START: cca 07:30 GMT 6th JAN 2014
The following link is the Twitter account from which the automated tweets were sent last year (2013).
https://twitter.com/1231507051321
From that Twitter account came the first image of Cicada 2014 which is as follows:
ADDITIONAL INFORMATION
Resolution: 547*577
http://i.imgur.com/zN4h51m.jpg
Uploaded to: http://prntscr.com/2gy9v1
OutGuess steganography software output: http://pastebin.com/raw.php?i=7ruHyAdB
Quick edits for now, will update with full write up later.
UPLOADED ON:
- http://prntscr.com/2gy9v1 imgur
- http://prntscr.com/2gy9y5 twitter
- (printscreen made at 7:39 GMT jan 6th
- in time zone: Central European Time Zone (UTC+01:00)
- local time: 08:40 AM
SIDE NOTE
After running the original image through Paint.net 3bit steganography plugin a cicada was revealed. (It can also be seen by simply adjusting the brightness and contrast.)
This is most likely nothing, as cicadas are a common motif.
FILE NAME
The original image was named as follows:
zN4h51m.jpg
Although there is no solid foundation as yet to suggest the filename is anything other than a re-upload, it may be worth while putting the name of the file to one side.
zN4h51m
The Gematria value of the file name is 133. (0+29+4+23+5+1+71) This number is the title of the 0-57 pages received on Onion 7.
JPEGsnoop
Image Forensics
http://www.map-base.info/forensics/report_1/index_uk.shtml
Joseph Liouville maybe
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The work of a private man who wished to transcend, He trusted himself, to produce from within. 1:2:3:1 3:3:13:5 45:5:2:3 20:3:20:5 8:3:8:6 48:5:14:2 21:13:4:1 25:1:7:4 15:9:3:4 1:1:16:3 4:3:3:1 8:3:26:4 47:3:3:5 3 13:2:5:4 1:4:16:4 . o n i o n Good luck. 3301 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQIcBAEBAgAGBQJSyjguAAoJEBgfAeV6NQkPsgAP/A3tMC3lpyFNAc/sj+Izu15S CzUjZJMe20Gu9UMNokQ2UJabktv9w0GMyK17TrMkUcU+ZpjdzGNqKoE2ETVxLmD/ uBZtR5PnF9EE3D08tJUPN1vSrYNkYk+9zcaUJZMPNgYNCt/CACutPwrOci9i9FDO 7BIpnhGqT3ZruqrSwO2Y73LJI1xxUt1XUqh1NQ+fJeAFMRkJBZZazkxRlgk3GGsF fLrcEKrS+KBipV1EQaaKxjISc9hc2c1TfxE66evlkN+zLcoyDcYuyruNM5wiZzgM 2uR58c+xgWQgG5UuLFClfvjDxUvDkrKt4mzEeaYSUm1MsYueuYklz4ydlg5Mf6l2 p1WyAxO52XfXVUZASk6VmaEQ0WjODTXvLeFTxUSDoKDMkvxDVxX6wGkufS9JwakB nTZizZ8Ypv8GcNCuNNGd6gZ1Vk2MYntggXdX8INd0Itcd3QnLqbBnATDOinDxlOs 5zTrtyTHNaxxDagPfAbU1jMXM0aHd7PFAzjjp7kgCTWqMyBch+8Vt80bjkdL9iw8 Q3hxuanq8mh6nUGc+tNe0UfqKHEbE+jWIezYqgawJB0M9R5OhxWE+E+jPXtZKkXQ JHYndPDrrsV8q27b7p0KN0+oblTkjqsItIAuLu7FNd0B4xb1jjp1Sbh7WJdZ/rbi mCO0vN/obU9qK1Vfapy0 =6Gxk -----END PGP SIGNATURE-----
OUTGUESS DECYPHER WALKTHROUGH
Using Backtrack 5 R3 simply install Outguess from the repository. Once installed, run the following command:
outguess -r /location/of/your/image/zN4h51m.jpg /location/to/output/zN4h51m.txt
Unclear what that means? Replace '/location/of/your/image/' with the directory structure location of the file you want to check
Replace '/location/to/output/' with the directory structure location of where you want your file to output to. After the output location, name your file whatever you want with a .txt file extension.
Cypher = x:x:x:x (paragraph:sentence:word:letter) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ##################################### PART 1 The work of a private man who wished to transcend, He trusted himself, to produce from within. Which leads to - http://www.math.dartmouth.edu/~doyle/docs/self/self.pdf ##################################### PART 2 1:2:3:1 = a 3:3:13:5 = u 45:5:2:3 = q 20:3:20:5 = g 8:3:8:6 = n 48:5:14:2 = x 21:13:4:1 = j 25:1:7:4 = t 15:9:3:4 = v 1:1:16:3 = d 4:3:3:1 = b 8:3:26:4 = l 47:3:3:5 = l 3 = 3 13:2:5:4 = p 1:4:16:4 = v . o n i o n Which is equal to - auqgnxjtvdbll3pv.onion ##################################### Good luck. 3301 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQIcBAEBAgAGBQJSyjguAAoJEBgfAeV6NQkPsgAP/A3tMC3lpyFNAc/sj+Izu15S CzUjZJMe20Gu9UMNokQ2UJabktv9w0GMyK17TrMkUcU+ZpjdzGNqKoE2ETVxLmD/ uBZtR5PnF9EE3D08tJUPN1vSrYNkYk+9zcaUJZMPNgYNCt/CACutPwrOci9i9FDO 7BIpnhGqT3ZruqrSwO2Y73LJI1xxUt1XUqh1NQ+fJeAFMRkJBZZazkxRlgk3GGsF fLrcEKrS+KBipV1EQaaKxjISc9hc2c1TfxE66evlkN+zLcoyDcYuyruNM5wiZzgM 2uR58c+xgWQgG5UuLFClfvjDxUvDkrKt4mzEeaYSUm1MsYueuYklz4ydlg5Mf6l2 p1WyAxO52XfXVUZASk6VmaEQ0WjODTXvLeFTxUSDoKDMkvxDVxX6wGkufS9JwakB nTZizZ8Ypv8GcNCuNNGd6gZ1Vk2MYntggXdX8INd0Itcd3QnLqbBnATDOinDxlOs 5zTrtyTHNaxxDagPfAbU1jMXM0aHd7PFAzjjp7kgCTWqMyBch+8Vt80bjkdL9iw8 Q3hxuanq8mh6nUGc+tNe0UfqKHEbE+jWIezYqgawJB0M9R5OhxWE+E+jPXtZKkXQ JHYndPDrrsV8q27b7p0KN0+oblTkjqsItIAuLu7FNd0B4xb1jjp1Sbh7WJdZ/rbi mCO0vN/obU9qK1Vfapy0 =6Gxk -----END PGP SIGNATURE-----
PGP
Signature of image is valid:
6D85 4CD7 9333 22A6 01C3 286D 181F 01E5 7A35 090F gpg: Signature made Sun 05 Jan 2014 10:59:26 PM CST using RSA key ID 7A35090F gpg: using PGP trust model
Further verification: http://imgur.com/r7s3E9S
PGP HELP FILES
Pretty Good Privacy (PGP) Downloading, Installing, Setting Up, and Using this Encryption Software A Tutorial for Beginners to PGP
http://www.pitt.edu/~poole/accessiblePGP703.htm
Determining Strengths For Public Keys Used For Exchanging Symmetric Keys - RFC 3766
http://tools.ietf.org/search/rfc3766
OpenPGP Message Format - RFC 2440
http://www.ietf.org/rfc/rfc2440.txt
BOOK CODE
BOOK NAME
Self-Reliance by Ralph Waldo Emerson1841
- Cypher recovered from the hidden message in the original image for 2014 is decyphered using this book. The cypher was set out as x:x:x:x or paragraph:sentence:word:letter
BOOK LINK
http://www.math.dartmouth.edu/~doyle/docs/self/self.pdf
CLUE FOR THE BOOK
The work of a private man who wished to transcend, He trusted himself, to produce from within.
