Changes: CICADA 3301 2014 PUZZLE FACTS PART 9

Revision as of 21:12, 11 December 2014

A life sign

On May 2nd 2014 about 10:00 GMT, 3301 sent out messages to all hidden services previously registered on Onion 6. The requests made on the hidden services looked like this:

127.0.0.1 - - [02/May/2014:10:**:** +0200] "GET /key.asc HTTP/1.1" 200 * "-" "Cicada/33.01 CicaDOS 1.033 E Edition"PP
127.0.0.1 - - [02/May/2014:10:**:** +0200] "GET / HTTP/1.1" 200 * "-" "Cicada/33.01 CicaDOS 1.033 E Edition"
127.0.0.1 - - [02/May/2014:11:**:** +0200] "POST /cgi-bin/upload HTTP/1.1" 200 * "-" "Cicada/33.01 CicaDOS 1.033 S Edition"

They requested the public key and and the root before uploading a file named message.txt.asc to the hidden service. The file contained a valid signature and a link to a new onion. As it appears, the emails sent to different people were identical.

05/13/2014

The message above is malformed. It was found that there are ascii spaces in the message (the last 31 have to be 37):

<Totry> so anyway, that sequence - 2,3,5,7,11,13,17,23,29,31,31 - no-one have a clue why 19 is missing
[...]
<Totry> in the interests of moving things along....that sequence is written in ascii spaces (20) in the message
[...]
<nikkler> Hello.xxYourxenlightenmentxawaitsxyou.xx$
<nikkler> xxx$
<nikkler> xxxxxky2khlqdf7qdznac.onionxxxxxxx$
<nikkler> xxxxxxxxxxx$
<nikkler> Wexlookxforwardxtoxhearingxfromxyou.$
<nikkler> xxxxxxxxxxxxx$
<nikkler> xxxxxxxxxxxxxxxxx$
<nikkler> Goodxluck.xxxxxxxxxxxxxxxxxxxxxxx$
<nikkler> xxxxxxxxxxxxxxxxxxxxxxxxxxxxx$

<nikkler> xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxbearnings$

Onion 7 - ky2khlqdf7qdznac.onion

The onion from the message was running a thttpd server, version 2.25b. It was modified on April 2nd 08:33:19 GMT, meaning it took 3301 one month to set the website up and they let us wait another month before finally uploading a message. The page contained 58 images, all written in Runes and part of the Liber Primus as it seems.

Header:

Server:	thttpd/2.25b 29dec2003
Last-Modified:	Wed, 02 Apr 2014 08:33:19 GMT
Date:	Fri, 02 May 2014 11:32:45 GMT
Content-Type:	text/html; charset=iso-8859-1
Connection:	close
Accept-Ranges:	bytes

Source code:

   < html >
   < head >< title >133</ title ></ head >
   < body >
   < div id="331" >
   < img src="0.jpg" />< br />
   < img src="1.jpg" />< br />
   < img src="2.jpg" />< br />
   < img src="3.jpg" />< br />
   < img src="4.jpg" />< br />
   < img src="5.jpg" />< br />
   < img src="6.jpg" />< br />
   < img src="7.jpg" />< br />
   < img src="8.jpg" />< br />
   < img src="9.jpg" />< br />
   < img src="10.jpg" />< br />
   < img src="11.jpg" />< br />
   < img src="12.jpg" />< br />
   < img src="13.jpg" />< br />
   < img src="14.jpg" />< br />
   < img src="15.jpg" />< br />
   < img src="16.jpg" />< br />
   < img src="17.jpg" />< br />
   < img src="18.jpg" />< br />
   < img src="19.jpg" />< br />
   < img src="20.jpg" />< br />
   < img src="21.jpg" />< br />
   < img src="22.jpg" />< br />
   < img src="23.jpg" />< br />
   < img src="24.jpg" />< br />
   < img src="25.jpg" />< br />
   < img src="26.jpg" />< br />
   < img src="27.jpg" />< br />
   < img src="28.jpg" />< br />
   < img src="29.jpg" />< br />
   < img src="30.jpg" />< br />
   < img src="31.jpg" />< br />
   < img src="32.jpg" />< br />
   < img src="33.jpg" />< br />
   < img src="34.jpg" />< br />
   < img src="35.jpg" />< br />
   < img src="36.jpg" />< br />
   < img src="37.jpg" />< br />
   < img src="38.jpg" />< br />
   < img src="39.jpg" />< br />
   < img src="40.jpg" />< br />
   < img src="41.jpg" />< br />
   < img src="42.jpg" />< br />
   < img src="43.jpg" />< br />
   < img src="44.jpg" />< br />
   < img src="45.jpg" />< br />
   < img src="46.jpg" />< br />
   < img src="47.jpg" />< br />
   < img src="48.jpg" />< br />
   < img src="49.jpg" />< br />
   < img src="50.jpg" />< br />
   < img src="51.jpg" />< br />
   < img src="52.jpg" />< br />
   < img src="53.jpg" />< br />
   < img src="54.jpg" />< br />
   < img src="55.jpg" />< br />
   < img src="56.jpg" />< br />
   < img src="57.jpg" />< br />
   </ div >
   </ body >
   </ html >

The images from onion 7 can be found here .

