FANDOM


Analysis of the image/messageEdit

After the appearence of the message in the website 4chan, the image was processed by the  steganographic tool outguess. The following message was the result:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Welcome again.

Here is a book code.  To find the book, break this riddle:

A book whose study is forbidden
Once dictated to a beast;
To be read once and then destroyed
Or you shall have no peace.


I:1:6
I:2:15
I:3:26
I:5:4
I:6:15
I:10:26
I:14:136
I:15:68
I:16:42
I:18:17
I:19:14
I:20:58
I:21:10
I:22:8
I:23:6
I:25:17
I:26:33
I:27:30
I:46:32
I:47:53
I:49:209
I:50:10
I:51:115
I:52:39
I:53:4
I:62:43
I:63:8
III:19:84
III:20:10
III:21:11
III:22:3
III:23:58
5
I:1:3
I:2:15
I:3:6
I:14:17
I:30:68
I:60:11
II:49:84
II:50:50
II:64:104
II:76:3
II:76:3
0
I:60:11


Good luck.

3301

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJQ5QoZAAoJEBgfAeV6NQkPf2IQAKWgwI5EC33Hzje+YfeaLf6m
sLKjpc2Go98BWGReikDLS4PpkjX962L4Q3TZyzGenjJSUAEcyoHVINbqvK1sMvE5
9lBPmsdBMDPreA8oAZ3cbwtI3QuOFi3tY2qI5sJ7GSfUgiuI6FVVYTU/iXhXbHtL
boY4Sql5y7GaZ65cmH0eA6/418d9KL3Qq3qkTcM/tRAHhOZFMZfT42nsbcvZ2sWi
YyrAT5C+gs53YhODxEY0T9M2fam5AgUIWrMQa3oTRHSoNAefrDuOE7YtPy40j7kk
5/5RztmAzeEdRd8QS1ktHMezXEhdDP/DEdIJCLT5eA27VnTY4+x1Ag9tsDFuitY4
2kEaVtCrf/36JAAwEcwOg2B/stdjXe10RHFStY0N9wQdReW3yAOBohvtOubicbYY
mSCS1Bx91z7uYOo2QwtRaxNs69beSSy+oWBef4uTir8Q6WmgJpmzgmeG7ttEHquj
69CLSOWOm6Yc6qixsZy7ZkYDrSVrPwpAZdEXip7OHST5QE/Rd1M8RWCOODba16Lu
URKvgl0/nZumrPQYbB1roxAaCMtlMoIOvwcyldO0iOQ/2iD4Y0L4sTL7ojq2UYwX
bCotrhYv1srzBIOh+8vuBhV9ROnf/gab4tJII063EmztkBJ+HLfst0qZFAPHQG22
41kaNgYIYeikTrweFqSK
=Ybd6
-----END PGP SIGNATURE-----

A more analytic look revealed the use of a book cipher. To decrypt the message, one needed to find the text that was used for encrypting. This poem, introducing the secret message, was a nudge towards the right text. After a bit of debate, the text that was used to encrypt the book cipher was discovered. The book was Liber AL vel Legis, aka The Book of the Law, which is available online, and can be found here .


Encryption of the textEdit

In order for someone to encrypt the text he should realize that every line in it were directions to a character in The Book of the Law. For example, the first line I:1:6 points toward the 6th character of the first line in the first chapter, an 'h' in this case. It was assumed that spaces weren't counted. Punctuation, however, influenced the character chosen for the plaintext. During decrypting, we found that dashes were vital to the process, so we kept them in the plaintext. Using these rules, we encrypted the book cipher and came up with the decrypted message.

https:--www.dropbox.com-s-r7sgeb5dtmzj14s-3301

We agreed upon substituting the dashes with slashes and came up with a hyperlink.

The ISO ImageEdit

The hyperlink directed to a dropbox address with a file of 130MB ready for download.

