Uncovering Cicada Wiki
Don't have an account?
Register
Advertisement
Register
Uncovering Cicada Wiki
Uncovering Cicada Wiki
125
pages

MAIN CICADA 3301 2014 PAGE PART 2

View source

This is part 2 of main Cicada 3301 2014 wiki article. It is discontinued, readonly now. Please dont add new things anymore. Repairing mistakes and adding missing information is appreciated.

Cicada 3301 2014 Main articles and Subpages

Subpages, tools, splinter groups, other sources...

Subpages: Hot Links:

Warm Links:

/dev/random

'Some other groups and pages

If you want to add your link on this menu PM Lurker69

ONION 2 CICADA 3301 2014  Short (256 bytes) growing string)

At the end of Part 1, linked to above, we had a single resource: 

cu343l33nqaekrnw.onion
A7kfqA2

This site will be refererd to as onion 2 in wikia.


To open the url as it is, download the Tor Browser Bundle . If this is not an option to you, you can visit the pages through the .onion.to or the .tor2web.org pages. This does not require the Tor Browser Bundle, however, you give up some anonymity doing this.

As of 04:00 GMT 11.1.2014, http://cu343l33nqaekrnw.onion/ is not accesible anymore.

Upon visiting the address, the following document was displayed, the string it contained grew gradually: 

<!--Patience is a virtue-->

634292ba49fe336edada779a34054a335c2ec12c8bbaed4b92dcc05efe98f76abffdc2389bdb9de2cf20c009acdc1945ab095a52609a5c219afd5f3b3edf10fcb25950666dfe8d8c433cd10c0b4c72efdfe12c6270d5cfde291f9cf0d73cb1211140136e4057380c963d70c76948d9cf6775960cf98fbafa435c44015c5959837a0f8d9f46e094f27c5797b7f8ab49bf28fa674d2ad2f726e197839956921dab29724cd48e1a81fc9bab3565f7513e3e368cd0327b47cf595afebb78d6b5bca92ba021cd6734f4362a0b341f359157173b53d49ea5dff5889d2c9de6b0d7e8c615286ce596bfa83f50b6eeabd153aaf50cd75f39929ba11fb0f8e8d611442846


Note the HTML comment that reads "Patience is a virtue". This soon became evident. We also noticed that every few minutes, another 2 characters, or 1 byte in hex representation, were appended to the end of that string.

This process continued for approximately 23 hours. The intervals between new bytes were found to be seemingly random multiples of five. A sample of the data collected:

Clock Time 00 20 25 35 50 05 15 20 45 00 15 20 40 45 05 10 15 30 40 15
Interval -- 20 05 10 15 15 10 05 25 15 15 05 20 05 20 05 05 15 10 35
Interval / 5 -- 04 01 02 03 03 02 01 05 03 03 01 04 01 04 01 01 03 02 07
Data added 26 e1 97 83 99 56 92 1d ab 29 72 4c d4 8e 1a 81 fc 9b ab 35



TIMESTAMPS FROM ONION 2 VER 1 GROWING STRING UPDATES BY BotSottile

Datasets were collected by various users. No guarantees of completeness:

http://pastebin.com/5bTLHqCN (Credit: Cripion101)

http://imgur.com/lTRRxTT

http://pastebin.com/qn8jmPJr (GMT +1)

http://i.imgur.com/prAeqPS.png

FULL  SHORT STRING  512 character or 256 BYTES LONG

After 23 hours, the process stopped and no more characters/bytes were appended to the string. The final string was:

634292ba49fe336edada779a34054a335c2ec12c8bbaed4b92dcc05efe98f76abffdc2389bdb9de2cf20c009acdc1945ab095a52609a5c219afd5f3b3edf10fcb25950666dfe8d8c433cd10c0b4c72efdfe12c6270d5cfde291f9cf0d73cb1211140136e4057380c963d70c76948d9cf6775960cf98fbafa435c44015c5959837a0f8d9f46e094f27c5797b7f8ab49bf28fa674d2ad2f726e197839956921dab29724cd48e1a81fc9bab3565f7513e3e368cd0327b47cf595afebb78d6b5bca92ba021cd6734f4362a0b341f359157173b53d49ea5dff5889d2c9de6b0d7e8c615286ce596bfa83f50b6eeabd153aaf50cd75f39929ba11fb0f8e8d611442846

The total amount of characters is 512. Separated into groups of 4, with 10 columns, the data becomes: 

6342 92ba 49fe 336e dada 779a 3405 4a33 5c2e c12c 
8bba ed4b 92dc c05e fe98 f76a bffd c238 9bdb 9de2 
cf20 c009 acdc 1945 ab09 5a52 609a 5c21 9afd 5f3b
3edf 10fc b259 5066 6dfe 8d8c 433c d10c 0b4c 72ef
dfe1 2c62 70d5 cfde 291f 9cf0 d73c b121 1140 136e
4057 380c 963d 70c7 6948 d9cf 6775 960c f98f bafa
435c 4401 5c59 5983 7a0f 8d9f 46e0 94f2 7c57 97b7
f8ab 49bf 28fa 674d 2ad2 f726 e197 8399 5692 1dab
2972 4cd4 8e1a 81fc 9bab 3565 f751 3e3e 368c d032
7b47 cf59 5afe bb78 d6b5 bca9 2ba0 21cd 6734 f436
2a0b 341f 3591 5717 3b53 d49e a5df f588 9d2c 9de6
b0d7 e8c6 1528 6ce5 96bf a83f 50b6 eeab d153 aaf5
0cd7 5f39 929b a11f b0f8 e8d6 1144 2846



<Lurker69> i wonder what was point of first string
<Lurker69> did cicada change plan?
<Bl4ckF0X> Lurker69 I think they wanted to keep us busy
<Lurker69> buying time?
<Bl4ckF0X> yeah


One of us noticed that if you interpret this data as a monochromatic bitmap, some interesting images can be obtained. When you asume that the bitmap is 25 pixels wide, the result is:

http://postimg.org/image/yukab2cjx/

Using different widths, one obtains these:

http://postimg.org/image/4hgmiqo7h/

http://postimg.org/image/db7h08q0j/2fd3ffe1/



DO NOT DELETE UNTIL SOLVED (LOOSE END)

WE DONT HAVE ANY  IDEA OF PURPOSE OF THIS STRING

added on 11.1.2014, .onion 3 stopped updating, displaying similar string, same lenght 256 bytes; 'more on main 2014 page 3'

DO NOT DELETE UNTIL SOLVED (LOOSE END)

ONION 2 LONG STRING <!---761---> with 3 jpgs

However at 05:31:40 GMT -- about an hour after the string was complete -- the document changed. The old 512-character code was gone, along with the HTML comment. In its place:

Screenshot 31

printscreen of onion 2 with second string








The full source is quite large. It is archived at:

https://infotomb.com/oyfhl.txt


String as a PDF file:

https://drive.google.com/file/d/0B8agGVBzeYO6OHR5bktUYmpjZWc/edit?usp=sharing

Note that the HTML comment was changed from 

<!--Patience is a virtue-->

to 

<!--761-->


Taking the sum of the phrase "Patience is a virtue" using the Gematria Primus results in the number 761.


The new string was 3641299 characters long. It contained a significant amounts of repeated text.

Lenght of full html: 378FDE = 3641310 bytes

Lenght of string:  378FD2 = 3641298 bytes



761 is a prime, and was used in Cicada 2013 as the file name of a clue in the form of an mp3 -- "The Instar Emergence".