- Poem references transcendentalism
- Emerson is a noted transcendentalist author
- "he trusted himsef" refers to "trust thineself", which is a theme throughout Self-Reliance, as is producing from within
ONION NO1 - For Every Thing That Lives Is Holy
DECYPHERED URL
http://auqgnxjtvdbll3pv.onion/
- clearnet link https://auqgnxjtvdbll3pv.onion.to
JPG ON ONION
- if you look closely at the image, there is a cicada symbol
- the center bottom (Ancient of Days) image is shifted two pixels to the right, and the right image is two pixels shorter than the canvas, leaving a 2 px wide vertical and horizontal strip of 415 and 293 pixels empty.
- The Cicada symbol itself is mirrored compared to all the other 3301 communication, as is the Newton image and the filename.
Resolution of jpg:
- 1327 *1427
DEBATE ABOUT MEANING OF THE PICTURE ON ONION
FILE NAME
The original file name is:
1033.jpg
This may be notable (unconfirmed), as it is a mirror of 3301 i.e. Cicada 3301
1033 vs. 3301
JPEGsnoop
Filename: [1033.jpg] Filesize: [342361] Bytes
Start Offset: 0x00000000
Marker: SOI (xFFD8) OFFSET: 0x00000000 Marker: APP0 (xFFE0) OFFSET: 0x00000002 length = 16 identifier = [JFIF] version = [1.1] density = 1 x 1 (aspect ratio) thumbnail = 0 x 0 Marker: DQT (xFFDB) Define a Quantization Table. OFFSET: 0x00000014 Table length = 67 Precision=8 bits Destination ID=0 (Luminance) DQT, Row #0: 8 6 5 8 12 20 26 31 DQT, Row #1: 6 6 7 10 13 29 30 28 DQT, Row #2: 7 7 8 12 20 29 35 28 DQT, Row #3: 7 9 11 15 26 44 40 31 DQT, Row #4: 9 11 19 28 34 55 52 39 DQT, Row #5: 12 18 28 32 41 52 57 46 DQT, Row #6: 25 32 39 44 52 61 60 51 DQT, Row #7: 36 46 48 49 56 50 52 50 Approx quality factor = 74.75 (scaling=50.51 variance=0.81) Marker: DQT (xFFDB) Define a Quantization Table. OFFSET: 0x00000059 Table length = 67
Precision=8 bits Destination ID=1 (Chrominance) DQT, Row #0: 9 9 12 24 50 50 50 50 DQT, Row #1: 9 11 13 33 50 50 50 50 DQT, Row #2: 12 13 28 50 50 50 50 50 DQT, Row #3: 24 33 50 50 50 50 50 50 DQT, Row #4: 50 50 50 50 50 50 50 50 DQT, Row #5: 50 50 50 50 50 50 50 50 DQT, Row #6: 50 50 50 50 50 50 50 50 DQT, Row #7: 50 50 50 50 50 50 50 50 Approx quality factor = 74.74 (scaling=50.52 variance=0.19)
Marker: SOF0 (Baseline DCT) (xFFC0) OFFSET: 0x0000009E Frame header length = 17 Precision = 8 Number of Lines = 1427 Samples per Line = 1327 Image Size = 1327 x 1427 Raw Image Orientation = Portrait Number of Img components = 3 Component[1]: ID=0x01, Samp Fac=0x22 (Subsamp 1 x 1), Quant Tbl Sel=0x00 (Lum: Y) Component[2]: ID=0x02, Samp Fac=0x11 (Subsamp 2 x 2), Quant Tbl Sel=0x01 (Chrom: Cb) Component[3]: ID=0x03, Samp Fac=0x11 (Subsamp 2 x 2), Quant Tbl Sel=0x01 (Chrom: Cr) Marker: DHT (Define Huffman Table) (xFFC4) OFFSET: 0x000000B1 Huffman table length = 31
Destination ID = 0 Class = 0 (DC / Lossless Table) Codes of length 01 bits (000 total): Codes of length 02 bits (001 total): 00 Codes of length 03 bits (005 total): 01 02 03 04 05 Codes of length 04 bits (001 total): 06 Codes of length 05 bits (001 total): 07 Codes of length 06 bits (001 total): 08 Codes of length 07 bits (001 total): 09 Codes of length 08 bits (001 total): 0A Codes of length 09 bits (001 total): 0B Codes of length 10 bits (000 total): Codes of length 11 bits (000 total): Codes of length 12 bits (000 total): Codes of length 13 bits (000 total): Codes of length 14 bits (000 total): Codes of length 15 bits (000 total): Codes of length 16 bits (000 total): Total number of codes: 012
Marker: DHT (Define Huffman Table) (xFFC4) OFFSET: 0x000000D2 Huffman table length = 181
Destination ID = 0 Class = 1 (AC Table) Codes of length 01 bits (000 total): Codes of length 02 bits (002 total): 01 02 Codes of length 03 bits (001 total): 03 Codes of length 04 bits (003 total): 00 04 11 Codes of length 05 bits (003 total): 05 12 21 Codes of length 06 bits (002 total): 31 41 Codes of length 07 bits (004 total): 06 13 51 61 Codes of length 08 bits (003 total): 07 22 71 Codes of length 09 bits (005 total): 14 32 81 91 A1 Codes of length 10 bits (005 total): 08 23 42 B1 C1 Codes of length 11 bits (004 total): 15 52 D1 F0 Codes of length 12 bits (004 total): 24 33 62 72 Codes of length 13 bits (000 total): Codes of length 14 bits (000 total): Codes of length 15 bits (001 total): 82 Codes of length 16 bits (125 total): 09 0A 16 17 18 19 1A 25 26 27 28 29 2A 34 35 36 37 38 39 3A 43 44 45 46 47 48 49 4A 53 54 55 56 57 58 59 5A 63 64 65 66 67 68 69 6A 73 74 75 76 77 78 79 7A 83 84 85 86 87 88 89 8A 92 93 94 95 96 97 98 99 9A A2 A3 A4 A5 A6 A7 A8 A9 AA B2 B3 B4 B5 B6 B7 B8 B9 BA C2 C3 C4 C5 C6 C7 C8 C9 CA D2 D3 D4 D5 D6 D7 D8 D9 DA E1 E2 E3 E4 E5 E6 E7 E8 E9 EA F1 F2 F3 F4 F5 F6 F7 F8 F9 FA Total number of codes: 162
Marker: DHT (Define Huffman Table) (xFFC4) OFFSET: 0x00000189 Huffman table length = 31
Destination ID = 1 Class = 0 (DC / Lossless Table) Codes of length 01 bits (000 total): Codes of length 02 bits (003 total): 00 01 02 Codes of length 03 bits (001 total): 03 Codes of length 04 bits (001 total): 04 Codes of length 05 bits (001 total): 05 Codes of length 06 bits (001 total): 06 Codes of length 07 bits (001 total): 07 Codes of length 08 bits (001 total): 08 Codes of length 09 bits (001 total): 09 Codes of length 10 bits (001 total): 0A Codes of length 11 bits (001 total): 0B Codes of length 12 bits (000 total): Codes of length 13 bits (000 total): Codes of length 14 bits (000 total): Codes of length 15 bits (000 total): Codes of length 16 bits (000 total): Total number of codes: 012