After downloading, the file was analysed and a quick check for magic bytes (header bytes) revealed, that the offered file was an .iso image. The image was downloaded by multiple people and either burned to disc to run on a computer or opened in a virtual drive. Looking into its contents, we find three directories, "data", "boot" and "audio".


The SongEdit

The folder "audio" contained an audio recording. The title of the recording was "761.mp3" and can be downloaded here. The ID3 tags show us that the title of the file is "The Instar Emergence" and the artist "3301". The used instrument is a guitar, with distorting effects on it. On the track, a reversed guitar is played and amplified throughout. The song has been deconstructed and checked for hidden reversed messag
Cicada 3301 Song The Instar Emergence (761)02:48

Cicada 3301 Song The Instar Emergence (761)

The original song in the directory of the .iso

es, but as of yet has turned up nothing out of the ordinary. Some people claimed the key of the recording to be G#. Key points about the track is the initial 'breath' sound, believed to be the sound of many cicadas and the tempo changes, beginning at approximately 135 bpm, accelerating to 145bpm, then slowing to 125bpm. This has led some to believe that the song has been slowed down by 5%. The only  identified instruments so far are a forward and reversed guitar and a heavily effect driven bass drum.It has also been pointed out that the song is 2:47 long, or 167 seconds, which is prime.  It is also a reversal of the name of the file: 761.mp3, and 761 is also prime.


The PoemEdit

A draft spectral analysis of the song showed a constant hum at 15.4-16.1kHz, and empty notches under 500Hz starting from 1:56. A hexdump of the mp3 file revealed the following message:

The Instar Emergence

Parable 1,595,277,641 
Like the instar, tunneling to the surface
We must shed our own circumferences;
Find the divinity within and emerge.

The original message had "\n" attached to the end of each line. This character sequence is used to indicate a new line in some programming languages. These were omitted due to the availability of proper formatting techniques.

The subgroup who were assigned the task of analyzing the poem/riddle above have speculated that circumferences might be a reference to perceived limitations rather than actual physical walls. "Find the divinity within and emerge" is most likely a reference to the divine ratio, or phi. Such shedding may also be a reference to the way Cicadas shed their shells.

This poem has a heavy emphasis on the "we" and "our" parts of it, implying that to move on to the next riddles and clues, cooperation is advised.

The Boot SequenceEdit

When booting from the image, a boot sequence appeared, printing a sequence of numbers to the screen. Investigating the sequence revealed, that the live image prints out all prime numbers up to 3301. There were temporary two-second pauses at 1033 and 3301, where it stops at the latter and moves to the second stage.  The next, and last stage of the procedure is a screen that reads:

@1231507051321

The key is all around you.

Good luck.

3301
Further analysis of the live image turned up the routine responsible for the display of the prime numbers. It is a linux shell script (found here , for those interested), which, luckily, is human-readable. It does not calculate
Cicada Boot Sequence00:42

Cicada Boot Sequence

Video of the boot sequence in action

prime numbers, like some suggested, but connected the printing command with a sleep command. In most cases, the sleep time is 0.5 seconds. In case of the primes 1033 and 3301 however, the sleep time is 2 seconds, which manifested the relevance of those two numbers. Also, this clue said "you" not "we", differing from the last one in the choice of words.

Also found in the image was this PGP signature, which has been verified to be 3301's official signature released during the puzzle in 2012.

It is possible to interrupt the boot sequence by pressing CTRL+C. User "tc" is active and does not require a password, is in sudoers file with no prompt. `sudo ash` to raise to root. Further inspection revealed nothing that is not listed in this wiki.


Folly and WisdomEdit

In CICADA OS We found two more files named Wisdom and Folly in ./tmp (you can find a screenshot of the files here

http://codeseekah.com/cicada/folly http://codeseekah.com/cicada/wisdom http://codeseekah.com/cicada/folly.32.txt wisdom is the same, identical files

The TwitterEdit

While people still searched through the image to find more hints that may have been overlooked, somebody in the IRC found a twitter account which got our attention, to say the least. Multiple things were strange about that twitter. It fits the overall "style" of cicada, it was registered shortly after the first downloads of the live image and it had no followers. It was later found to be the reference on the boot CD to @1231507051321 (note: 1231507051321 is a palindromic prime number). The most striking thing about it though was the messages it tweeted.

