Cicada 3301: The web's toughest and most creepy crypto-puzzle is BACK
Just who is behind this baffling and arcane mega-code-riddle?
Poll The internet is full of daft things. Animated cat GIFs, stupid headlines, NSA spies, etc.
But the online world isn't just fields of mindless dreck. For instance, you could always take a crack at the web's toughest crypto-puzzle: the ever-baffling Cicada 3301.
Appearing each year since 2012, these strange series of challenges have stumped clever netizens the world over. By solving the riddles, it appears you eventually get in touch with the quizmasters, who are no doubt interested in people with your skills.
Now 2014's puzzle is underway after this image was linked to by this Twitter feed, which has been spewing raw data in tweets for the past few days. The picture shows this text: "Hello. Epiphany is upon you. Your pilgrimage has begun. Enlightenment awaits. Good luck. 3301."
If you fiddle with the image to enhance the shadows, it reveals a winged cicada insect that featured in last year's contest. But that's just a distraction. If you run the original JPEG through steganography analysis tool OutGuess, you get a quote from the essay Self-Reliance by Ralph Waldo Emerson – plus a sequence of numbers separated by colons and a cryptographic signature generated by the PGP key used in the past by the Cicada 3301 team.
Each line of those numbers hidden in the JPEG file refers to a paragraph, sentence, word and letter in that Emerson text, which is used to gradually build up a URL. So, for instance,
1:2:3:1 means take paragraph 1, sentence 2, word 3, letter 1, which is an 'a'.
The whole sequence constructs the URL auqgnxjtvdbll3pv.onion which refers to a web server running within the Tor network. That hands out another graphic that again uses steganography to hide a "good luck" message, RSA encrypted data and cipher variables that are needed to crack the encryption key to move on to the next part.
Crouching cipher, hidden lesson ... the cicada insect revealed in the original image
If you want to see how far down the rabbit hole this goes, a bunch of code-crackers are documenting their ongoing progress here. In fact, last year's puzzle is just as fascinating, involving finding bootable Linux CD images hidden online and locating and decoding posters on lamp posts dotted around the world.
It's not entirely clear if anyone successfully passed the 2013 test, but how it was unravelled reads like a plot from an extremely nerdy novel. An IT security expert called Joel Eriksson managed to defeat the 2012 challenge, but arrived at the final server too late – the Cicada 3301 team had already found their winners. It's believed those who arrive first are asked for their contact details, possibly revealing the whole thing is a job interview from hell.
You'll notice that knowledge of cryptography, steganography, programming, computer networks, obscure literature and runes, and mathematics is essential in order to get anywhere at all.
No one knows who is behind the spooky tests, or if they do, they're not telling. Apparently, it first surfaced on a grim 4chan.org discussion board about the paranormal, with the message: "We are looking for highly intelligent individuals."
Perhaps, then, it's just a 4chan prank, but Kenny Paterson, a crypto-professor at Royal Holloway, University of London, believes it's too well organised to be a practical joke.
"There's been several such competitions in the past. Google used to post puzzles on billboards beside the highways in Silicon Valley to attract people to come and work for them. A few years ago, our own GCHQ had a set of puzzles for people to solve as a way to recruit people with bright minds," he told BBC Radio 4.
"It's unlikely to be a spoof due to the lengths [Cicada 3301] have gone to. They are really sophisticated; they have all kinds of amazing, esoteric references in there to the work of [occultist] Aleister Crowley, for example, paintings by William Blake, and Maya numerals. It takes a long, long time to set up puzzles like this. It's not something you can do in your spare time."
So, what better way to decide what on Earth this thing is, than to put it to our Reg readers. Vote away in the poll below or pop a comment in the forums with other bright ideas, if you so wish. Or better yet, solve the mystery and tell us (PGP) what you found. ®
Sponsored: Network DDoS protection