Marker: DHT (Define Huffman Table) (xFFC4) OFFSET: 0x000001AA Huffman table length = 181
Destination ID = 1 Class = 1 (AC Table) Codes of length 01 bits (000 total): Codes of length 02 bits (002 total): 00 01 Codes of length 03 bits (001 total): 02 Codes of length 04 bits (002 total): 03 11 Codes of length 05 bits (004 total): 04 05 21 31 Codes of length 06 bits (004 total): 06 12 41 51 Codes of length 07 bits (003 total): 07 61 71 Codes of length 08 bits (004 total): 13 22 32 81 Codes of length 09 bits (007 total): 08 14 42 91 A1 B1 C1 Codes of length 10 bits (005 total): 09 23 33 52 F0 Codes of length 11 bits (004 total): 15 62 72 D1 Codes of length 12 bits (004 total): 0A 16 24 34 Codes of length 13 bits (000 total): Codes of length 14 bits (001 total): E1 Codes of length 15 bits (002 total): 25 F1 Codes of length 16 bits (119 total): 17 18 19 1A 26 27 28 29 2A 35 36 37 38 39 3A 43 44 45 46 47 48 49 4A 53 54 55 56 57 58 59 5A 63 64 65 66 67 68 69 6A 73 74 75 76 77 78 79 7A 82 83 84 85 86 87 88 89 8A 92 93 94 95 96 97 98 99 9A A2 A3 A4 A5 A6 A7 A8 A9 AA B2 B3 B4 B5 B6 B7 B8 B9 BA C2 C3 C4 C5 C6 C7 C8 C9 CA D2 D3 D4 D5 D6 D7 D8 D9 DA E2 E3 E4 E5 E6 E7 E8 E9 EA F2 F3 F4 F5 F6 F7 F8 F9 FA Total number of codes: 162
Marker: SOS (Start of Scan) (xFFDA) OFFSET: 0x00000261 Scan header length = 12 Number of img components = 3 Component[1]: selector=0x01, table=0x00 Component[2]: selector=0x02, table=0x11 Component[3]: selector=0x03, table=0x11 Spectral selection = 0 .. 63 Successive approximation = 0x00
Decoding SCAN Data OFFSET: 0x0000026F Scan Decode Mode: Full IDCT (AC + DC)
Lum (Tbl #0), MCU=[0,0] [0x0000026F.0]: ZRL=[ 0] Val=[ -100] Coef=[00= DC] Data=[0x F1 B2 CC 50 = 0b (11110001 1011---- -------- --------)] [0x00000270.4]: ZRL=[ 0] Val=[ 1] Coef=[01..01] Data=[0x B2 CC 50 70 = 0b (----001- -------- -------- --------)] [0x00000270.7]: ZRL=[ 0] Val=[ 2] Coef=[02..02] Data=[0x B2 CC 50 70 = 0b (-------0 110----- -------- --------)] [0x00000271.3]: ZRL=[ 0] Val=[ 2] Coef=[03..03] Data=[0x CC 50 70 37 = 0b (---0110- -------- -------- --------)] [0x00000271.7]: ZRL=[ 0] Val=[ 1] Coef=[04..04] Data=[0x CC 50 70 37 = 0b (-------0 01------ -------- --------)] [0x00000272.2]: ZRL=[ 0] Val=[ -3] Coef=[05..05] Data=[0x 50 70 37 03 = 0b (--0100-- -------- -------- --------)] [0x00000272.6]: ZRL=[ 0] Val=[ -1] Coef=[06..06] Data=[0x 50 70 37 03 = 0b (------00 0------- -------- --------)] [0x00000273.1]: ZRL=[ 2] Val=[ -1] Coef=[07..09] Data=[0x 70 37 03 90 = 0b (-111000- -------- -------- --------)] [0x00000273.7]: ZRL=[ 0] Val=[ -1] Coef=[10..10] Data=[0x 70 37 03 90 = 0b (-------0 00------ -------- --------)] [0x00000274.2]: ZRL=[ 1] Val=[ 2] Coef=[11..12] Data=[0x 37 03 90 2A = 0b (--110111 0------- -------- --------)] [0x00000275.1]: ZRL=[ 0] Val=[ -1] Coef=[13..13] Data=[0x 03 90 2A 43 = 0b (-000---- -------- -------- --------)] [0x00000275.4]: ZRL=[ 0] Val=[ 1] Coef=[14..14] Data=[0x 03 90 2A 43 = 0b (----001- -------- -------- --------)] [0x00000275.7]: ZRL=[ 1] Val=[ 1] Coef=[15..16] Data=[0x 03 90 2A 43 = 0b (-------1 1001---- -------- --------)] [0x00000276.4]: ZRL=[ 0] Val=[ -1] Coef=[17..17] Data=[0x 90 2A 43 2C = 0b (----000- -------- -------- --------)] [0x00000276.7]: ZRL=[ 0] Val=[ -1] Coef=[18..18] Data=[0x 90 2A 43 2C = 0b (-------0 00------ -------- --------)] [0x00000277.2]: ZRL=[ 0] Val=[ 0] Coef=[19..19] Data=[0x 2A 43 2C 89 = 0b (--1010-- -------- -------- --------)] EOB DCT Matrix=[ -800 6 -15 -8 12 0 0 0] [ 12 6 0 -10 13 0 0 0] [ 14 0 16 -12 0 0 0 0] [ -7 0 -11 0 0 0 0 0] [ -9 0 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0]
Lum (Tbl #0), MCU=[0,0] [0x00000277.6]: ZRL=[ 0] Val=[ 4] Coef=[00= DC] Data=[0x 2A 43 2C 89 = 0b (------10 0100---- -------- --------)] [0x00000278.4]: ZRL=[ 0] Val=[ 1] Coef=[01..01] Data=[0x 43 2C 89 13 = 0b (----001- -------- -------- --------)] [0x00000278.7]: ZRL=[ 0] Val=[ 5] Coef=[02..02] Data=[0x 43 2C 89 13 = 0b (-------1 00101--- -------- --------)] [0x00000279.5]: ZRL=[ 0] Val=[ 4] Coef=[03..03] Data=[0x 2C 89 13 3B = 0b (-----100 100----- -------- --------)] [0x0000027A.3]: ZRL=[ 0] Val=[ -3] Coef=[04..04] Data=[0x 89 13 3B 22 = 0b (---0100- -------- -------- --------)] [0x0000027A.7]: ZRL=[ 0] Val=[ -5] Coef=[05..05] Data=[0x 89 13 3B 22 = 0b (-------1 00010--- -------- --------)] [0x0000027B.5]: ZRL=[ 0] Val=[ 2] Coef=[06..06] Data=[0x 13 3B 22 E4 = 0b (-----011 0------- -------- --------)] [0x0000027C.1]: ZRL=[ 0] Val=[ 3] Coef=[07..07] Data=[0x 3B 22 E4 8D = 0b (-0111--- -------- -------- --------)] [0x0000027C.5]: ZRL=[ 0] Val=[ 2] Coef=[08..08] Data=[0x 3B 22 E4 8D = 0b (-----011 0------- -------- --------)] [0x0000027D.1]: ZRL=[ 0] Val=[ -3] Coef=[09..09] Data=[0x 22 E4 8D BD = 0b (-0100--- -------- -------- --------)] [0x0000027D.5]: ZRL=[ 0] Val=[ -2] Coef=[10..10] Data=[0x 22 E4 8D BD = 0b (-----010 1------- -------- --------)] [0x0000027E.1]: ZRL=[ 1] Val=[ 1] Coef=[11..12] Data=[0x E4 8D BD 38 = 0b (-11001-- -------- -------- --------)] [0x0000027E.6]: ZRL=[ 