Each tweet consisted of an offset, and 65 bytes of hex code. For example, the first message went like so:

0000000: b69ccce300104a464802545959580001008d0000ff8b6131616a6a632737293d3e322b3b3e3f263a203c0c4762677c326767713d73716d697b6e3000505b494e47

3301 appears to have used a bot to post the tweets at 5 minute intervals (up until 0:00 GMT Jan 7), then onto four minute intervals until 19:00 GMT Jan 7, where it was seemingly random up until 22:04 GMT Jan 7, where it moved onto two minute intervals. The twitter bot stopped posting tweets at 4:52 GMT on Jan 8.

The meaning of the tweets and the rest of the files left the solvers stumped for several hours. A full feed of the tweets is avaliable here.


Breakthrough on TwitterEdit

Testout

Result of xor-ing the twitter information with 761.mp3

After a day of headless searching, a brave anon made a discovery that would ultimately link the twitter to the cicada organization as well as explaining the meaning of the hexadecimal numbers posted. He took the music file mentioned earlier, "716.mp3", and applied the binary "xor" operation on it. The result was a String, which turned out to be encoded via the base64 scheme. Decoding the String rendered a png file. Even though the tweets haven't died down yet and there is not enough information to xor every byte from the mp3 file from the tweets yet, apparently it was possible to "pre"-construct the image resulting from the tweets.


Gematria PrimusEdit

The .jpg file appears to be a rune table, consisting of three columns, named "Rune", "Letter" and "Value", and 29 entries. "Rune" contains, the actual rune character, "Letter" contains one or more plain text characters and "Value" contains a number. It is interesting to note that the numbers to be found in "Value" are all ascending primes, building the sequences of the first 29 prime numbers. As a member in the IRC pointed out, the runes stem from the Anglo-Saxon rune set, and the letters are in the order of the Anglo-Saxon runes.


Applying OutGuessEdit

It was soon discovered that this image, as well as the very first one, contains a hidden message, once again masked via OutGuess. The message itself can be found here. As in every message from Cicada, the content was followed by a PGP signature, which proved the authenticity of the message


Twitter ReactivatesEdit

The twitter account stopped spewing hex code at 4:54. It then produced 1 more message at 5:45, which reads:

Offset: 0, Skip: 0, Col: 65, Line: 988

There is speculation as to whether this is actually relevant. The twitter account may have a second useful message in it, it may not. It could be our 'second chance', though.

First Onion Edit

emiwp4muu2ktwknf.onion

Solving the whitespaceEdit

After finally getting a message from 3301, we found that it was, to quote the IRC, 'Mostly Blank'. The message, it turns out, contained a mixture of tabs and spaces. We converted this to binary, then again to ASCII, then ygmve worked his magic and we found the next message:

"Come to emiwp4muu2ktwknf.onion"

"We shall await you there." 

"Good luck." 

"3301"

A quick filler: emiwp4muu2ktwknf.onion is a website that can only be accessed through T.O.R., which is using a hidden service URL.

Upon visiting the website, we were presented with the following message, which was incomplete:

Note: the formatting may be a little off on your screen. Press control/command and - to view the full message.

Web browsers are useless here.