Imgur gallery of all 58 new rune pages is here: http://imgur.com/a/8xnWx#0

Requesting a non existent file resulted in a 404 page giving the port used by the server:

Apache Server at 127.0.0.1 Port 5243

Trying to connect to the server with telnet resulted in the following error:

UNKNOWN 400 BaO'[d Request
Server: thttpd/2.25b 29dec2003
Content-Type: text/html; charset=iso-8859-1
Date: Fri, 02 May 2014 11:46:39 GMT
Last-Modified: Fri, 02 May 2014 11:46:39 GMT
Accept-Ranges: bytes
Connection: close
Cache-Control: no-cache,no-store

<HTML>
      <HEAD><TITLE>400 Bad Request</TITLE></HEAD>
      <BODY BGCOLOR="#cc9999" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc">
      < H2>400 Bad Request< /H2>
                   Your request has bad syntax or is inherently impossible to satisfy.
      < HR>
          <ADDRESS><A HREF="http://www.acme.com/software/thttpd/">thttpd/2.25b 29dec2003</A></ADDRESS>
      </BODY>
</HTML>

Transcription of Runes

Transcription is currently in progress and can be found here.

You can find the latest transcript here.

Page 15

A discussion of the matrix on page 15 can be found here:

http://uncovering-cicada.wikia.com/wiki/Onion_7:_numbers_on_page_15

[[Media:--67.191.39.104 02:23, November 4, 2014 (UTC)Example.ogg67.191.39.104 02:23, November 4, 2014 (UTC)]]

Page 49,50,51

These pages contain the following ASCII text:

3N 3p 2l 36 1b 3v 26 33 1W 49 2a 3g 47 04 33 3W 21 3M 0F 0X 1g 2H 0x 1R 1n 3I 2r 0P 2U 16 2L 2D 1t 1s 3H 0d 0s 1K 2D 05 1K 1O 0S 1D 3o 1l 3J 1G 4D 0G 0l 0x 1Q 2p 2a 1K 4E 1w 2Q 19 1k 3G 24 0p 22 4F 0P 3C 3J 1D 2n 1m 2i 1J 3P 2v 1s 2O 0k 1M 2M 0w 3L 3D 2r 0S 1p 15 3V 3e 3I 0n 3u 1O 0u 0Z 3g 2U 1C 0Y 1N 3n 0W 3Q 22 13 0V 3c 0E 34 0W 1t 1D 2N 3H 47 0s 2p 0Z 34 0g 3v 1Q 0s 0D 0K 2h 3D 3L 2x 1Q 20 2n 2L 1C 2p 0A 29 3r 0D 45 0k 2e 2W 25 3U 1W 2r 46 2s 2X 39 3p 0X 0E 1q 0q 4B 49 48 3r 3b 3C 1M 1j 0I 4A 48 40 3m 4E 0s 2S 1v 3T 0I 3t 2B 2k 2t 2O 0e 2l 1L 28 2a 0J 1L 0c 3C 2o 0X 00 2Z 2d 1T 2u 1t 1j 0l 1o 1E 3T 18 3E 1G 27 0L 0v 2t 06 11 1A 2U 4B 1O 2M 3d 2S 0x 0w 0q 0p 2V 18 0q 1D 49 2O 00 1v 2t 1k 3s 3G 21 3w 0W 29 2r 2O 2L 0g 3Y 0M 0u 3I 3C 1r 2c 2q 3o 30 0a 39 1K

The first digit is always '0', '1', '2' or '3'. The last letter falls within '[0-9A-Za-x]', exactly 60 values. The maximum value is '4F'. This suggests a sexagesimal (base 60) counting system, where '4F' would correspond to '255'. The text can be rewritten in hexadecimal as follows:

CBE7A7BA61ED7EB75CF99CDEF704B7D479CA0F2166893B576DC6AD1996428D857372C5273650850550541C49E66BC74CFD102F3B56AB9C50FE7692456AC47C337AFF19C0C749A96CA44FCDB172902E528E3AC9C1AD1C6F41D3DCC631EC543823DE96482253E520CE7A3F1FDA0EB82073498FC5F736AB23B82AED56360D14A3C1C9B35678A98D48AB0A81E90DF52EA0987DD25CADF6AE99BDE7210E7034FBF9F8E9D9C0526912FAF8F0E4FE369475D112EB83A6AF9028A751809C135126C0AA21009B9F59B073692F6E4AD144C24C7F1539AF063D4696FB548EDB943B3A343397443449F9900075AF6AEAC479EE2081AD908D2AD61638C6C0719EACE6B424BD50