0] Val=[ 1] Coef=[13..13] Data=[0x E4 8D BD 38 = 0b (------00 1------- -------- --------)] [0x0000027F.1]: ZRL=[ 0] Val=[ -1] Coef=[14..14] Data=[0x 8D BD 38 1E = 0b (-000---- -------- -------- --------)] [0x0000027F.4]: ZRL=[ 1] Val=[ -2] Coef=[15..16] Data=[0x 8D BD 38 1E = 0b (----1101 101----- -------- --------)] [0x00000280.3]: ZRL=[ 3] Val=[ -1] Coef=[17..20] Data=[0x BD 38 1E F4 = 0b (---11101 00------ -------- --------)] [0x00000281.2]: ZRL=[ 2] Val=[ -1] Coef=[21..23] Data=[0x 38 1E F4 CD = 0b (--111000 -------- -------- --------)] [0x00000282.0]: ZRL=[ 0] Val=[ -1] Coef=[24..24] Data=[0x 1E F4 CD E7 = 0b (000----- -------- -------- --------)] [0x00000282.3]: ZRL=[ 6] Val=[ 1] Coef=[25..31] Data=[0x 1E F4 CD E7 = 0b (---11110 111----- -------- --------)] [0x00000283.3]: ZRL=[ 0] Val=[ 0] Coef=[32..32] Data=[0x F4 CD E7 CD = 0b (---1010- -------- -------- --------)] EOB DCT Matrix=[ 32 6 -25 16 -12 0 0 0] [ 30 -18 21 10 -26 0 0 0] [ 28 14 8 0 0 0 0 0] [ -21 0 0 -15 26 0 0 0] [ -18 0 -19 0 0 0 0 0] [ -12 0 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0]
Lum (Tbl #0), MCU=[0,0] [0x00000283.7]: ZRL=[ 0] Val=[ -3] Coef=[00= DC] Data=[0x F4 CD E7 CD = 0b (-------0 1100---- -------- --------)] [0x00000284.4]: ZRL=[ 1] Val=[ 3] Coef=[01..02] Data=[0x CD E7 CD 0C = 0b (----1101 111----- -------- --------)] [0x00000285.3]: ZRL=[ 0] Val=[ 1] Coef=[03..03] Data=[0x E7 CD 0C A0 = 0b (---001-- -------- -------- --------)] [0x00000285.6]: ZRL=[ 1] Val=[ 5] Coef=[04..05] Data=[0x E7 CD 0C A0 = 0b (------11 11001101 -------- --------)] [0x00000287.0]: ZRL=[ 0] Val=[ -1] Coef=[06..06] Data=[0x 0C A0 7A 73 = 0b (000----- -------- -------- --------)] [0x00000287.3]: ZRL=[ 0] Val=[ 2] Coef=[07..07] Data=[0x 0C A0 7A 73 = 0b (---0110- -------- -------- --------)] [0x00000287.7]: ZRL=[ 0] Val=[ -2] Coef=[08..08] Data=[0x 0C A0 7A 73 = 0b (-------0 101----- -------- --------)] [0x00000288.3]: ZRL=[ 0] Val=[ -1] Coef=[09..09] Data=[0x A0 7A 73 56 = 0b (---000-- -------- -------- --------)] [0x00000288.6]: ZRL=[ 0] Val=[ -1] Coef=[10..10] Data=[0x A0 7A 73 56 = 0b (------00 0------- -------- --------)] [0x00000289.1]: ZRL=[ 5] Val=[ -1] Coef=[11..16] Data=[0x 7A 73 56 27 = 0b (-1111010 0------- -------- --------)] [0x0000028A.1]: ZRL=[ 2] Val=[ 1] Coef=[17..19] Data=[0x 73 56 27 66 = 0b (-111001- -------- -------- --------)] [0x0000028A.7]: ZRL=[ 0] Val=[ 0] Coef=[20..20] Data=[0x 73 56 27 66 = 0b (-------1 010----- -------- --------)] EOB DCT Matrix=[ -24 0 25 -8 0 0 0 0] [ 18 0 14 0 -13 0 0 0] [ 7 -14 0 0 0 0 0 0] [ -7 0 0 0 0 0 0 0] [ -9 11 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0]
Lum (Tbl #0), MCU=[0,0] [0x0000028B.3]: ZRL=[ 0] Val=[ 8] Coef=[00= DC] Data=[0x 56 27 66 91 = 0b (---10110 00------ -------- --------)] [0x0000028C.2]: ZRL=[ 0] Val=[ 7] Coef=[01..01] Data=[0x 27 66 91 76 = 0b (--100111 -------- -------- --------)] [0x0000028D.0]: ZRL=[ 0] Val=[ 2] Coef=[02..02] Data=[0x 66 91 76 94 = 0b (0110---- -------- -------- --------)] [0x0000028D.4]: ZRL=[ 0] Val=[ 2] Coef=[03..03] Data=[0x 66 91 76 94 = 0b (----0110 -------- -------- --------)] [0x0000028E.0]: ZRL=[ 0] Val=[ 4] Coef=[04..04] Data=[0x 91 76 94 24 = 0b (100100-- -------- -------- --------)] [0x0000028E.6]: ZRL=[ 0] Val=[ -2] Coef=[05..05] Data=[0x 91 76 94 24 = 0b (------01 01------ -------- --------)] [0x0000028F.2]: ZRL=[ 1] Val=[ -2] Coef=[06..07] Data=[0x 76 94 24 1E = 0b (--110110 1------- -------- --------)] [0x00000290.1]: ZRL=[ 0] Val=[ 1] Coef=[08..08] Data=[0x 94 24 1E A1 = 0b (-001---- -------- -------- --------)] [0x00000290.4]: ZRL=[ 0] Val=[ -3] Coef=[09..09] Data=[0x 94 24 1E A1 = 0b (----0100 -------- -------- --------)] [0x00000291.0]: ZRL=[ 0] Val=[ 1] Coef=[10..10] Data=[0x 24 1E A1 0E = 0b (001----- -------- -------- --------)] [0x00000291.3]: ZRL=[ 0] Val=[ 1] Coef=[11..11] Data=[0x 24 1E A1 0E = 0b (---001-- -------- -------- --------)] [0x00000291.6]: ZRL=[ 0] Val=[ -1] Coef=[12..12] Data=[0x 24 1E A1 0E = 0b (------00 0------- -------- --------)] [0x00000292.1]: ZRL=[ 0] Val=[ 1] Coef=[13..13] Data=[0x 1E A1 0E 3F = 0b (-001---- -------- -------- --------)] [0x00000292.4]: ZRL=[ 3] Val=[ 1] Coef=[14..17] Data=[0x 1E A1 0E 3F = 0b (----1110 101----- -------- --------)] [0x00000293.3]: ZRL=[ 0] Val=[ -1] Coef=[18..18] Data=[0x A1 0E 3F 9D = 0b (---000-- -------- -------- --------)] [0x00000293.6]: ZRL=[ 0] Val=[ -3] Coef=[19..19] Data=[0x A1 0E 3F 9D = 0b (------01 00------ -------- --------)] [0x00000294.2]: ZRL=[ 0] Val=[ 1] Coef=[20..20] Data=[0x 0E 3F 9D 76 = 0b (--001--- -------- -------- --------)] [0x00000294.5]: ZRL=[ 1] Val=[ -1] Coef=[21..22] Data=[0x 0E 3F 9D 76 = 0b (-----110 00------ -------- --------)] [0x00000295.2]: ZRL=[11] Val=[ 1] Coef=[23..34] Data=[0x 3F 9D 76 18 = 0b (--111111 10011--- -------- --------)] [0x00000296.5]: ZRL=[ 0] Val=[ 0] Coef=[35..35] Data=[0x 9D 76 18 EA = 0b (-----101 0------- -------- --------)] EOB DCT Matrix=[ 64 42 -10 0 0 0 0 0] [ 12 24 -14 10 0 0 0 0] [ 14 7 -8 12 0 0 0 0] [ -21 9 -11 0 0 0 0 0] [ 9 -33 0 0 0 0 0 0] [ 12 -18 0 0 0 0 0 0] [ 0 32 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0]