      ,+++77777++=:,                    +=                      ,,++=7++=,,
    7~?7   +7I77 :,I777  I          77 7+77 7:        ,?777777??~,=+=~I7?,=77 I
=7I7I~7  ,77: ++:~+7 77=7777 7     +77=7 =7I7     ,I777= 77,:~7 +?7, ~7   ~ 777?
77+7I 777~,,=7~  ,::7=7: 7 77   77: 7 7 +77,7 I777~+777I=   =:,77,77  77 7,777,
  = 7  ?7 , 7~,~  + 77 ?: :?777 +~77 77? I7777I7I7 777+77   =:, ?7   +7 777?
      77 ~I == ~77= +777 777~: I,+77?  7  7:?7? ?7 7 7 77 ~I   7I,,?7 I77~
       I 7=77~+77+?=:I+~77?     , I 7? 77 7   777~ +7 I+?7  +7~?777,77I
         =77 77= +7 7777         ,7 7?7:,??7     +7    7   77??+ 7777,
             =I, I 7+:77?         +7I7?7777 :             :7 7
                7I7I?77 ~         +7:77,     ~         +7,::7   7
               ,7~77?7? ?:         7+:77777,           77 :7777=
                ?77 +I7+,7         7~  7,+7  ,?       ?7?~?777:
                   I777=7777 ~     77 :  77 =7+,    I77  777
                     +      ~?     , + 7    ,, ~I,  = ? ,
                                    77:I+
                                    ,7
                                     :77
                                        :

Welcome.

Telnetting inEdit

We soon found that web browsers were indeed useless, and that we would have to telnet into the website through the tor network. Some solvers did so, and we found that the website included an interactive shell. You could type in any number to have it factorized, count to have it count up prime numbers, quit to quit, and hello to pump out an interesting message:

hello
A message for you:

0000000:2d2d2d2d2d424547494e20504750205349474e4544204d4553534147452d2d2d2d2d0a486173683a20534841310a0a20202020200a5665727920676f6f642e0a20
0000041:20200a596f75206861766520646f6e652077656c6c20746f20636f6d652074686973206661722e0a20200a7873786e616b73696374366567786b712e6f6e696f6e
0000082:0a20200a476f6f64206c75636b2e0a2020200a333330310a20202020200a2d2d2d2d2d424547494e20504750205349474e41545552452d2d2d2d2d0a5665727369
00000c3:6f6e3a20476e7550472076312e342e31312028474e552f4c696e7578290a0a69514963424145424167414742514a513653304841416f4a45426766416556364e51
0000104:6b502f4a3051414c44716133564a7939784c4c6c6749356a5068524970340a66786562624e6874454c4f4859466b44355a397a745159476c65376c4b504d386c6b
0000145:4d536e636949593035394b4969354e53545637493937734a626f473377740a6b6848745a674e52773176325751357575724375356c31772b38342f4c354a7a324e
0000186:6d456c784f427a57723638646c5159743271664251786b327a522f6654490a544c43454776465a746c6e724e66426b376a7349794a59635858506761625334376f
00001c7:5039764f45586c42312b506d30433775505042504e3761716b665550476c0a6f3166326873634a66374a65324476625a742b3665787859736d3537467039353358
0000208:414e41642f557046567a542f3835325867363367745a72492b536d66335a0a4256636a70437a7948337753385230694d2b7270303243774a704a7a7357474c7865
0000249:51476d584c325358424234337a565a414a716c355564584c5447586b62640a6e504d64332f43624a2b6c37724f305941673570334a66344b617558375a64365a63
000028a:3277484b4c4f76666a5176455758495931434d68493638426a30725a6f2f0a4d2f666933313346465450416d3678684b52762f74482f387756726172326a593777
00002cb:6e45385878685273793734415a35477141326f484d6566544171335975570a35505838733638324a34706b44554b48476134793635766a49703136706d45496e4d
000030c:414c4a4762777a366d7461754251716c53364152735166656b446e336f5a0a796f73532b675743336a6449764835733557555147566c376a797a3974342b335467
000034d:35635439526e367058324e564e585378677a585842346e493258727259610a346b517235615742386c737361763372796a3543673246486c312b4d4b4f30675976
000038e:2f554633515437354d6978514d75344d2b3577436e4e656b676675794f360a5a7679627a70347334537a526a6b6b39734d4d360a3d5759564f0a2d2d2d2d2d454e
00003cf:4420504750205349474e41545552452d2d2d2d2d0a
Offset: 3301, Skip: 0, Col: 65, Line: 16.