Page 33 to 39 contain a hint in the form of Cuneiform numbers. These represent the numbers '17' '13' '55' and '1'. In base 60: 17*60+13 = 1033 and 55*60+1 = 3301

Page 49

Page 49 contains:

3N 3p 2l 36 1b 3v 26 33     
1W 49 2a 3g 47 04 33 3W             
21 3M 0F 0X 1g 2H 0x 1R
1n 3i 2r 0P 2U 16 2L 2D
1t 1s 3H 0d 0s 1K 2D 05
1K 1O 0S 1D 3o 1L 3J 1G
4D 0G 0L 0x 1Q 2p 2a 1K
4E 1w 2Q 19 1k 3G 24 0p
22 4F 0P 3C 3J 1D 2n 1m
2i 1J 3P 2v 1s 2O 0k 1M

Page 50

Page 50 contains:

2M 0w 3L 3D 2r 0S 1p 15
3V 3e 3I 0n 3u 1O 0u 0Z
3g 2U 1C 0Y 1N 3n 0W 3Q
22 13 0V 3c 0E 34 0W 1t
1D 2N 3H 47 0s 2p 0Z 34
0g 3v 1Q 0s 0D 0K 2h 3D
3L 2x 1Q 20 2n 2L 1C 2p
0A 29 3r 0D 45 0k 2e 2W
25 3U 1W 2r 46 2s 2X 39
3p 0X 0E 1q 0q 4B 49 48
3r 3b 3C 1M 1j 0l 4A 48
40 3m 3E 0s 2s 1v 3T 0i
3t 2B 2k 2t 2O 0e 2L 1L

Page 51

Page 51 contains:

28 2a 0J 1L 0c 3C 2o 0X
00 2Z 2d 1T 2u 1t 1j 0L
1o 1E 3T 18 3E 1G 27 0L
0v 2t 06 11 1A 2U 4B 1O
2M 3d 2S 0x 0w 0q 0p 2V
18 0q 1D 49 2O 00 1v 2t
1k 3s 3G 21 3w 0W 29 2r
2O 2L 0g 3Y 0M 0u 3i 3C
1r 2c 2q 3o 30 0a 39 69

Page 56

Take the runes on page 56 (http://imgur.com/a/8xnWx#56) and encode them to numbers 0 to 28. Shift them with a stream of (prime numbers, modulo 29) -1, then the runes decode to:

AN END. WITHIN THE DEEP WEB TH

ERE EXISTS A PAGE THAT HA

SHES TO:

36367763ab73783c7af284446c

59466b4cd653239a311cb7116

d4618dee09a8425893dc7500b

464fdaf1672d7bef5e891c6e227

4568926a49fb4f45132c2a8b4

IT IS THE DUTY OF EUERY PILGR

IM TO SEEK OUT THIS PAGE.

This can be interpreted as the hash of an onion page.

Page 57

Page 57 (http://imgur.com/a/8xnWx#57) contains the following text in unencrypted runes:

Parable : like the instar tunneling to the surface.

We must shed our own circumferences. Find the

divinity within and emerge.

This parable appeared in 2013.

<a href="tel:0421812877725">0421812877725</a>. (scanned from mayfly, most likely redlaser glitch)

digits are most likely glitch with red laser. Saved just in case.

Symbols from onion 7

Here is archive of /x/ thread

http://archive.4plebs.org/x/thread/14547165/

We figured out so far that: cuneiform means indeed <a href="tel:1033 3301">1033 3301</a> (see above)

It's Babylonian and Babylonians had sexagesimal numeral system.

Probably a hint to base60.

The blurred tree-like thing is a dendrite.

Celery-like thing on the right site of the picture probably is a dendrite too.

The two flies in the centre are mayflies.no.

The fly in the top left is an Ephemeridae.

Update

There are 58 pages in total, labled 0-57. 57 is the most accurate integer that can be squared to reach a number closest to 3301. It cannot be a coincidence.

This leads me to believe that the page number is extremely relevant to solving the next stage of this puzzle. Seeing as page 57 is unencrypted, I believe that we are looking for an encryption where the page number (x) can be substituted with 57 (or 58) to equal 0, since the 57th (or possibly 58th if you count the number of pictures) runic page is unencrypted.

Calculating the number 3301 in Base58 gives "ur," which is a Sumerian city. This supports the idea of Cuneiform, and also adds the possibility of x being 58.

I will continue to post my findings.

-Near

--

Nothing new for long time. I guess it is over this time.