Feeds

Cicada 3301: The web's toughest and most creepy crypto-puzzle is BACK

Just who is behind this baffling and arcane mega-code-riddle?

High performance access to file storage

Poll The internet is full of daft things. Animated cat GIFs, stupid headlines, NSA spies, etc.

But the online world isn't just fields of mindless dreck. For instance, you could always take a crack at the web's toughest crypto-puzzle: the ever-baffling Cicada 3301.

Appearing each year since 2012, these strange series of challenges have stumped clever netizens the world over. By solving the riddles, it appears you eventually get in touch with the quizmasters, who are no doubt interested in people with your skills.

Now 2014's puzzle is underway after this image was linked to by this Twitter feed, which has been spewing raw data in tweets for the past few days. The picture shows this text: "Hello. Epiphany is upon you. Your pilgrimage has begun. Enlightenment awaits. Good luck. 3301."

If you fiddle with the image to enhance the shadows, it reveals a winged cicada insect that featured in last year's contest. But that's just a distraction. If you run the original JPEG through steganography analysis tool OutGuess, you get a quote from the essay Self-Reliance by Ralph Waldo Emerson – plus a sequence of numbers separated by colons and a cryptographic signature generated by the PGP key used in the past by the Cicada 3301 team.

Each line of those numbers hidden in the JPEG file refers to a paragraph, sentence, word and letter in that Emerson text, which is used to gradually build up a URL. So, for instance, 1:2:3:1 means take paragraph 1, sentence 2, word 3, letter 1, which is an 'a'.

The whole sequence constructs the URL auqgnxjtvdbll3pv.onion which refers to a web server running within the Tor network. That hands out another graphic that again uses steganography to hide a "good luck" message, RSA encrypted data and cipher variables that are needed to crack the encryption key to move on to the next part.

Crouching cipher, hidden lesson ... the cicada insect revealed in the original image

If you want to see how far down the rabbit hole this goes, a bunch of code-crackers are documenting their ongoing progress here. In fact, last year's puzzle is just as fascinating, involving finding bootable Linux CD images hidden online and locating and decoding posters on lamp posts dotted around the world.

It's not entirely clear if anyone successfully passed the 2013 test, but how it was unravelled reads like a plot from an extremely nerdy novel. An IT security expert called Joel Eriksson managed to defeat the 2012 challenge, but arrived at the final server too late – the Cicada 3301 team had already found their winners. It's believed those who arrive first are asked for their contact details, possibly revealing the whole thing is a job interview from hell.

You'll notice that knowledge of cryptography, steganography, programming, computer networks, obscure literature and runes, and mathematics is essential in order to get anywhere at all.

No one knows who is behind the spooky tests, or if they do, they're not telling. Apparently, it first surfaced on a grim 4chan.org discussion board about the paranormal, with the message: "We are looking for highly intelligent individuals."

Perhaps, then, it's just a 4chan prank, but Kenny Paterson, a crypto-professor at Royal Holloway, University of London, believes it's too well organised to be a practical joke.

"There's been several such competitions in the past. Google used to post puzzles on billboards beside the highways in Silicon Valley to attract people to come and work for them. A few years ago, our own GCHQ had a set of puzzles for people to solve as a way to recruit people with bright minds," he told BBC Radio 4.

"It's unlikely to be a spoof due to the lengths [Cicada 3301] have gone to. They are really sophisticated; they have all kinds of amazing, esoteric references in there to the work of [occultist] Aleister Crowley, for example, paintings by William Blake, and Maya numerals. It takes a long, long time to set up puzzles like this. It's not something you can do in your spare time."

So, what better way to decide what on Earth this thing is, than to put it to our Reg readers. Vote away in the poll below or pop a comment in the forums with other bright ideas, if you so wish. Or better yet, solve the mystery and tell us (PGP) what you found. ®

JavaScript Disabled

Please Enable JavaScript to use this feature.

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
Oz bank in comedy Heartbleed blog FAIL
Bank: 'We are now safely patched.' Customers: 'You were using OpenSSL?'
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.