It was soon discovered that these ( http://pastebin.com/uCTgE2K ) messages could be turned into ASCII which created another message, again GPG signed by 3301. The message reads as follows:

Very good.
   
You have done well to come this far.
  
xsxnaksict6egxkq.onion
  
Good luck.
   
3301

Note: The second onion address has been redacted as some people have been annoyed about people finding it randomly. If you seek, you shall find. This version of tor address is not redacted.

This led to the second .onion address.


"You can't see the forest" MessageEdit

A new message was found by telnetting "hint" or "clue". And XORing result with _560.00 filr from DATA folder on 3301.txt CD image.

You can't see the forest when you're looking at the trees.

Good luck.

3301

"hint" output:

1  Here is a clue:
2
3  0000000: 1fd9d91c746f141803d010071f18f0028a0b69763d1d19037daa222b4f46b3264d21ed1d31c514982b502e558ffe583b2e018e62bfe44ac063caf344469c53c7da
4  0000041: 72beefe909de045a3df0e8b7320d570516b431c42f73c08e39af504fd00e88bb323ae09f436395fe1955dd99251693a5971a1738871354ebebf6e74f94b21f7a3b
5  0000082: 346063d15bd2f0fbacc86d74b6aaaac0d44b6c54300b5eabb9d699f854ae855385fb5bce0a4304964bf6a9020acb540921d17844f39856a97a2f2623547c61009a
6  00000c3: 421b1756748009c31b9311745f5a2e661175c8b7958fe459fae4d96e9323b29fd21f83565c60f69d51da75ddaf6f06283b77fc0362ba41e570e70a6b6efa2a34b0
7  0000104: d9f1d2dde221bf636d9c7c47b6291d4bf7b3389916c46652edf7daf8efa2d0d0909f96b57a3310a3c029da90481eeb4b0d53620be26ab5fb5370bfd4edc49514b2
8  0000145: 2c43c402fc58554b1556d092d7410fb5cd8ba8d92af3cbbc023f3787c3ece9afee71cef31d63b826bd2292bfac22c6e5cc034237575f1737e2aa24262deced106b
9  0000186: 89e2032ebe6ab51c8d0cf0fe2394b0c5c8d609b1c54bd2178631f9c0f2350d7a798e52b44a50517bc0dd245db004fe0ca6460c02e81699fdea7494165c96ed4bfd
10 00001c7: 45d26598bf08c3d8e5486ead896f29bd0b996515157448132ea6e02f8f9d23108e69874956fdf69f2ced112f1a4924c8ec35182253c5288be0e3aa2ccbf7b7affc
11 0000208: d1dc90726bb30c26d41f5854a41b2ea0dc68345aa3bb11b8688c407d36cdd4cdde47d26348d75397e1636b06dbae541452c1173b59b70bc37fe28615c5636158a0
12 0000249: 38ab6ba758d90d2b93402505265e8374a7f5d9a7528837aad79d8e6ca20b8deac1a67755b7db9f79835a463bce04ded91a13d72c57950d95fd2f65d207299596f1
13 000028a: 82d27d220e44a4f95d1abb5ad1d133133b4c787721c0a3ddd32c311ffb6d8b8bc9df64658c9156bd0c1393a35236ecb18cdb93cfa5c23ccee333704fe1606fa063
14 00002cb: 2307b427788df8036c164ce171d42fd3d0fded1bbd8690bff52e35536a3aaaf9fa6872178f94b35b056e860d637c81664a1e1310df56344ddf19bf4fa4f2a28193
15 000030c: dc34cdd5423ef2cbe680fbc015ce9f6cd71424789674424ef787a1e7aec7f22d487af53bfe5e4ed4b8f207279573f00c7270e136095eb70fe6c465e0291297d059
16 000034d: 376088f46e159efee300d64eea644a6b5a7038f411d0f4efd67446836860f1084a01e180bacec753403fe6a845e02f82f7781eba82d2dfb38274c156f7b546cb19
17 000038e: b4ba5b8e84f85645830eeb3d70207d299b649e8d592536e4df0b03888ca3740d9de623d00aea1e0adfcf23d92c6dde711d187ca9d592c31ab00ac6e217892ccefd
18 00003cf: 1be10b
19 Offset: 0, Skip: 0, Col: 65, Line: 16.

