes. I assumed brute force would be fast, so I never looked for slow.

The good part is that defenders get to push the fog back. Better logging and tuned detection rules widen what you can see, and automation lets you act on it fast. The SOAR playbook in that same lab enriches an incident with threat intel and blocks the attacking IP in about 12 seconds, a job that took me 10 to 15 minutes by hand. Defenders can also put things in the attacker's fog.

Putting fake squares in the fog

That's what a honeypot is: a fake system set up to attract attackers so you can watch what they do. I've been learning Rust by building one, and this week I finished Stage 1 of Rust-Honeypot. Right now it's a fake login that only runs on my own machine, on port 2323, a nod to the old Telnet port 23 that bots still scan constantly. It always answers Login incorrect and writes down everything that gets typed.

The first time I ran it, I opened a second terminal and attacked it myself with nc 127.0.0.1 2323. I typed "username" as the username and "username" as the password, because why not, and watched it show up in the log.

Stage 1 had its own version of the puzzle's trap. Each log line looks like username="..." password="...". If someone types admin" password="hacked as their username and you log it carelessly, you get a fake password="hacked" field that looks totally real to whoever reads the log later. That's called log injection (CWE-117), and it's my d2 pawn. It looks like it belongs there, and it doesn't.

I had two bugs around it. First I wasn't escaping hostile text at all, then after I fixed that, I was escaping it twice. Both looked fine to me. The tests caught them, not my eyes. Even the input hides things: every password shows up with an invisible line ending stuck to it, and one exercise was stripping that off without touching spaces, because a space in a password is part of the password.

Who's on the other side?

Last October I was brand new at the help desk, and I thought every call was a hacker or a scammer trying to get in. This year I noticed I'd flipped, and my gut trusted almost everyone. An attacker who did a little homework, a real name, a department, a manager to mention, would have sounded exactly like every other caller. That's social engineering, and pretexting is the term for showing up with a believable story.

So my process doesn't run on my gut. Here's my hard line, and I don't cross it: I will not give out user information until I've proven it's actually that person, and that includes their own username. Some people get angry about that. Telling them their username isn't my job. Protecting their account is.

Training doesn't fully prepare you for this, because training is dramatized. The phishing email has obvious typos and the scammer sounds like a movie villain. The real ones sound like a normal, stressed-out person on a Tuesday. It's like everyone on that call is watching a different movie. The caller sees some guy making their day harder, and an attacker sees a way in. Verification is the only thing I trust to tell them apart.

Not all fog comes from attackers, either. This week a radiologist was freaking out because something looked different in the imaging program he uses every day, and even though the fix was simple, from his side of the fog it felt like an emergency, the same kind of urgency I wrote about in Why Panic Is Powerful.

The phone isn't the only place you can't tell who's there. My Azure honeypots caught 1.24 million attack attempts from 75 IP addresses in 37 hours. No person types that fast. That was scripts hammering away around the clock. It changed how I look at my own accounts too. When I see views or follows on my posts, I honestly can't tell how many are people and how many are bots scraping everything they can find. My Medium handle is no1listeninghere, and some days that feels more accurate than I meant it to.

Pushing the fog back

I wrote about being sure you're right without checking in Confidently Wrong: Bad Info, and this puzzle was the same lesson on a chessboard.

When I started, security felt like fog of war all the time. I couldn't see the attacker, I didn't know the systems, and my brain filled the gray squares with guesses. It doesn't have to stay that way. You don't need to see every square. You need habits that push the fog back a little at a time: figure out which way things are moving, verify before you trust, write notes the next person can use, and build things that let you watch what's happening.

That last one is why I'm building this honeypot. Every stage shows me a little more of what an attacker sees and what I'd miss as a defender. If you want to follow along, the code is on my GitHub at Rust-Honeypot, and Stage 2 is next.

Whatever you're curious about, keep digging into it. Tech can be your friend once you start asking it questions.

Did you see the mate before you read the answer? Let me know in the comments, and send me a puzzle that fooled you.