761 is also a palindromic prime EMIRP -- 167, its reverse, is a prime number as well.

DECODING STRING

Analsysis of this new string revealed that it contained three JPEG image files. To obtain them, we:

1.   Converted the string into its binary representation
2.   Every byte of string has to be XORed with 0xFF (11111111); we can achieve same efect if we invert every bit (1 beocmes 0 and 0 becomes 1)0x00 0x27 | 0x00 -> 0xFF
  0x00     0x27         |                          0x00 -> 0xFF
00000000 00100111 XOR   | OR just reverse bits   00000000 -> 1111111     
11111111 11111111  =    |                      
11111111 11011000       |                          0x27   ->  0xD8    
  0xFF     0xD8         |                        00100111 -> 11011000

3.   Discovered the byte sequence that indicates the beginning of a JPG image (0xFF 0xD8)

4.   A quick look at Wikipedia's JPEG article tells us how every jpg file begins:
  • bytes 0xFF, 0xD8 indicate start of image
  • bytes 0xFF, 0xD9 indicate end of image

5.   Discovered this sequence again, marking the beginning of a second JPG and the end of the first.

6.    Discovered this sequence at the end of the string. This meant that the third image had its order reversed (i.e. instead of 0xFF 0xD8 being located at the beginning of the image, it was found at the end, and in reverse order like the rest of that image)

For example, the first two bytes of the original string were: 

0x00 -> 0x27      00000000 -> 1111111

When you apply XOR with 0xFF, those bits become 

0xFF -> 0xD8      00100111 -> 11011000

Which is the beginning of a JPG file.

The offsets of jpgs from beginning of the string.

  • 00000000: First Image ("Liber Primus")
  • 000293AC: Second Image ("Rune Warning Message")
  • 00191BB2: Third Image (in reverse order) ("Chapter 1: Intus")

To make files on *nix systems: 

dd if=onionout.jpg bs=1 skip=$((0x00293ac)) > cu343l33nqaekrnw.onion.6.jpg


Commands for splitting the onionout.jpg into three files (offsets converted to decimal). Here the onion file is called onioninvert.bin after inversion (xor with 0xff): 

dd if=onioninvert.bin of=onion1.jpg bs=1 skip=0 count=168876
dd if=onioninvert.bin of=onion2.jpg bs=1 skip=168876 count=1476614
dd if=onioninvert.bin of=onion3rev.jpg bs=1 skip=1645490 count=175159

Note that the 3rd file is reversed. Write a program to print out all the bytes in the reverse order to create the third jpg.

Here are the three images:

Image One ("Liber Primus")

Liber primus

First Image

Backup images:

http://imagebin.org/285655

  • this is too big file it needs to be cut off after ff d9
  • 168876 + 175159 + 1476614 = 1,820,649  full string

PGP signature:

PrimusLiberPGP

Liber Primus PGP









Outguess reveals a hex string inside jpg image:

http://dpaste.com/1541806/
http://pastebin.com/JB1NennF
https://infotomb.com/w31vx.txt

  • The message is 1982 char = 991 bytes long
Outguessed message from Liber Primus.jpg


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

775d0481115f6e4f3ba8873ac66da1df6bbe3ff19389878f2ddb9423881b
5a95bb5dff35ebab119090c5c19678e58bf9cfe2a93694e23da86465cd11
64d7de4744d7a4fea07f75c7db7676f8fc9b52621881b02f2296fe5922b2
6759ee322200e7d8c8a92c0e1ea401cb384a466f3f237ee220b95d151210
c03cd464ba34077eab3529503d6395f84fedbc0245b2f8425ac4b774bf91
16f5dcc1b3af3fa15ee85bc63dcb40b6eec5c2c05d34295f25eb7b788abc
f5674f5a6344a2768e768407a06a48fb9c7d4b6c75b243043d562d0db556
3650e412fc04b538c3900dea56da01591a00f87b6f42831e3a9730ec76a2
e3c7262cf7a6ba39c70b50c35a9b9226b1404bd4b00e79b508a4a3410eaf
057bb314a41c9e381820cea07b323f038749548c042f6203a30a5fa12f18
08109faf49c18a2d55eca3610b8206b143d487cd195c58080fe84e26f6f7
57b6a7cbdaeab019be4482644a02effce5e7e0920b3173412c7245ad832e
ea3e00e49c7a88d52f136aed5b4b1973541de38b8093901522e26491c2ea
ede8464e3e77a2cc1bb78c2274aaff68120a4751337c1f92892dc80dc51a
ad3df760f5a022e835e902aa389df29a8be04f067f0735622125e7fd0eda
de4fcf6ff48ad4954e8ab6b130e4d5fb2540c178c7fcc243cc7701aa3cf8
21546dfe0558854b202745a87c98d2ea3236d850c25bf0cb93d4c0bc78ec
c0841a9b341b9a2c8449c5825600139d3b9710822e4f5dcd8f8ae6395868
265221a7eade3f93441b33bbd45145fd08a8816247f55b6e1a2fdc2d9b44
451c828194abbe59730fe07894a5536138ce1cd21b0306211c4c9ddd8be6
3c69f6470bcb878f544825a789aaf9adff2b2e4408469de7f6c2fc6d1823
8d5efa614aec168f4f33f49c2eac1ed9a6606b39c6213b5a5c0ca5fb6cf2
0e0f19e8a7faffe11edad29472acf65d6535b0832c5b589623a3b5a3c337
f7b0aae38ec1cd7815f334447d2e9d0ccd75d06e9d533f7623bfe22611d5
661c65d7c4bad3074ba437b9d9006eb638eb2d744716b0fda8a6f2a09b8c
f7b7a9bae4a7b96054bdeb220e99c32eb2fdead676becde5938ee32abb4c
126e8420e6259029d1bcd9a51486fb0e619a7654c67954787c696df49b57
ef42b503da982fd5b02acb142ce2d1fe64db441c895240c6a07c1f5baabd
ace7525482dd263f348c6e0ae5a0693346ed966f726e2d7261e7e50f1e48
0c0b14d1e1acf72d29e678b322ebaa3828b5b1d2ca17671e8687a15ddf89
c1a8f5a35b2e4d9e958452676ad69a66e2944b5843768d1deb6b9bdb12fe
38d34769da0bbd00ac22724b8df8dd412ef0c114762f4f1f5b00c796ebf8
733c11d9f435ae76a72dc66c162f1f4b25fc3473b157c1b044d72ecfa059
fe
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJSy3GZAAoJEBgfAeV6NQkPWq0P+wS37GvUbr+bYg6HVcP8Qz7Z
CYhZ8Cy4XtXQFhkc4xGYoCZEO0DoHpN1bMQ8Lf7jZovxwiG6ZwXkWXzCZ5re+Ptx
wiEKN4GbDbZzEb/8Z/EuQxp8hAgcMmub/ypmAdsPO2skVsNZVptCuEJwLmRdmhIF
PqWo3ka1NqtQlBQKecKzlvPMuAXLukQOkRs9WX+1/0CQcdlfORkzeX5RxZTqHxw5
1yLCY4YgtQwrIw4bCn7+GjTjAyb0f0rR57NDuQHv4TveVi0zXYaofvqHsv3ekjd7
J/nVuwq9sqOaCOSYZHjvqZQ95fZDEuDcqblNWPUjpdjC8sHgNSi79b5oy3zMjjl2
tj2maj6Nhe+7YV9Ji99RKO0K3lS+WaMGZzgGOmAMiOYfGloZLPxL8tKzbtgJaAMT
tr9QkHSenBlyqcstJpjD7aGZHCGOWzB+PlXvSR+zQHUDIJbecCu3SOf+KFKnf0q7
6Na0qopCU7CiWSN7YHC6OYsUeN3hAGw7/xcxoEtaKlpMW0+kicPoG/I3Ak4ibs1x
Nqn6m2m68PCE93biPU2mqofx/2NFjzXCGrFydfDjYqBcea/VteUAR4ZL/hAZTo2r
Kaz9gfcFAQpw4ddLOL7D1XMNcreJqtLBDZ0PmpXmZBS5Hex5lxOodugD1hHFvDmt
DwDOHMwAIKZ1k7JtlMfB
=v5mD
-----END PGP SIGNATURE-----


Does cicada reference this book: Journey Into Jung's Red Book: Liber Primus?