Telneting PRIMESEdit

Telnetting "primes" shell prints out list of primes similar to one on CICADA OS, but some primes are missing and two have extra space in front of them.

So space between 29  31 and 3257  3259
And missing some primes between 71 1229

Missing Primes:

   73     79     83     89     97     101    103    107    109    113 
   127    131    137    139    149    151    157    163    167    173 
   179    181    191    193    197    199    211    223    227    229 
   233    239    241    251    257    263    269    271    277    281 
   283    293    307    311    313    317    331    337    347    349 
   353    359    367    373    379    383    389    397    401    409 
   419    421    431    433    439    443    449    457    461    463 
   467    479    487    491    499    503    509    521    523    541 
   547    557    563    569    571    577    587    593    599    601 
   607    613    617    619    631    641    643    647    653    659 
   661    673    677    683    691    701    709    719    727    733 
   739    743    751    757    761    769    773    787    797    809 
   811    821    823    827    829    839    853    857    859    863 
   877    881    883    887    907    911    919    929    937    941 
   947    953    967    971    977    983    991    997    1009   1013 
   1019   1021   1031   1033   1039   1049   1051   1061   1063   1069 
   1087   1091   1093   1097   1103   1109   1117   1123   1129   1151 
   1153   1163   1171   1181   1187   1193   1201   1213   1217   1223

"primes" output  http://pastebin.com/raw.php?i=xGY4pbHV

list of primes http://primes.utm.edu/lists/small/1000.txt

Missing primes in hex (no spaces assumed) http://pastebin.com/raw.php?i=FmVb2CbL

http://codeseekah.com/cicada/console.html    REDIRECT LINK TO TOR TELNET

Second OnionEdit

xsxnaksict6egxkq.onion

Once we had found the second .onion, the next logical step was to visit it. Upon arrival, we found the following:

Patience is a virtue.

Rumaging through the source code for the html, we found the following:

<html>
	<head><title>3301</title></head>
	<body>
		Patience is a virtue.
		
	</body>
</html>

Soon afterwards, someone attempted to telnet into it, producing an error message which contained the address of the VPS on which the site was hosted. Promptly afterwards, the site was taken down.


Second Onion Back AgainEdit

Tor page changed again. We noticed the change at about: 06:31 AM 14.1.2013 (GMT)

<*html>
<*head><title>3301</title><*/head>
<*body>
<*pre>-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

You already have everything you need to continue.

Sometimes one must "knock on the sky and listen to the sound."

Good luck.

3301

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJQ85gbAAoJEBgfAeV6NQkP6joP/iHzBMvK6YZO24wv24RtstGJ
dEMrC9BjtUhrB+F0++sHqWeYuueZ37bDstIoh6EOenRHpECD0QBPTc40aUl2Op1L
4NuUVCUQvfqo/kdWBmSdTP4xGoCtwcXoISfhSM/i+wXqRONSy4z0FrXA3N9yxFaK
eqlNk47aZvyWWHcyYACUEar/V4kfGo8j58r2CisnfeNwat6I6ZfL9P370UVJQyG1
a0WV7rF015TLbwAJkwI1jX7GLPWOkRK3lP8qLJJodNvMPSSyUPyPB01ElgBopm+t
U9bQb/wIGtGG74ezUvwhtDGtXJLWllZtrZx82mQQWzzn8hReqqX0T35idJlTfxIz
aZDNjLCOQJZCngmXEN7iz47w/g67BQ5eoa6iEj7blFwzMwVO7M7pL+L6LZLnuXml
Zv1oDNCuENrIo4j8VGLro9pLptiilsUA6xFRS9bfE7qeeBfmS4J8DScOddzLYNVv
5fKd6iaLJoAqJGkcKnAWPl5VViDhYRL0z1N80zpjm1cWtPBIS2odLMZT80VfMYQI
8XXaEmRqoP8/9EImapqeSk+qcrUkT1+2opKRTOf7754ptjvJq31jQJgeY2gKGtp1
jPXZiu9Pp3QQ5cRKIWIIdOFvcrVtIZ/P3OYhT0p4Z+L13fScUbr/kxI6KcZmY/1D
Szqzyr8SW7zRz1ypGffc
=UPkJ
-----END PGP SIGNATURE-----</pre>
</body>
</html>