Chr(0) (Tbl #1), MCU=[0,0] [0x00000297.1]: ZRL=[ 0] Val=[ 12] Coef=[00= DC] Data=[0x 76 18 EA 41 = 0b (-1110110 0------- -------- --------)] [0x00000298.1]: ZRL=[ 0] Val=[ 0] Coef=[01..01] Data=[0x 18 EA 41 B9 = 0b (-00----- -------- -------- --------)] EOB DCT Matrix=[ 108 0 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0]
Chr(0) (Tbl #1), MCU=[0,0] [0x00000298.3]: ZRL=[ 0] Val=[ -6] Coef=[00= DC] Data=[0x 18 EA 41 B9 = 0b (---11000 1------- -------- --------)] [0x00000299.1]: ZRL=[ 2] Val=[ 1] Coef=[01..03] Data=[0x EA 41 B9 96 = 0b (-110101- -------- -------- --------)] [0x00000299.7]: ZRL=[ 0] Val=[ 0] Coef=[04..04] Data=[0x EA 41 B9 96 = 0b (-------0 0------- -------- --------)] EOB DCT Matrix=[ -54 0 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0] [ 12 0 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0]
Scan Data encountered marker 0xFFD9 @ 0x00053957.0
Detailed IDCT Dump (RGB): MCU [ 0, 0]: [ x182239 x162037 x1A243B x1D273E x141E35 x0A142B x0F1930 x1E283F x1C263D x1D273E x19233A x141E35 x172138 x1D273E x1E283F x182239 ] [ x151F36 x131D34 x172138 x1C263D x162037 x0C162D x0E182F x182239 x1D273E x232D44 x1E283F x151F36 x1B253C x2B354C x273148 x162037 ] [ x111B32 x0F1930 x131D34 x1A243B x172138 x0E182F x0C162D x101A31 x162037 x202A41 x1D273E x111B32 x1B253C x2F3950 x283249 x0E182F ] [ x0E182F x0C162D x101A31 x172138 x182239 x101A31 x0A142B x0A142B x0A142B x111B32 x121C33 x0E182F x151F36 x202A41 x182239 x071128 ] [ x0C162D x0C162D x0F1930 x151F36 x172138 x121C33 x0B152C x081229 x061027 x061027 x0C162D x141E35 x151F36 x0E182F x081229 x081229 ] [ x0D172E x0E182F x101A31 x131D34 x141E35 x121C33 x0E182F x0B152C x0E182F x09132A x101A31 x1E283F x1B253C x0A142B x040E25 x0D172E ] [ x0F1930 x111B32 x121C33 x121C33 x111B32 x111B32 x111B32 x101A31 x162037 x131D34 x182239 x202A41 x1E283F x111B32 x09132A x0A142B ] [ x101A31 x131D34 x141E35 x111B32 x0F1930 x111B32 x131D34 x141E35 x19233A x1A243B x1B253C x1C263D x1C263D x182239 x0D172E x020C23 ] [ x172138 x1A243B x162037 x0E182F x0D172E x162037 x1E283F x202A41 x232D44 x212B42 x212B42 x252F46 x263047 x202A41 x111B32 x050F26 ] [ x182239 x19233A x151F36 x0E182F x0D172E x141E35 x1B253C x1D273E x2D374E x2A344B x263047 x232D44 x202A41 x182239 x0C162D x040E25 ] [ x19233A x19233A x151F36 x0E182F x0C162D x111B32 x162037 x182239 x2B354C x29334A x252F46 x202A41 x1B253C x162037 x121C33 x0F1930 ] [ x182239 x172138 x141E35 x0E182F x0C162D x0D172E x121C33 x141E35 x1B253C x1D273E x1E283F x1C263D x1A243B x19233A x1C263D x1F2940 ] [ x172138 x151F36 x121C33 x0F1930 x0C162D x0C162D x0F1930 x131D34 x141E35 x172138 x1B253C x1A243B x162037 x141E35 x162037 x19233A ] [ x141E35 x111B32 x101A31 x101A31 x0E182F x0C162D x0F1930 x141E35 x1B253C x1D273E x1D273E x19233A x121C33 x0C162D x09132A x09132A ] [ x111B32 x0E182F x0F1930 x111B32 x101A31 x0D172E x101A31 x162037 x202A41 x202A41 x1E283F x1A243B x162037 x121C33 x101A31 x0F1930 ] [ x0F1930 x0C162D x0E182F x121C33 x121C33 x0E182F x111B32 x182239 x1D273E x1C263D x1B253C x1C263D x1E283F x212B42 x242E45 x252F46 ]
Compression stats: Compression Ratio: 16.62:1 Bits per pixel: 1.44:1
Huffman code histogram stats: Huffman Table: (Dest ID: 0, Class: DC) # codes of length 01 bits: 0 ( 0%) # codes of length 02 bits: 1611 ( 5%) # codes of length 03 bits: 23739 ( 79%) # codes of length 04 bits: 3328 ( 11%) # codes of length 05 bits: 1058 ( 4%) # codes of length 06 bits: 144 ( 0%) # codes of length 07 bits: 0 ( 0%) # codes of length 08 bits: 0 ( 0%) # codes of length 09 bits: 0 ( 0%) # codes of length 10 bits: 0 ( 0%) # codes of length 11 bits: 0 ( 0%) # codes of length 12 bits: 0 ( 0%) # codes of length 13 bits: 0 ( 0%) # codes of length 14 bits: 0 ( 0%) # codes of length 15 bits: 0 ( 0%) # codes of length 16 bits: 0 ( 0%)
Huffman Table: (Dest ID: 1, Class: DC) # codes of length 01 bits: 0 ( 0%) # codes of length 02 bits: 10579 ( 71%) # codes of length 03 bits: 2646 ( 18%) # codes of length 04 bits: 1479 ( 10%) # codes of length 05 bits: 235 ( 2%) # codes of length 06 bits: 1 ( 0%) # codes of length 07 bits: 0 ( 0%) # codes of length 08 bits: 0 ( 0%) # codes of length 09 bits: 0 ( 0%) # codes of length 10 bits: 0 ( 0%) # codes of length 11 bits: 0 ( 0%) # codes of length 12 bits: 0 ( 0%) # codes of length 13 bits: 0 ( 0%) # codes of length 14 bits: 0 ( 0%) # codes of length 15 bits: 0 ( 0%) # codes of length 16 bits: 0 ( 0%)
Huffman Table: (Dest ID: 0, Class: AC) # codes of length 01 bits: 0 ( 0%) # codes of length 02 bits: 207100 ( 47%) # codes of length 03 bits: 57202 ( 13%) # codes of length 04 bits: 94523 ( 22%) # codes of length 05 bits: 40190 ( 9%) # codes of length 06 bits: 13856 ( 3%) # codes of length 07 bits: 13514 ( 3%) # codes of length 08 bits: 4977 ( 1%) # codes of length 09 bits: 4072 ( 1%) # codes of length 10 bits: 1572 ( 0%) # codes of length 11 bits: 899 ( 0%) # codes of length 12 bits: 277 ( 0%) # codes of length 13 bits: 0 ( 0%) # codes of length 14 bits: 0 ( 0%) # codes of length 15 bits: 17 ( 0%) # codes of length 16 bits: 446 ( 0%)
Huffman Table: (Dest ID: 1, Class: AC) # codes of length 01 bits: 0 ( 0%) # codes of length 02 bits: 30847 ( 59%) # codes of length 03 bits: 6588 ( 12%) # codes of length 04 bits: 7680 ( 15%) # codes of length 05 bits: 4431 ( 8%) # codes of length 06 bits: 2327 ( 4%) # codes of length 07 bits: 164 ( 0%) # codes of length 08 bits: 559 ( 1%) # codes of length 09 bits: 61 ( 0%) # codes of length 10 bits: 36 ( 0%) # codes of length 11 bits: 11 ( 0%) # codes of length 12 bits: 1 ( 0%) # codes of length 13 bits: 0 ( 0%) # codes of length 14 bits: 8 ( 0%) # codes of length 15 bits: 1 ( 0%) # codes of length 16 bits: 2 ( 0%)