Might be reference to this book:

Journey Into Jung's Red Book: Liber Primus
by Jules Okapi, J.C. Andrijeski (Goodreads Author)

http://www.goodreads.com/book/show/9734908-journey-into-jung-s-red-book

Jung was referenced in Warning Pastebin from 2013: http://pastebin.com/dHJ6JNkr

Beliefs:
• teach followers to "Find a death every day." It doesn’t mean literal death. Instead there is a double meaning: 1) know you're going to die, so, nothing matters, and 2) Find the death of the “I” or the ego.
• other philosophy they use is "what you resist persists" by Jung, and the Jesuit corollary "create what you fear most." For example, if you are afraid of resistance and rebellion, then send operators to create resistance and rebellion. This way, you can direct the energy of the people, embrace it, let it dwindle, and at the same time minimize the damage.

Image Two ("Chapter 1: Intus")

Intus

Second Image

Image original backup:

  • http://imagebin.org/285662
  • this is too big file it needs to be cut of after ff d9
  • 168876 + 175159 + 1476614 = 1,820,649  full string


Meaning:

intus -  (Latin) adv.: within| on the inside| inside; at home

PGP:

ChapterIntusPGP

Chapter Intus PGP







Outguess reveals a hex message inside this image:

http://pastebin.com/MALhVdxx
https://infotomb.com/vd0bo.txt

  • Hex string is 1982 char = 991 bytes long
Outguessed message from Chapter 1 Intus
 -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

4dd1c8afafceed237cca8a334b24fe09069e3771e416a749687af002b4de
844566fdef57ba9f76a17c2ca1472f08cbb7b595524310614d8f9044f7f5
49c422a0f10599ace22d443907db0d54d6bf726f1c42c27fe93b7d8a5980
0661353b73fd868adc2ab687a0fdc7cd6560f917a1392e6594b62554b8cc
b844f766583cada19fff1e233867020d49c5b4669b64c1bfe2cb7127b2ca
76d117be8994665dde9a1b49f16494eed2cbd31d4faa8f66b3afd1dc8fd0
96c344c89f2a23ed0d493524ab9f61ef020cbd8a4cd8fb0f21ecdfc461b0
e5aae8037a9ffc7667bee4a11479000c1c93f64dd2e38173f9e8aa380a3a
5387612fbe0787389a91633033be608eb9c0b799869704413a6bdf74961c
d81ac702815f0d4503a212828ad9b25efae12b9bafb4debb3f38f6825fbc
81053014e17d79e82c2548d23e9c32228feccf3a53ca80def3a96a75d83e
5f21b4c35d2641e9ac3a0124dd6dfb2f5187b16c4858158afc0bd285b0a0
ff43bc3452c52e59ffcdc6d5837daabf6800ed0354780625215b2eaa3e4b
1f7323d5ef64419c6ce0b84efe4f5b4c2656d47da20820c91780001d6759
84ee9984864f6679e35fdf255f6478d49c1843277364ecd66da6d0d2d133
fbbd94a63d6f1edb6b8f692c87aa1c99078f8a9e855ee80e27cac12c3033
082355388893e86bff30b33820f71254ee6e920e0ee27b1ca97b1ed69147
a4ee2cca257b9e728ff835b162289f112a90d2de9feaff313beaa624ce7e
a4a3f875bcad3e42aa5bd19c3e3c9a3641c692bc2b987fb2ab551d9503f0
91cf1ca69a88354153c8308b759010bd415f85776cdc1c0f5b965ab00ab4
52ef5f513daad68fd1c94d3547f46aa9baf2e5323a933ec4b2334dea55eb
37a4ec7453d40790d27a082264586e0e3ee1e499e1e0544e2f578bd25d22
06774a80f0d56d4d5f6de6cb95e557b392071497fda207d1f82abc6d71bf
deca78cd55bf7c89be389d8840d5f57f8109ae2cc4879b22191b10297c0c
10965320ae295521074743a119fed32a078031cd35dd1e108e41b0f0f591
e4941f1be81d8ff793e3ec2ad1a3ca718220d8f402eac82da7e51668b90d
0dde5db35f5f933c0d13397afa4377ada56ed49c7ca3fa0b6a190261561b
eba51e102fff455a1bec3424f5e9800c6345460c4fdf23b8c8ce0baaf73c
55712d8a71cd2aa3143f337cb322adea56ee79ce4b239ce352f4b863298f
2c1f5c4ec348f1569c1d125be9c3419ffc5b533b4fb5154c3c5c51a7c4e8
0f3aebf392cc81f2b29f773a44b4a2d7bc3c690f8f58e1aa4ba9d716961a
31003f22306b8c9271b5fa0dc588be92ece2c79043c841592d69fbfbeac4
60c4259e4339a3c8e3e100c3dceab0acb351f026189e1335cd0701f97667
a3
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJSy3GcAAoJEBgfAeV6NQkPG7oP/RbIXusHQ/HFHc837NxYqqVI
kVUsXqpJCyTVvbvQKooL4vkP2o/mdWoyyLbHjCdi1RruTXAfiNo1d6Wp4DckLtqD
H/rpWMa9sUjlCuHBYQGWYIKfmz3xNaN5Au1qaMO/JxVOs0SrF78PFKeb0DorZZxA
UljcJ1UVGlPZWTazBzPco+6LwVJi1Nnh2P/Tpz+RAwwI6BIVoEkWws0PD0JF3ld0
GCDZ0KtnN9OigjKqdG9rrZymFiv3kr5w8HgvVt6c9+UAa26KK6PCXI+XVQ14Yn4C
RQehAfQc+aJwUsRxhgdsuJHQm8tfljt1Lq3MKnYkpyjGek/ZQndZkNz8VU9uNHhm
SzEp1O5vo6+pNzpUSVJRCGFcsNt5K+zn86mFYv+Wj9SxLFml1zujmk4gS7m94hFT
daKvEFCFLmT1Oa2d81zA7W2VhA9/BgphIQ15W8cYfxrw8XGvxhb4O9IFcYy1QIcS
yzaDpZ2Ig6a2nbRITwbV3Azt1C9oU2bzalLQYyaitITVkRenVdOTb+7dNq9bBYvx
RwIL1M2aIjJSxxjAqUXsmsQ2xdHLPp1jVZ3kM4Y9ZIEx2GYaSNT7LWH2c0wwBAa+
ISgQy3Dy7Fzqyfo9yGpeHEmMO8gOEzKTlNbFhnhIE1PBVoPH/b+itKrsYXd19CgZ
OgqRJn3MNOr+Ne7K97z3
=fabe
-----END PGP SIGNATURE-----


Third Image ONION 2 VER 2 RUNES WARNING MESSAGE

Huh2

3rd image ppl say came from onion 2

Backup jpg:

https://infotomb.com/oju8n

Final translation: 

A warning!

believe nothing from this book.
Except what you know to be true.
Test the knowledge, find your truth,
experience your death.
Do not edit or change this book.
Or the message contained within.
Either the words or their numbers

For all is sacred!