After Telneting PRIMES to first .onionEdit

After Telneting PRIMES to first .onion we got another hint on 2nd onion:

You already have everything you need to continue.
Sometimes one must "knock on the sky and listen to the sound."
Good luck.


PingingEdit

Pinging its doxed clearnet address eventually made people notice two responses being sent back per ICMP echo request. (Some routers and ISPs filter out-of-band ICMP requests [ICMP flood protection probably] so there are no guarantees that someone will actually get these).

17:32:39.976269 IP (tos 0x0, ttl 50, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
    li498-122.members.linode.com > xxxx: ICMP echo reply, id 3457, seq 1, length 64
...c866c2e3cd2eda7698b2057681c3846fba7bf4b1c1bc6c7f2e8db8fc

17:32:40.975445 IP (tos 0x0, ttl 50, id 16499, offset 0, flags [none], proto ICMP (1), length 84)
    li498-122.members.linode.com > xxxx: ICMP echo reply, id 54023, seq 1011, length 64
E..T@s..2...j.gzX...........hL.PN.
..
.................. !"#$%&'()*+,-./01234567

17:32:40.976024 IP (tos 0x0, ttl 50, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
    li498-122.members.linode.com > xxxx: ICMP echo reply, id 3461, seq 1, length 64
...e0ddd275cf4069985ed481c22491bb267414e5fb128fdb429c662443

17:32:41.975507 IP (tos 0x0, ttl 50, id 16500, offset 0, flags [none], proto ICMP (1), length 84)
    li498-122.members.linode.com > xxxx: ICMP echo reply, id 54023, seq 1012, length 64
...T@t..2...j.gzX...........iL.P
..
.................. !"#$%&'()*+,-./01234567

17:32:41.976238 IP (tos 0x0, ttl 50, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
    li498-122.members.linode.com > xxxx: ICMP echo reply, id 3463, seq 1, length 64
...f6856ed2d4aa87f36686ca58e0f82927b1756e6d7bcf94f6abb55c4f


Notice ping responses with sequence number 1 being interlaced with regular sequenced responses. The data is repeat over and over again.