YCC clipping in DC: Y component: [<0= 0] [>255= 0] Cb component: [<0= 0] [>255= 0] Cr component: [<0= 0] [>255= 0]
RGB clipping in DC: R component: [<0= 0] [>255= 0] G component: [<0= 0] [>255= 0] B component: [<0= 0] [>255= 0]
Average Pixel Luminance (Y): Y=[ 98] (range: 0..255)
Brightest Pixel Search: YCC=[ 1119, -105, 16] RGB=[255,255,230] @ MCU[ 56, 55]
Finished Decoding SCAN Data Number of RESTART markers decoded: 0 Next position in scan buffer: Offset 0x00053956.7
Marker: EOI (End of Image) (xFFD9) OFFSET: 0x00053957
Searching Compression Signatures
Signature: 0182408A81A4ABF04D4A34A8A5E98C58 Signature (Rotated): 012D821C6AB210E2A753BE053B8F55D0 File Offset: 0 bytes Chroma subsampling: 2x2 EXIF Make/Model: NONE EXIF Makernotes: NONE EXIF Software: NONE
Searching Compression Signatures: (3327 built-in, 0 user(*) )
EXIF.Make / Software EXIF.Model Quality Subsamp Match? ------------------------- ----------------------------------- ---------------- -------------- CAM:[SONY ] [CYBERSHOT U ] [ ] Yes SW :[Adobe Photoshop 7.0 ] [Save As 07 ] SW :[Apple Quicktime ] [0466-0467 ] SW :[Digital Photo Professiona] [05 ] SW :[IJG Library ] [075 ] SW :[MS Paint ] [ ] SW :[MS Visio ] [ ] SW :[ZoomBrowser EX ] [low ]
The following IJG-based editors also match this signature: SW :[GIMP ] [075 ] SW :[IrfanView ] [075 ] SW :[idImager ] [075 ] SW :[FastStone Image Viewer ] [075 ] SW :[NeatImage ] [075 ] SW :[Paint.NET ] [075 ] SW :[Photomatix ] [075 ] SW :[XnView ] [075 ]
Based on the analysis of compression characteristics and EXIF metadata:
ASSESSMENT: Class 1 - Image is processed/edited
HTML SOUCE CODE OF http://auqgnxjtvdbll3pv.onion/ (no linebreaks added)
<html><head><title>For Every Thing That Lives Is Holy</title><body><img src="[view-source:http://auqgnxjtvdbll3pv.onion/1033.jpg 1033.jpg]" /></body></html>
HTML OF .onion THROUGH MOZILLA DEVELOPER TOOLS
<html> <head> <title>For Every Thing That Lives Is Holy</title> </head> <---that line is not in code on onion
<body>
<img src="1033.jpg"></img> <--- in code there is src="1033.jpg" />
</body>
</html>
HTML OF .onion RAW SOURCE CODE
<html> <head> <title>For Every Thing That Lives Is Holy</title>
<body>
<img src="1033.jpg" />
</body>
</html> *Note missing trailing </head> in source code
ALTERNATIVE IMAGE LOCATIONS
http://commons.wikimedia.org/wiki/File:Newton-WilliamBlake.jpg
https://en.wikipedia.org/wiki/Nebuchadnezzar_%28Blake%29
https://en.wikipedia.org/wiki/The_Ancient_of_Days
https://en.wikipedia.org/wiki/Newton_%28Blake%29
http://commons.wikimedia.org/wiki/File:William_Blake_-_Nebuchadnezzar_(Minneapolis).jpg
There's also this [http:// http://www.quantum-chemistry-history.com/Sokal_Dat/my_Archive/Page%20bibliographique%20de%20Pierre%20Thuillier-Dateien/Thuillier02.jpg book]
Original source for central image is (a likely reversed painting) by Blake of Newton: http://en.wikipedia.org/wiki/File:Newton-WilliamBlake.jpg
PRINT SCREEN OF ONION 1
Resolution of jpg:
- 1327 *1427
HTTP BANNER ONION 1
HTTP/1.1 200 OK Date: Mon, 06 Jan 2014 14:24:13 GMT Server: Apache Last-Modified: Mon, 06 Jan 2014 07:43:43 GMT ETag: "9904-68-4ef486b41c9c0" Accept-Ranges: bytes Content-Length: 104 Vary: Accept-Encoding Content-Type: text/html
Converting the time 14:24:13 to seconds = 51853 prime
Converting the time 07:43:43 to seconds = 27823 prime
OUTGUESS FROM ONION 1
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Welcome. Good luck. 3301 e = 65537 n = 75579125746085351644267182920580212556413102071876330957950694457000592\ 10248050757270234679993673844203148013173091173786572116639 - -----BEGIN COMPRESSED RSA ENCRYPTED MESSAGE----- Version: 1.99 Scheme: Crypt::RSA::ES::OAEP eJwBswBM/zEwADE2MgBDeXBoZXJ0ZXh0LE2jxJS1EzMc80kOK+hra1GKnXgQKQgVitIy8NgA7kxn 2u8jNQDvlu0uymNNiu6XVCCn66axGH0IZ9w4Af3K/yRgjObsfA1Q7QqpXNALJ9FFPgYl5rh07cBP M9kbSH6DynU/5cYgQod2KymjWcIvKx3FkjV4UOGakDnBf1eQp1uwvn3KxDVwTyzPqbMnZvOA06Ec AfKtyz1hEK/UBXkeMeVrnV5SQQ== =yTUshDMKN65aPaKAR0OU8g== - -----END COMPRESSED RSA ENCRYPTED MESSAGE----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQIcBAEBAgAGBQJSyly/AAoJEBgfAeV6NQkPHhUP/R7nuYiTMw+3sbe0xV+4rmiN liSDmW6ibOK4UTkZDTeAS5kAKIjxCC3DwWi0lXqBGZyabojWHM2wRwYLOhvfKvgg DgPnW1BSZ/R67GaUy0CM/vtZOtktBeIdntlZamk9DpW5bQ311c7N9dy6uWc8+hOM umkcnT7u799zESazFgCeDSOw0cFgHDiG9UTAQxbe+NsXY/NKm4N0WAtgWmdte5ym dU8ImpmXWg8NChdn49UtuAACi8s8tcI/lHj1Yjh+AQRbO2+Ozn9eSxUAQ1TsXSgt 30jKmXI5ss4WHS16nYsS97BUbo4oX3NBXaCjSZb7fKO9CRJBo3gm2R8/NcIMIkEc GlQ/7rCQWHXA0MC+415ut5dcJf2ihwid81c1xsDyqQdfhEsWE/wVnK7Ujje+BgcO ybBHl8ejJzWhZkCvesHOmIo1RLEanxlGUC5jcRLqImrT7A9CrO+EVFW16EZpvzug Tsopo56+JbIFiIzAq+CGujHgDZnoHJFtB574utjOnZz9xzsVZ3lirQyAFOGauH+g K+XxjXjY8tT5lppAgmF3zWKqha7NoV+9FgFl2q2SS9ue+s4Joyn5PYKnICJeze3i K9BZ7gIT694s4dLEzu6kGaRyuNmx8qaoDs0kjvEB5pI+1buGuNAysHQWIDyY3DWb CjJ1AnBLY0ObxaMbWMR/ =d5E8 -----END PGP SIGNATURE-----
e = 65537
3.3.1. The rsa-sha1 Signing Algorithm
The rsa-sha1 Signing Algorithm computes a message hash as described
in Section 3.7 below using SHA-1 [FIPS.180-2.2002] as the hash-alg.