PGP signature: 

RunesWarningPGP

Runes Warning PGP









Outguess reveals a hex message:

https://infotomb.com/pxziu.txt

  • Lenght: 1982 char = 991 bytes
Outguessed message from Runes Warning jpg image


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

17a1e10393d3c62b0e2c2d59ca197f85246746c533bf6d8316f2256679e8
f3fdf08d1a2a30470f0bccba289066e74a44703ebf32d0c85072b96d75ab
0d52aeb0fa971d00161a78adfcf82fe97e68004551973b11ebf9d09f377d
41328e401cb3287240c6d6c7f479f1521b73e958d15305c6e12f2b0fe59f
37581648ab3ce7ff718573295f249dff41476700feba4c9ed321cc593e68
5015c175301674d1ad5f02ca8be69a786c4941fd41d7e177d710fff64041
4e8926bff638e4e9f056de4d31d56e7aeb21b1c64f5b963f328bc3e9fca1
9daf235deff53c368d24e32213ea621747d64c77dae0452f9235c9ad4eab
e001066c03e47f663bdb56a55f6ba3c358e5b63a66b64dbd5dae1a7fa9e0
bf0c1c520e08dd1f57b79510b48fc55717cf2f45c5c1f2cad771d06e00f3
cf46e6cc99cd80f30ca39ec403485ac4e34a2e9905d2f3b29a754f2354a6
49e0564ee196b5934010c116e4195da9fb2a62cf493d1ea1e913cf6c01bc
7e14939380edffb4e890d571a2618aaa56567da3bda4ef5c70d87d6f848a
c4cb27f9e27d873f2e19711be4b4d3687d2da067a5270c30cfa7bc77ef39
6ce0228d259e76e187c1acc9299dc4656dbf7d427d5489fb09f00768b287
69c33a87b9949f657277bdfc83299a044d983cb700f57f099d8e93a97ff3
230161f6e58e1c48885992a76a18b0d6b53f7c36848fc4ae73ce86459d9a
0133503262335d3671f0b5065b63c7ed7940b06df492c1a48527026dde55
cb83e8851b795ba6a021a571ab1f8e8a221756a438460fa8dc3cf189d78d
bce1af1f4d4adf4d66a892bece6f3ba50bf0aed30f96287b08839442f11e
01e8dc401d040941d7d862cba80edb651f83b31059e6c17613a9d2ff24a7
e88f7d534a612334e50798ee2c81329eccb9fdc36db00e25180b64664bb5
522e10471e4ce5e400855932a07dcde4c45ed07d879a1b298afb53a9c8be
6017e101ae19f79693a9d89b0cc91902164a262b2386f4677ffc9f3b28b7
0fe2469121c9e87e07b3385d8f88edd77c012ad378fac5b465950e3d2969
4777e6e7748d0ff19d38757198625816759c5f4b040667a26238c0315423
4af3bff4d40b5674bbc2848ad8b3b5f58dc191a68cf1dc435c7a0da7ac21
7cb5ee52de5527e9c7adba5f8f4104934bcf4821b4c639322ef45ec817b0
ceec2abfab5b41f04cc0193401da8e8a244e8d940d2283ba0b713629548a
2a272bcf09d53023e3c21a8ef95fb1e5bfa4a7d9c4d51d0af3efbcc25124
b7f8500a93818b3f6b621d1f410854f02bd87a648a4955fcebb67bfcdcbc
7bbe410dae6a45e79fffc51f1f1f4c8786682db0609d42045d203650340b
67923e6a9a2120930182828f9a82ffc7c5e4831be89d87d7ccfd021bfb13
57
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJSy3GgAAoJEBgfAeV6NQkPeooP/22GiX8uJLQlZeGHMTgSFuef
1w1IJNrcCeS2Bi/NL21QSPEaOI/BnQ8OPYr8YdOlwdOg+9ZhZzkh4FoybcRZlcnO
v9au5GPnmQIbwhKZFf2sr2l/A9IZPkYSVjx9bFd8q5/QHKYMiglBiXiV8qpI11mm
0Bite/O19pG2KjXwtwVUX+kQcde56lDTMa1jW7b/mdpbF7u+N2xMR0e3NOYSHeLa
b7NWUKaqsFQ/JdzXsXYd8IPjRjSg3rhaVBAFD7yVG5AmTTCe6h0D+NEO0yW8c6x7
fQ25erhmpMLYKyUj6yTSp2HH1hw3JaIktRUe2j8cVn5H2NZtcUVfvqTyPvf/Bmdn
6SRiFWPoat1IRd8apBzpREPrYx2NTTqE1ruvUvFRGYf8G4oRf3+6uYSN8rLNKeHo
pAyAUIO0ilrY70x1K3iug1BNdRHk1uEuqzFyY4FWI22V0PTUsum4PyXaTtNo0Lu8
oqkConHUTzH7R8c3HHJVgKfZfQZ1fWn2PbOOMJVNTsegn7dIfDpA6QcWTEZ4perh
W3Lxfz9hBhAbQlsImrDqva7PBAjSO5VzBQYRlR/P3ImNa0EOCM3/iC+SuILKZfIJ
acDNmtCv2+sWLyk9LihsTUomFqJFTbVSmLul/uo7tbj7fNB72T7+SYqde3D4fdco
TYZhnC/brWCq72fdZSEc
=IW8b
-----END PGP SIGNATURE-----


TRANSCRIPTION OF RUNES


TEXT: 

R NGRAMW JIHEIIAI MAEYW EAAAEN
YEP JAEAED IXDISEO NGLREO THAEIA
DMAENG EOAE JI EOAIAI EOIPEO YI D
MAENGHICOEI EAEMC THAEIAA EOAIAY IX
SIAEIMDI THAEIAA CFY CAE MAEEO ICEEO AE
A DLRWI YEP JAEAED AEA YI NICCROEI
DAEMEOREMIC NGEYEM IEYIA YI NGAE
ACC AEA YIEA MIANJIAC EAAEA RHH E
C CRDAIC


NUMERICAL: 

11 7911977119 373123673110731 7110110319 1099710129
1036743 3710110189 314789315341 79731141 5101107
897110179 41101 3731 419710731 41314341 10331 89
71101792331138331 109677113 510110797 510110797 4197107103 3147
533197317131 510110797 132103 13101 7110141 31136741 101
97 8973111931 1036743 3710110189 10197 10331 294343118331
8910171411167713113 79671036771 31671033197 10331 79101
971343 10197 103316797 711072937319743 10910197 112323 67
43 431189973113


Soulseekah coded an analog of the 'Count' function available at

RUNES SOLVED

1. Stack the Gematria Primus, left column onto the right one. 2. Find rune position in the list (for example, first rune R is position 5) 3. Count the same position backwards (5 from bottom gets you A).  This is basically the rune equivalent of the Atbash cipher which is "has been associated with the esoteric methodologies of Jewish mysticism's interpretations of Hebrew religious texts as in the Kabbalah."  It is also noteworthy that Gematria is associated with Kabbalah as well. 