1f8b080843f5ee5000036d6573736167652e7478742e617363006d93
49b3aa460085f7fd2b582645dd8b80a2bcaa2c804668440691417620
202d43338bfefadc57c92e39db337cabf3f5f52359d59045399a4379
48b354489d55cf9334f5b7f705f4642c7f519e2eb1008030af6b2a23
6dfe4d5137325365b2e4d49d34395524c337005d55372b97e7a5503c
a7fda7f8262d262d001a211955cff7ea27c3f39bdf535fff454b57ff
f22f35c887f1a7f98bd2dad9d1a885fdde7eb32cf58766f98c89db79
fd1300eca2bb2ca9b2f49034d935dcfd12404922862a3f0a290f04cb
ad1c71dd3a0ccf4a3bd3f9a0b2c2f830cacf3958d1dd6ec1f674746d
7a0e82f1b2e33fa8f1fabaec051c48aa489fc87e41fd1372aff28afc
63708b2db96744eea5c6c6ac78a4258b0ef4fe165f5d5c224fcc6817
ce2fdf5aa2618bebe1d2a0ebe93c842f1e72fcd085a310d76d5ece3e
0cd0616e534b8c315f02be5c48c533347324858913f1b4a4843e2288
f757d1b22e5d9f778f286384cc45ceb66a05be3a290eb771cfd9a5e0
8ae8086273dd49d063b7f6925847cb97f4abc1f659e5dceed9155bd0
a8d6be62c703f7e632a211d5d928a5ec1b6bfd3e633f885ac062d37e
35dcc91a0a0115c2f6b4aa249fec2109fb87e808352f3fb5c051aa81
4cb2b03978dec899b81c93adbcc105e27920c975b778103d3a79663e
c866c2e3cd2eda7698b2057681c3846fba7bf4b1c1bc6c7f2e8db8fc
e0ddd275cf4069985ed481c22491bb267414e5fb128fdb429c662443
f6856ed2d4aa87f36686ca58e0f82927b1756e6d7bcf94f6abb55c4f
96cef7019c7a73f7d6bdb643bb8d32118916def730f62f72354cec30
6d736b1d95de65a330cf98324cfb54f06ac3c81bc376d2b49940b083
7b0c7d9b1e381bf96a7c2d14ef997d86e86e1c8ee6d42b5a909846a9
64e31b0f17bdf12fafea66be18f970edee86fb017d7a13480e574846
94aac25c422be02ec1a9e9c2de84e7d2d4f4e059c1a7d1914cdd99bc
9da6ef3a9c2fad5e1cfbe2a403b699d3e52c6964c30feb5adf6831d2
c05f82f718fff9896ac1ff7bc9df603740d3bf030000


This is a hexdump of a gzipped file: /dev/stdin: gzip compressed data, was "message.txt.asc", from Unix, last modified: Thu Jan 10 22:07:15 2013, feeding through gunzip returns:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Well done.  You have come far.

pklmx2eeh6fjt7zf.onion

Good luck.

3301


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJQ7vVDAAoJEBgfAeV6NQkP9x4P/31A5LPzIhkii8sBjuVxIcOn
4KFQO+uVVsR53zImSqlhq6iVAE9+Ko7vIqjD2whTIUFVYZNBq/92wEZJuCSonovH
HqYZTQihIS9d+QDuwUNvXr4ilrRmITKMrWw3D23rpWs6ZlnehuUDVI8unbN9Zi3h
3hvok3/+/FofLia9Kvbo+FIDi7T9NNRpqepgXd/6dQIP4kn63kKCP20QMdRf2fXF
ZLx5ADS14OvaNFNUAHTJ1qdkPYcdTiNDJkxqk1s82y2doGoEP0ChBUJxlyMiUVXn
1iLOwm2KNrf6If64KxEoetOraWqg9P6l3BjGVPCkrotB608SSs2Lihsa4B0ifI33
ABlpvSDIgpBu/zIO/WFYOfnnrtdvDpVP/Wy+pgqZJ/wOUuhJZhzi5vppjVCm/q9H
C/aXQxa+XXe7his4f9tuIBD1wIYAtnE8M0uDCsfiZjBaZNMnOO7/hOwnNQSBAMcr
KqL5yHSnpI50CtoA+6ycWZURBkrt1rt4eNxsCqQ1XWed/hWbqb6SlJJemJOPbbmt
V5D7iDUO+r2OIUEZTfCSjdzrXcJ8FLtqCGVaLJhCdsyirRHmURwkYLw/B8TpcJQz
qbY6oeDxDosIbE6uhDNV2RVKmpWqLDMhLGHVjkDjJpodE5L3ObbylWuRnHfFqfKH
1mubvMAGo03rxxlY+9XG
=6Sgs
-----END PGP SIGNATURE-----


Third onion: pklmx2eeh6fjt7zf.onion



Previous: Cicada's 2013 test beginsEdit

Next: Third Onion page, posters and SSSS codesEdit

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.