That hash is then signed by the signer using the RSA algorithm
(defined in PKCS#1 version 1.5 [RFC3447]) as the crypt-alg and the
signer's private key. The hash MUST NOT be truncated or converted
into any form other than the native binary form before being signed.
The signing algorithm SHOULD use a public exponent of 65537.
Source: http://www.ietf.org/rfc/rfc4871.txt
n = 75579125746085351644267182920580212556413102071876330957950694457000592\10248050757270234679993673844203148013173091173786572116639
3.3.3. Key Sizes
Selecting appropriate key sizes is a trade-off between cost,
performance, and risk. Since short RSA keys more easily succumb to
off-line attacks, signers MUST use RSA keys of at least 1024 bits for
long-lived keys. Verifiers MUST be able to validate signatures with
keys ranging from 512 bits to 2048 bits, and they MAY be able to
validate signatures with larger keys. Verifier policies may use the
length of the signing key as one metric for determining whether a
signature is acceptable.
Factors that should influence the key size choice include the
following:
o The practical constraint that large (e.g., 4096 bit) keys may not
fit within a 512-byte DNS UDP response packet
o The security constraint that keys smaller than 1024 bits are
subject to off-line attacks
o Larger keys impose higher CPU costs to verify and sign email
o Keys can be replaced on a regular basis, thus their lifetime can
be relatively short
o The security goals of this specification are modest compared to
typical goals of other systems that employ digital signatures
See [RFC3766] for further discussion on selecting key sizes.
Source: http://www.ietf.org/rfc/rfc4871.txt
PGP VALIDATION
PGP Validates - http://prntscr.com/2h1cvj
STEGDETECT
Stegdetect also detects jphide data inside this image
- Stegdetects commonly detects false positives
Our n is 130 decimal digit s long or 429 bit.
SIDE NOTE
For people who are not going to go the bruteforce way, they can check their p and q assumptions here: http://codeseekah.com/cicada/isp.php
It is important to note that p and q are not necessarily primes (i.e. nobody forced 3301 to use primes). (http://en.wikipedia.org/wiki/RSA_(cryptosystem)#Key_generation).
Also note that factoring will take a long time, so guessing might be a good approach as well - look at sets of emirps for example, there might be a 60-65 digit emirp/prime set out there that produces n.
WE ALMOST SAME PUZZLE IN 2012. But it was individualized, one before last one.
IF YOU RUN OUTGUESS ON THE IMAGE WITH KEY OF 3011 YOU GET THE FOLLOWING:
RSA
DAFUQ IS THIS RSA ? WHY DO WE HAVE TO FACTORIZE n ? HOW RSA KEY WORKS ?
- http://youtu.be/M7kEpw1tn50?t=54s
- https://www.cs.drexel.edu/%7Ejpopyack/IntroCS/HW/RSAWorksheet.html
- http://searchsecurity.techtarget.com/definition/RSA
- http://en.wikipedia.org/wiki/RSA_%28algorithm%29
- https://en.wikipedia.org/wiki/Primality_test
*p distinct prime number
*q distinct prime number
*n is used as the modulus for both the public and private keys. Its length, usually expressed in bits, is the key length.
(In cryptography, key size or key length is the size measured in bits of the key used in a cryptographic algorithm (such as a cipher).)
*e is released as the public key exponent.
RSA encryption and decryption
Assume that an RSA public key uses a modulus with j bits; its factors
are two numbers of about j/2 bits each. The expected computation
time for encryption and decryption are different. As before, we
denote the number of words in the machine representation of the
modulus by the symbol n.
Most implementations of RSA use a small exponent for encryption. An
encryption may involve as few as 16 squarings and one multiplication,
using n-by-n-word operations. Each operation must be followed by a
modular reduction, and therefore the time complexity is about 16*(.6
+ 1) + 1 + 1 ~= 28 n-by-n-word multiplies.
RSA decryption must use an exponent that has as many bits as the
modulus, j. However, the Chinese Remainder Theorem applies, and all
the computations can be done with a modulus of only n/2 words and an
exponent of only j/2 bits. The computation must be done twice, once
for each factor. The effort is equivalent to 2*(j/2) (n/2 by n/2)-
word multiplies. Because multiplying numbers with n/2 words is only
1/4 as difficult as multiplying numbers with n words, the equivalent
effort for RSA decryption is j/4 n-by-n-word multiplies.
If you double the size of the modulus for RSA, the n-by-n multiplies
will take four times as long. Further, the decryption time doubles
because the exponent is larger. The overall scaling cost is a factor
of 4 for encryption, a factor of 8 for decryption.
Source: http://tools.ietf.org/search/rfc3766#page-11
FACTORIZATION
- http://gilchrist.ca/jeff/factoring/benchmark.html
- http://gilchrist.ca/jeff/factoring/nfs_beginners_guide.html
- http://gilchrist.ca/jeff/factoring/index.html
FACTORIZING n FOR REAL
TOGETHER AS ONE DIVIDED BY ZERO
Our best self-motivated coders distributed factorization among their boxes:
- They used: http://cado-nfs.gforge.inria.fr/
- Number Field Sieve (NFS) algorithm.
- Currently on final step.
- Expect results "In Time."