(R) (ING RAM W) (JIHEI IA I) (M AE YW) (EA A AE N)
 A   WARNING.    BELIEVE      NOTHING   FROM

(YEP)  (J AE AE D ) ... 
 THIS   BOOK. ...


And so on. The message is:

Runes-warning

Runes substitution key

A Warning

Believe nothing from this book,
Except what you know to be true.
Test the knowledge, 
find your truth,
experience your death.
Do not edit or change this book,
Or the message contained within.
Either the words or their numbers 
For all is sacred!

Using the Gematria Primus , each line adds up to a prime number, most of which are palindromic primes (marked with a *). 

A Warning

Believe nothing from this book,    =  757*
Except what you know to be true.   = 1009*
Test the knowledge,                =  691
find your truth,                   =  353*
experience your death.             =  769*
Do not edit or change this book,   =  911*
Or the message contained within.   = 1051*
Either the words or their numbers  =  859
For all is sacred!                 =  677

 Solution


SOLUTION

•
 A warning! believe nothing from this book.
Except what you know to be true.
Test the knowledge, find your truth,
experience your death.
Do not edit or change this book.
Or the message contained within.
Either the words or their numbers For all is sacred!

•



"• teach followers to "Find a death every day." from Warning pastein: http://pastebin.com/dHJ6JNkr

NEXT STEP

https://gist.github.com/numinit/4cd82eba206a8af9561c 


outguess jpg1 XOR outguess jpg2  XOR outguessjpg3   = 


IDGTK UMLOO ARWOE RTHIS UTETL HUTIA TSLLO
UIMNI TELNJ 7TFYV OIUAU SNOCO 5JI4M EODZZ
Good luck.
3301



XORing all three SIGNED Outguess outputs from 3 jpgs produced that PGP signed message:

  • just outguess jpg1 xor ougutess2 xor outguress3
  • so, 1. we got 3.5 megabyte onion dump
  • converted to raw data
  • xor with fffffffffff.....
  • got 3 images
  • 1 at offset 0, 2 at offset 0x00293ac and then reveversed, and 3 at offset 0 again
  • each image had similar outguesses with 3 same-sized hexdumps
  • 991 bytes long, xor the 3 together to get https://infotomb.com/z5f6p.txt
  • simple as that


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



IDGTK UMLOO ARWOE RTHIS UTETL HUTIA TSLLO 
UIMNI TELNJ 7TFYV OIUAU SNOCO 5JI4M EODZZ 

Good luck.

3301


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJSy23PAAoJEBgfAeV6NQkPeJwP/0IoafJ1SbmhD+KNbL5I2EdH
jgPRnZNrKCyMpWFSIw1qs6ujuw6VnW/rfnOD+df4kpzoAwEFfZDcRnBVsvIzOJ31
Txj9jXD22ki/CNRY88NyIzW9fjKs+iOylsa7Tx+6PBb3ndoYNEwnQwLIq3K4S3kQ
tgMzE3LiVq2pQwqFNdN+zGqcq7POEs0GmnL1aNpqU+Wrba4gSfoWwQBWUDv3S/s8
vY0hEqhWNd76wphig6hH6OyIaX/t1eYfcsSYhzAE5oKKahGr1E7cX1GBpHCIr1WM
ZwNaGVArQAkyEzT++tmF01O9h218CiTUFoBM/Zxyra7vxI2UOYS/pLonuV+eXARY
YfPHaZZxfk3bUWXcxioRukFSY2+xNdPfuBIT8rcJqa1kPJOzeZVC/IcwHA2mmG4l
3ltiVcDnQrZgz6Im3/ugFg8bqW12qqZ6XizRP3EXm4EnyhpfKZnXKPLEOvPKCj6j
1kYCrLmGtTTPFx79fZfryGXQIEAmipRbjVS5sVbUCfgmqUagmdU6v9VI53n6+r0J
b2amxREA+2MflkEoVJUaLQJ1rKZLFFJ9J17zUaXKMllsDBWXJS4Mb54o2+8bkEcM
3cP+16XV9pf2wZBkJE0AwoXI4L8JEyjNZZcGSLy8BojlAupX3Fg9KKt71XXrm9FD
tuBhMYWo/TDz+4UzLB+I
=57tj
-----END PGP SIGNATURE-----

PGP of page1 XOR page2 XOR page3

P1XORp2XORp3

Signed at 4:00 on 7th Jan, this is 16 minutes before outguessed messages in page 1, 2 and 3 were signed.






THIS PAGE IS DISCONTINUED, READONLY NOW. PLEASE DONT EDIT IT ANYMORE.

BELOW THIS POINT ARTICLE IS NOT EDITED

TO CONTINUE READING GO TO ARTICLE PART 3

LINK TO CURRENT SITE WITH UPDATED PROGRESS

Collapsed bottom part of article

Collapsed bottom part of article containing ideas, unused clues, dead ends...


Columnar tranposition with keys of length 2 to 9:

Columnar tranposition with keys of length 2 to 9:

ONION 3 VER 2  onion updated 05:50 GMT

Onion3VER2

onion 3 ver 2 after it updated, ptinscren from 05:05 GMT 9.1.2014














HTML SOURCE: 

<!--1033-->

87de5b7fa26ab85d22

THIS STRING IS ALSO GROWING WTH TIME JUST LIKE ONE ON ONiON 2 VER 1 DID

CURRENT STATUS OF STRING

  •  9.1. 2014 05:48 GMT:
87de5b7fa26ab85d2256c453e7f5bc
  • 8:52am GMT: 87de5b7fa26ab85d2256c453e7f5bc3ac7f25ee743297817febd7741
  • post more timestamps (IN GMT or add your timezone)
  • post more timestamps (IN GMT or add your timezone)
  • post more timestamps (IN GMT or add your timezone)





Screenshot 34












BOT LOGGING PROGRESS OF STRING

We have bot that logs in IRC and reports every change

  • Entropy is his nick,  numinit is managing it


[05:54 GMT]  <Entropy> NEW BYTE: 3a, 16 bytes, 32 chars, min: 22, max: f5, avg: 140.0625 (8c), stdev: 63.2332 (3f), entropy: 4.0000 bits/byte, modified: 2014-01-09 05:54:01 UTC (15 minutes, 0.000 seconds)

[06:11 GMT] <Entropy> NEW BYTE: c7, 17 bytes, 34 chars, min: 22, max: f5, avg: 143.5294 (90), stdev: 62.8931 (3f), entropy: 4.0875 bits/byte, modified: 2014-01-09 06:12:01 UTC (18 minutes, 0.000 seconds)

[06:15 GMT] <Entropy> NEW BYTE: f2, 18 bytes, 36 chars, min: 22, max: f5, avg: 149.0000 (95), stdev: 65.1503 (41), entropy: 4.1699 bits/byte, modified: 2014-01-09 06:15:01 UTC (3 minutes, 0.000 seconds)

[06:54 GMT] <Entropy> NEW BYTE: 78, 23 bytes, 46 chars, min: 22, max: f5, avg: 140.6522 (8d), stdev: 67.1718 (43), entropy: 4.4366 bits/byte, modified: 2014-01-09 06:54:01 UTC (12 minutes, 0.000 seconds)

