Feeds

Cicada 3301: The web's toughest and most creepy crypto-puzzle is BACK

Just who is behind this baffling and arcane mega-code-riddle?

The Essential Guide to IT Transformation

Poll The internet is full of daft things. Animated cat GIFs, stupid headlines, NSA spies, etc.

But the online world isn't just fields of mindless dreck. For instance, you could always take a crack at the web's toughest crypto-puzzle: the ever-baffling Cicada 3301.

Appearing each year since 2012, these strange series of challenges have stumped clever netizens the world over. By solving the riddles, it appears you eventually get in touch with the quizmasters, who are no doubt interested in people with your skills.

Now 2014's puzzle is underway after this image was linked to by this Twitter feed, which has been spewing raw data in tweets for the past few days. The picture shows this text: "Hello. Epiphany is upon you. Your pilgrimage has begun. Enlightenment awaits. Good luck. 3301."

If you fiddle with the image to enhance the shadows, it reveals a winged cicada insect that featured in last year's contest. But that's just a distraction. If you run the original JPEG through steganography analysis tool OutGuess, you get a quote from the essay Self-Reliance by Ralph Waldo Emerson – plus a sequence of numbers separated by colons and a cryptographic signature generated by the PGP key used in the past by the Cicada 3301 team.

Each line of those numbers hidden in the JPEG file refers to a paragraph, sentence, word and letter in that Emerson text, which is used to gradually build up a URL. So, for instance, 1:2:3:1 means take paragraph 1, sentence 2, word 3, letter 1, which is an 'a'.

The whole sequence constructs the URL auqgnxjtvdbll3pv.onion which refers to a web server running within the Tor network. That hands out another graphic that again uses steganography to hide a "good luck" message, RSA encrypted data and cipher variables that are needed to crack the encryption key to move on to the next part.

Crouching cipher, hidden lesson ... the cicada insect revealed in the original image

If you want to see how far down the rabbit hole this goes, a bunch of code-crackers are documenting their ongoing progress here. In fact, last year's puzzle is just as fascinating, involving finding bootable Linux CD images hidden online and locating and decoding posters on lamp posts dotted around the world.

It's not entirely clear if anyone successfully passed the 2013 test, but how it was unravelled reads like a plot from an extremely nerdy novel. An IT security expert called Joel Eriksson managed to defeat the 2012 challenge, but arrived at the final server too late – the Cicada 3301 team had already found their winners. It's believed those who arrive first are asked for their contact details, possibly revealing the whole thing is a job interview from hell.

You'll notice that knowledge of cryptography, steganography, programming, computer networks, obscure literature and runes, and mathematics is essential in order to get anywhere at all.

No one knows who is behind the spooky tests, or if they do, they're not telling. Apparently, it first surfaced on a grim 4chan.org discussion board about the paranormal, with the message: "We are looking for highly intelligent individuals."

Perhaps, then, it's just a 4chan prank, but Kenny Paterson, a crypto-professor at Royal Holloway, University of London, believes it's too well organised to be a practical joke.

"There's been several such competitions in the past. Google used to post puzzles on billboards beside the highways in Silicon Valley to attract people to come and work for them. A few years ago, our own GCHQ had a set of puzzles for people to solve as a way to recruit people with bright minds," he told BBC Radio 4.

"It's unlikely to be a spoof due to the lengths [Cicada 3301] have gone to. They are really sophisticated; they have all kinds of amazing, esoteric references in there to the work of [occultist] Aleister Crowley, for example, paintings by William Blake, and Maya numerals. It takes a long, long time to set up puzzles like this. It's not something you can do in your spare time."

So, what better way to decide what on Earth this thing is, than to put it to our Reg readers. Vote away in the poll below or pop a comment in the forums with other bright ideas, if you so wish. Or better yet, solve the mystery and tell us (PGP) what you found. ®

JavaScript Disabled

Please Enable JavaScript to use this feature.

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Tor attack nodes RIPPED MASKS off users for 6 MONTHS
Traffic confirmation attack bared users' privates - but to whom?
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
Russia to SAP, Apple: Hand over source code to prove you're not spies
And they'd get away with it too, if weren't for that meddling Snowden
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.