- http://en.wikipedia.org/wiki/General_number_field_sieve
- I cant find any videos describing what NFS is
- http://www.youtube.com/watch?v=x_8YtOfKA0Q
- add if you find some
- http://primes.utm.edu/notes/rsa130.html
- Please read what GNFS is in respect to others doing hard work
SOLUTION GOES HERE
factors of our prime:
n= 7557912574608535164426718292058021255641310207187633095795069445700059210248050757270234679993673844203148013173091173786572116639
are:
p=97513779050322159297664671238670850085661086043266591739338007321 q=77506098606928780021829964781695212837195959082370473820509360759
NEXT STEP
Next step will be to use the two prime numbers, *p & *q, to recreate the private RSA KEY and decrypt the message:
-----BEGIN COMPRESSED RSA ENCRYPTED MESSAGE----- Version: 1.99 Scheme: Crypt::RSA::ES::OAEP eJwBswBM/zEwADE2MgBDeXBoZXJ0ZXh0LE2jxJS1EzMc80kOK+hra1GKnXgQKQgVitIy8NgA7kxn 2u8jNQDvlu0uymNNiu6XVCCn66axGH0IZ9w4Af3K/yRgjObsfA1Q7QqpXNALJ9FFPgYl5rh07cBP M9kbSH6DynU/5cYgQod2KymjWcIvKx3FkjV4UOGakDnBf1eQp1uwvn3KxDVwTyzPqbMnZvOA06Ec AfKtyz1hEK/UBXkeMeVrnV5SQQ== =yTUshDMKN65aPaKAR0OU8g== -----END COMPRESSED RSA ENCRYPTED MESSAGE-----
Script that does all this in one step:
- Script for decryption (insert correct p, q, e and encrypted message)
- ! copy script from Raw Paste Data on bottom of pastebin page
- pastebin formatting from normal window causes:
- Uncaught exception from user code: Breached Armour.
- To fix it you have to move the my $plaintext and the message to the beginning of the line
- Winfags need: http://strawberryperl.com/ (dont forget to set paths: http://prntscr.com/2h0193)
CLUES WITHIN ONION 1 IMAGE
Clear explication of the "clues" in the image: http://chosenhalfblood.blogspot.com/2014/01/jpg-artifacts-in-newton-by-blake.html
[23:00:57] <onecool> anyone see this clue in the image? http://i.imgur.com/HNKXdXo.jpg
POSSIBLE CLUE 1
A possible clue was found within the image. It appears to be upside down text. If you rotate the image you get the following:
A zoomed in image is as follows:
Further Proof it is actual text on the picture rather "jpeg artifacts"
After inspecting 10+ pictures online it seems as if the picture they used originally to edit/crop was the picture from wikipedia: http://en.wikipedia.org/wiki/File:Newton-WilliamBlake.jpg
Colors match up, size match up (perfectly overlay)
But also after overlaying them perfectly and applying the difference option in layer settings you clearly see this:
Cropped: http://i.imgur.com/P6Bg828.jpg
Also after zooming in and having both layers in normal mode and making a gif turning on and off the top layer you can clearly see it is not just jpg artifact but definate lines. and shapes in a white color font: *Red text added so you know which version(s) you are seeing.
http://gyazo.com/d92c9999e6e2cc62b4a2025bcc01cf72
Top line: MMMCCCI (or 3301) <- Assumptions
Bottom line (rotated 180 degrees): MXXXIII (or 1033) <- Assumptions
POSSIBLE EXPLANATIONS
MXXXIII
ue.1033.www
<doodleninja> http://www.3301.eu/
<doodleninja> umm
<doodleninja> its ue.1033.www
<doodleninja> backwards
FURTHER INVESTIGATION
- The site gives a 403 forbidden.
- Telnet connection didn't give any results.
- A hosting report gave the info that the server is located on a german hosting service.
- An nmap output report can be found here: http://pastebin.com/PzM2esF9
- IP Address of that server is 85.13.135.112
The next idea was FTP it was portscanned, 21 was found to be open, some people connected to it but no password was found. however, username was never prompted.
Dump of FTP: Connected to 85.13.135.112. 220 FTP on dd13608.kasserver.com ready Name:
- Not sure if typo above, I connected to the FTP server from my linux box and the server did in fact respond to "user" commands. System type is UNIX. Tried all the obvious (u: 3301 p: cicada, guest guest, etc) but to no avail. I suspect that this isn't a red herring but an access point to which we haven't found the right clues. There is very likely a username/password combination which will lead to a file on the system not unlike the OS they distributed last year (mp3 files, etc). IMHO by posting the link they are inviting people to the challenge but I'm hesitant to do a full-on penetration test (hint, someone else who doesn't care as much about breaking the law might want to try it...)
~ xl
The 3301.eu site uses domain privacy. I located the following information, which is publicaly available and has not been shared yet on the IRC channel.
Domain Name 3301 Status REGISTERED (What this means) Registered August 16, 2008 Expiry Date August 31, 2014 Last update July 5, 2011, 5:19 pm Registrant Name Boris Biedenbacher Organisation 3301 Agentur fuer Kommunikationsdesign UG Language German Address Konsul-Smidt-Strasse 8p 28217 Bremen Germany
Phone +49.4215966254 Fax Email biedenbacher@33null1.de Onsite Name Werner Kaltofen Organisation Neue Medien Muennich GmbH Language German
(German) Manchmal muss man sich auf den Kopf stellen, um herauszufinden was dahinter steckt...
Meaning something like (was translated by a native) (English) Sometimes, one must turn upside down (Literally: "stand on one's head", idiom for having to do really complicated things) to find out what's behind (this)...
- Refers to head, check source of page for header information:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />
<title>3301</title>
<style type="text/css">
</style>
</head>
<body>
<a href="http://www.we-are-design.de"><img src="3301.jpg" border="0"></a>
</body> </html>
The image points to [1]
This page is big but there are two interesting sections...
I manually typed it out and ran it through Babelfish..
GERMAN: Ausgerechnet du warst es, der uns vor den lodernden Flammen unmittelbar neben unserem Bürogebaude beschÜtzte, indem Du sie von uns weg gescheucht hast.
Wir werden es Dir nachsehen, dass Du vor gar nicht allzu langer Zeit unserem Baum das letzte Blatt klauen woltest (wir berichteten). Und auch, wenn Du uns in naher Zukunft die Frisur zerstörst oder uns im Herbst den Regen ins Gesicht peitschst, können wir Dir wohl so schnell nicht mehr böse sein... Danke, lieber Wind.
ENGLISH: You of all people protected us from the blazing flames next to to our office block by blowing them away from us.
We will overlook that you tried to steal the last leaf of our tree not long ago (we reported). And also, if you destroy our hair or blow the rain in our face in autumn, we can't be angry with you so quickyl... Thank you, dear wind.
It does refer to "wind" which I found interesting from the IRC logs....
The second section seems more interesting:
Again, running it through Babelfish:
GERMAN: Alle Achtung! Ein Blatt schaukelt noch am Baum vor unserem Büro in der Überseestadt Bremen im Kampf gegen den groben unsichtbaren Riesen: Herrn Wind. Wir haben ein Auge auf dich...
ENGLISH: Wow! (Literally: "All/Every caution") A leaf rocks on the tree in front of our office in the overseas town of Bremen in the fight against the big, invisible giant: Mr wind. We have an eye on you...
Invisible giants... Mr. Wind. I threw the address for the site listed in the DNS records into Google maps hoping that maybe there was a clue (a sign in a window when the streetview car went past) but alas, no such luck. I'm still prowling through there.
~xl
Onion2 String Color Coded
NORMAL http://jsbin.com/UXIlAsA/1/ NORMAL REV http://jsbin.com/IqurEDeb/1/ XOR each byte 3301 http://jsbin.com/oXobOjEb/1/ REV XOR each byte 3301 http://jsbin.com/oYujiDo/1/