--->HERE WE GOT THAT RUNES MESSAGE ON SERVR -STATUS PAGE, THEN ONION INDEX.HTML BEIGN TO UPDATE AGAIN

[08:27 GMT ]<Entropy> NEW BYTE: bd, 26 bytes, 52 chars, min: 17, max: fe, avg: 142.3462 (8e), stdev: 71.4493 (47), entropy: 4.6235 bits/byte, modified: 2014-01-09 08:27:01 UTC (30 minutes, 0.000 seconds)

[08:33 GMT ] <Entropy> NEW BYTE: 77, 27 bytes, 54 chars, min: 17, max: fe, avg: 141.4815 (8d), stdev: 70.2521 (46), entropy: 4.6808 bits/byte, modified: 2014-01-09 08:33:01 UTC (6 minutes, 0.000 seconds)

[08:39 GMT ]<Entropy> NEW BYTE: 41, 28 bytes, 56 chars, min: 17, max: fe, avg: 138.7500 (8b), stdev: 70.4311 (46), entropy: 4.7359 bits/byte, modified: 2014-01-09 08:39:01 UTC (6 minutes, 0.000 seconds)

[09:27 GMT ]<Entropy> NEW BYTE: ed, 29 bytes, 58 chars, min: 17, max: fe, avg: 142.1379 (8e), stdev: 71.4904 (47), entropy: 4.7890 bits/byte, modified: 2014-01-09 09:27:01 UTC (48 minutes, 0.000 seconds)

[09:30 GMT]<Entropy> NEW BYTE: ed, 30 bytes, 60 chars, min: 17, max: fe, avg: 145.3000 (91), stdev: 72.3220 (48), entropy: 4.7736 bits/byte, modified: 2014-01-09 09:30:01 UTC (3 minutes, 0.000 seconds)

[09:45 GMT]<Entropy> NEW BYTE: f0, 31 bytes, 62 chars, min: 17, max: fe, avg: 148.3548 (94), stdev: 73.0870 (49), entropy: 4.8252 bits/byte, modified: 2014-01-09 09:45:01 UTC (15 minutes, 0.000 seconds)

[10:00 GMT]<Entropy> NEW BYTE: 7c, 32 bytes, 64 chars, min: 17, max: fe, avg: 147.5938 (94), stdev: 72.0607 (48), entropy: 4.8750 bits/byte, modified: 2014-01-09 10:00:01 UTC (15 minutes, 0.000 seconds)

[10:06 GMT]<Entropy> NEW BYTE: a0, 33 bytes, 66 chars, min: 17, max: fe, avg: 147.9697 (94), stdev: 70.9923 (47), entropy: 4.9232 bits/byte, modified: 2014-01-09 10:06:01 UTC (6 minutes, 0.000 seconds)


[10:15 GMT]<Entropy> NEW BYTE: c7, 34 bytes, 68 chars, min: 17, max: fe, avg: 149.4706 (95), stdev: 70.4699 (46), entropy: 4.9110 bits/byte, modified: 2014-01-09 10:15:01 UTC (9 minutes, 0.000 seconds)

[10:27 GMT]<Entropy> NEW BYTE: e8, 35 bytes, 70 chars, min: 17, max: fe, avg: 151.8286 (98), stdev: 70.8037 (47), entropy: 4.9579 bits/byte, modified: 2014-01-09 10:27:01 UTC (12 minutes, 0.000 seconds)


THIS PAGE IS DISCONTINUED, READONLY NOW. PLEASE DONT EDIT IT ANYMORE.

TO CONTINUE GO TO ARTICLE PART 3

LINK TO CURRENT SITE WITH UPDATED PROGRESS

SO NEXT  CIPHERTEXT TO SOLVE IS :

Onion stoped updating at 46 charactrs

  • at Thursday, January 09, 2014 6:54:01 AM (server time? idk what time is in page info)
  • http://prntscr.com/2hs3zv (screenshot at 07:25 GMT)


87de5b7fa26ab85d2256c453e7f5bc3ac7f25ee743297817febd7741ededf07ca0c7e8



SOLUTION


?????

POST HERE YOUR THOUGHTS:

  • it is hash string! NO!


as of 10:19PM PST;   87de5b7fa26ab85d2256c453e7f5bc3ac7f2


as of 7:49 CET (GMT+1): 87de5b7fa26ab85d2256c453e7f5bc3ac7f25ee74329


As of 9:07 SAST (South African Std Time) it is: 87de5b7fa26ab85d2256c453e7f5bc3ac7f25ee7432978

as of 07:22 GMT   :  87de5b7fa26ab85d2256c453e7f5bc3ac7f25ee7432978


as of 07:52 GMT : 87de5b7fa26ab85d2256c453e7f5bc3ac7f25ee743297817


as of 10:45 GMT 01/09/2014 : 87de5b7fa26ab85d2256c453e7f5bc3ac7f25ee743297817febd7741ededf07ca0c7e8b1


as of 13:13 (GMT+2) 87de5b7fa26ab85d2256c453e7f5bc3ac7f25ee743297817febd7741ededf07ca0c7e8b178


as of 5:39 EST:

87de5b7fa26ab85d2256c453e7f5bc3ac7f25ee743297817febd7741ededf07ca0c7e8b1788ea4131441a8f71c63943d8b56aea6a45159e2f59f9a194af23eaabf9de0f3123c041c882d5b7e03e17ac49be67cef29fbc7786e3bda321a176498835f6198


keep empty lines here

PPL FOUND THAT ONION IS LEAKING IS LINODE ADRESS:

AND PUBLICLY POSTING ALL OUR IPS


http://fv7lyucmeozzd5j4.onion/server-status

https://fv7lyucmeozzd5j4.onion.to/server-status

https://fv7lyucmeozzd5j4.tor2web.org/server-status


http://jsfiddle.net/4LjAA/1/   source!

NEED SREENSHOT


AND LOGGING ALL YOUR IPS THAT CAN BE PUBLICLY ACCESABLE:

LOG FILE FROM 9.1. 2014. 06:17 GMT http://pastebin.com/ZRJhYgGP

[04:44] <absence_> Lurker69, onion.onion/server-status http://pastebin.com/je6Yudvh

THIS IW WAHT TAIIWOO MADE

http://82.9.41.159/html/user/ WAT?

[06:05] <absence_> http://fv7lyucmeozzd5j4.onion/.htaccess
[06:05] <Tech1> http://fv7lyucmeozzd5j4.onion/server-status is where i'm pulling from


onion/server-status
[05:41] <L0j1k> which is a server status page in apache, found by taiiwo's dirbuster

HERE IS SOME MAGIC HAW THAT WAS DONE

!!DO NOT DELETE ANY LOGS UNTIL WE HAVE EASY STEP BY STEP EXPLANATION HOW THIS WAS FOUND AND DONE, AND I MEAN AS EASY THAT JOURNALISTS CAN UNDERSTAND AND REPRODUCE IT !!!


FOR NOW WE DONT HAVE DECENT PARAGRAPH EXPLAINING IT SO HELP YOURSELF WITH THIS LOGS: LOGS ABOUT HOW WE FOUND LINODE SERVER OF ONION 3

note that we had to DOX Clearnet IP of onion server in 2013 also.

SOON AFTER STRING STOPPED UPDATING AND WE DFOUND NEW THINGS ON SERVER STATUS PAGE


 This means that cicada noticed we found that logs on server!

Smfgz0R

Onion 3 Change on SERVER STATUS PAGE




















We got new stuff form the server status (cca 07:18 GMT)

SOME WISDOM:

THE PRIMES ARE SACRED

THE TOTIENT FUNCTION IS SACRED

ALL THNGS SHOULD BE ENCRYPTED


KNOW THIS:


272           138             shadows   131         151

aethereal   buffers       void         carnal       18

226            obscura     form         245           mobius

18              analog       void         mournful   aethereal

151            131            cabal       138           272


http://i.imgur.com/b2XLHxg.jpg
http://i.imgur.com/wRSoiPx.jpg

We got new stuff form the server status (cca 07:18 GMT)

SOME WISDOM THE PRIMES ARE SACRED THE TOTIENT FUNCTION IS SACRED ALL THNGS SHOULD BE ENCRYPTED

That appears to be the first paragraph of first image.


Onion 3 v3

jpg from onion 2 server status


<soulseekah> you'll get the same image
<soulseekah> byte-for-byte
<soulseekah> there is no outguess



FINAL RESULT: 


272     138     341     131     151
366     199     130     320     18
226     245     91      245     226
18      320     130     199     366
151     131     341     138     272

IF WE MARK PRIMES AS 'o' AND NON-PRIMES AS 'x', WE GET THE FOLLOWING PATTERN: 

x	x	x	o	o

x	o	x	x	x

x	x	x	x	x

x	x	x	o	x

o	o	x	x	x


When resolved, it produces the following pattern: 

x	x	x	

x		x	x	x

x	x	x	x	x

x	x	x		x

		x	x	x


Upon dividing this in half along the center column (5 x's) and flipping a side vertically and horizontally, we see that they mirror each other.



https://infotomb.com/99694.txt This 5x5 matrix is also imbeded in between the two images found on server-status.

How we got that:

u dump hex > bin  twice to get it

converting this data to binary again





<ChuckFive> https://fv7lyucmeozzd5j4.onion.to/server-status
<TaiiwoBot> ^ Apache Status ^

http://i.imgur.com/b2XLHxg.jpg
http://i.imgur.com/wRSoiPx.jpg

BELLOW THIS LINE WE ARE STILL A BIT CONFUSED AND UNEDITED M'KAY?

Translate

translation done by player












BEGINNING OF REASONABLE EXPLANATION

As far I understand long string on updated SERVER-STATUS PAGE are two images, same one one from top secon d from bottom and reversed. Just like  it was on onion 2.

But in between there was chunkg of data (we call that  OOB TABLE) . Should be in th logs bellow.

That chunk of  data is after some hex>bin magic the same as 5X5 table in second paragraph of jpg.

Ppl say that second paragraph doesnt mean anything, its only words, and i dont know.

To replace runes with numbers we can do OOB TABLE hex>bin magic, or we can simply count runes values from gematria primus.


(note this is just how i imagine it based on info i gathered, i dont have time to check if all this is true; if you know more pls fix that aritcle -Lurk)

MORE LOGS:

<Surtri> In the image of hex

<soulseekah> it's just the same payload reversed btw
<soulseekah> dd if=fv7lyucmeozzd5j4.onion.1.jpg bs=1 skip=$((0x00521df)) count=364
<soulseekah> to extract

<nykos> http://dpaste.com/1543389/
<TaiiwoBot> ^ dpaste: #1543389 ^
<Surtri> Holy caw

[08:17] <nykos> hex hidden between the two images
[08:17] <nykos> https://infotomb.com/pw38g

[08:16] <nykos> the original text
[08:16] <nykos> https://infotomb.com/2cet8

[08:16] <nykos> http://i.imgur.com/wRSoiPx.jpg
[08:16] <nykos> the bottom half translations


[08:30] <soulseekah> http://static3.wikia.nocookie.net/__cb20130107123017/uncovering-cicada/images/1/1a/Testout.jpg
[08:30] <TaiiwoBot>  ^ http://tinyurl.com/m5c88hc ^
[08:30] <soulseekah> teefs: I think I posted?
[08:30] <soulseekah> 13:12 < soulseekah> 510    !310    !430    (310    "72720    (310    !430    !310    !51:630    )910     310     230     (1:220    %420     !90    %420    &2210     230     310    )910    &63
[08:30] <soulseekah> these?
[08:30] <soulseekah> probably not right
[08:30] <teefs> oh yes ur rite
[08:30] <teefs> was u
[08:31] <counterhash> How is he right teefsd
[08:31] <teefs> about him postin
[08:31] <soulseekah> okay let's say it's gematria
[08:31] <counterhash> It seems that this current clue is just about Liber Primus
[08:31] <soulseekah> then 272
[08:32] <soulseekah> some letters add up to that
[08:32] <soulseekah> this is the coin/change problem
[08:32] <soulseekah> classic
[08:32] <counterhash> I'll work something out
[08:32] <soulseekah> http://codeseekah.com/cicada/count.html
[08:32] <soulseekah> You can check source here
[08:32] <soulseekah> for mappings
[08:32] <teefs> u think search thru counts?
[08:33] <soulseekah> view-source
[08:33] <soulseekah> and see lookup table
[08:33] <teefs> i got a count prog
[08:34] <counterhash> soulseekah: Is this count updated for the new Gematria (with the reversal)?
[08:34] <teefs> what was reversal?
[08:34] <soulseekah> not sure it's old
[08:34] <soulseekah> no idea about reversals
[08:34] <counterhash> Where you flip the gematria table
[08:34] <soulseekah> oh no
[08:34] <soulseekah> no it's not
[08:34] <counterhash> Okay then it won't be updated
[08:34] <counterhash> I'll work on what I have
[08:34] <soulseekah> k
[08:34] <soulseekah> Let's think what else
[08:35] <soulseekah> there are a lot of matrix-based encryption schemes
[08:35] <Lurker69> soulseekah:
[08:35] <Lurker69> whil i try to upload http://i.imgur.com/wRSoiPx.jpg
[08:35] <teefs> https://infotomb.com/i5ree my count
[08:35] <TaiiwoBot> ^ infotomb ^
[08:35] <Lurker69> on wiki i get file identification erroer?
[08:35] <soulseekah> http://en.wikipedia.org/wiki/Hill_cipher
[08:35] <TaiiwoBot> ^ Hill cipher - Wikipedia, the free encyclopedia ^
[08:35] <Lurker69> does it mean there is some oteh r shit in jpg?
[08:36] <soulseekah> wow
[08:36] <soulseekah> http://i.imgur.com/wRSoiPx.jpg
[08:36] <Lurker69> or can i just resave it and upload!
[08:36] <soulseekah> but this is a 5x5 as well
[08:36] <teefs> counterhash: order of eval of symbol matter lot last yr do u got link to flipped gematria?
[08:36] <teefs> i can mod it
[08:36] <soulseekah> it's the same one
[08:36] <soulseekah> wo
[08:36] <counterhash> http://static2.wikia.nocookie.net/__cb20140108163161/uncovering-cicada/images/6/66/Runes-warning.jpg
[08:36] <TaiiwoBot>  ^ http://tinyurl.com/pd5apt9 ^
[08:36] <soulseekah> Guys guys
[08:36] <counterhash> It seems to be a Hill CIpher
[08:36] <soulseekah> http://i.imgur.com/wRSoiPx.jpg this is on the page
[08:36] <counterhash> go on soul
[08:36] <teefs> hill cipher hmm
[08:36] <Lurker69> fuck it i am just gonna dump logs

<soulseekah> about the 5x5 matrix we found in #3301solvers
<Lurker69> havent heard of matix at all
<soulseekah> https://infotomb.com/pw38g
<soulseekah> Seen this?
<soulseekah> I made that
<soulseekah> basically it allowed for the discover of some out of band data
<soulseekah> between the two images from the /server-status onion
<soulseekah> jpeg
<soulseekah> http://static2.wikia.nocookie.net/__cb20140109073114/uncovering-cicada/images/6/62/Onion_3_v3.jpg
<soulseekah> this is actualy 2 images
<soulseekah> i.e. if you reverse the file you get the same image
<soulseekah> byte for byte
<soulseekah> However, if you diff the two, you'll find out of band data that's between the images
<soulseekah> https://infotomb.com/ao1wx.txt
<soulseekah> converting this data to binary again
<soulseekah> will yield a nice clean matrix
<soulseekah> https://infotomb.com/99694.txt
<soulseekah> which matches the matrix at the bottom here: http://static2.wikia.nocookie.net/__cb20140109073114/uncovering-cicada/images/6/62/Onion_3_v3.jpg




THIS PAGE IS DISCONTINUED, READONLY NOW. PLEASE DONT EDIT IT ANYMORE.

TO CONTINUE GO TO ARTICLE PART 3

LINK TO CURRENT SITE WITH UPDATED PROGRESS

•

For Every Thing That Lives Is Holy

•

ANOTHER INTERESTING THING

CICADA USES DIFERENT PORT FOR EVERY onion 


Apache Server at auqgnxjtvdbll3pv.onion Port 5240
Apache Server at cu343l33nqaekrnw.onion Port 5241
Apache Server at fv7lyucmeozzd5j4.onion Port 5242


To see POT number just enter nonexisten link after
97sfcnM
valid onion url:


(Maybe the same Server? Would make sense from cicadas view)

PPL FOUND THAT ONION IS LEAKING IS LINODE ADRESS:

AND PUBLICLY POSTING ALL OUR IPS


AND LOGGING ALL YOUR IPS THAT CAN BE PUBLICLY ACCESABLE:

LOG FILE FROM 9.1. 2014. 06:17 GMThttp://pastebin.com/ZRJhYgGP

[04:44] <absence_> Lurker69, onion.onion/server-status http://pastebin.com/je6Yudvh

THIS IW WAHT TAIIWOO MADE

http://82.9.41.159/html/user/  WAT?

[06:05] <absence_> http://fv7lyucmeozzd5j4.onion/.htaccess
[06:05] <Tech1> http://fv7lyucmeozzd5j4.onion/server-status is where i'm pulling from

202.117.120.16 --> li676-95.members.linode.com (?)

HERE IS SOME MAGIC HAW THAT WAS DONE

!!DO NOT DELETE ANY LOGS UNTIL WE HAVE EASY STEP BY STEP EXPLANATION HOW THIS WAS FOUND AND DONE, AND I MEAN AS EASY THAT JOURNALISTS CAN UNDERSTAND AND REPRODUCE IT !!!


FOR NOW WE DONT HAVE DECENT PARAGRAPH EXPLAINING IT SO HELP YOURSELF WITH THIS LOGS: LOGS ABOUT HOW WE FOUND LINODE SERVER OF ONION 3

note that we had to DOX Clearnet IP of onion server in 2013 also.

TIMESTAMPS OF UPLOADED BYTES

All are in multiples of 3, it messed up by one second one time and corrected itself. We missed the first 28 digits. If you have them and their timestamp, please feel free to add them. 

[00:39] <Entropy> NEW BYTE: bc, 15 bytes, 30 chars, min: 22, max: f5, avg: 145.5333 (92),  stdev: 61.5314 (3e), entropy: 3.9069 bits/byte, modified: 2014-01-09 05:39:01 UTC (6 minutes, 0.000 seconds)

[00:54] <Entropy> NEW BYTE: 3a, 16 bytes, 32 chars, min: 22, max: f5, avg: 140.0625 (8c),  stdev: 63.2332 (3f), entropy: 4.0000 bits/byte, modified: 2014-01-09 05:54:01 UTC (15 minutes, 0.000 seconds)

[01:12] <Entropy> NEW BYTE: c7, 17 bytes, 34 chars, min: 22, max: f5, avg: 143.5294 (90),  stdev: 62.8931 (3f), entropy: 4.0875 bits/byte, modified: 2014-01-09 06:12:01 UTC (18 minutes, 0.000 seconds)

[01:15] <Entropy> NEW BYTE: f2, 18 bytes, 36 chars, min: 22, max: f5, avg: 149.0000 (95),  stdev: 65.1503 (41), entropy: 4.1699 bits/byte, modified: 2014-01-09 06:15:01 UTC (3 minutes, 0.000 seconds)

[01:21] <Entropy> NEW BYTE: 5e, 19 bytes, 38 chars, min: 22, max: f5, avg: 146.1053 (92),  stdev: 64.5909 (41), entropy: 4.2479 bits/byte, modified: 2014-01-09 06:21:01 UTC (6 minutes, 0.000 seconds)

[01:24] <Entropy> NEW BYTE: e7, 20 bytes, 40 chars, min: 22, max: f5, avg: 150.3500 (96), stdev: 65.6180 (42), entropy: 4.2219 bits/byte, modified: 2014-01-09 06:24:02 UTC (3 minutes, 1.000 seconds)

[01:36] <Entropy> NEW BYTE: 43, 21 bytes, 42 chars, min: 22, max: f5, avg: 146.3810 (92),  stdev: 66.4512 (42), entropy: 4.2971 bits/byte, modified: 2014-01-09 06:36:01 UTC (11 minutes, 59.000 seconds)

.4800 (8c), stdev: 72.2402 (48), entropy: 4.5639 bits/byte, modified: 2014-01-09 07:57:01 UTC (30 minutes, 0.000 seconds)

MORE WILL BE PUBLISHED AS SOON AS WE WILL FIND IT

Progress of PUZZLE is above this title






THIS PAGE IS DISCONTINUED, READONLY NOW. PLEASE DONT EDIT IT ANYMORE.

TO CONTINUE GO TO ARTICLE PART 3

LINK TO CURRENT SITE WITH UPDATED PROGRESS






Progress of PUZZLE is above this title

LINKS AND THINGS RELATED TO XORING

This Article was moved to  <a data-rte-meta="%7B%22type%22%3A%22external%22%2C%22text%22%3A%222014%20TIPS%20XOR%20TIPS%202014%20SUBPAGE%20%22%2C%22link%22%3A%22http%3A%5C%2F%5C%2FXOR%22%2C%22linktype%22%3A%22text%22%2C%22wasblank%22%3Afalse%2C%22wikitext%22%3A%22%5Bhttp%3A%5C%2F%5C%2FXOR%202014%20TIPS%20XOR%20TIPS%202014%20SUBPAGE%20%5D%22%7D" data-rte-instance="666868-214048535652d1c2663a620" rel="nofollow" class="external text" href="http://XOR">2014 TIPS XOR TIPS 2014 SUBPAGE </a>

Progress of PUZZLE is above this title

Community content is available under CC-BY-SA unless otherwise noted.
Advertisement

Fan Feed

More Uncovering Cicada Wiki