Cicada 3301: The hunt continues in 2014

The first part .

Despite concerns that media outreach would hinder this, Cicada began a new recruitment on January 6, 2014.

The great popularity of this quest meant the emergence of a huge number of fake pictures from people posing as Cicadas, which actually happened. From the first days of January, 4chan began to fill up with "black pictures with white text" posing as new assignments. However, on January 5, a day after the usual deadline for publishing the first task, when everyone had already begun to disperse, and the last hope was lost ...

After almost a year of inactivity, a twitter post with the following text was posted from the Twitter account on which the tasks of previous years were posted: “Hello. Epiphany is upon you. Your pilgrimage has begun. Enlightenment awaits. Good luck. 3301. ", which can be translated as" Hello. Behold the Epiphany. Your pilgrimage has begun. Enlightenment awaits. Good luck. 3301. "



In the picture, as usual, the path to the next task was hidden, but this time it was not just him. Having played a little with Photoshop, I managed to get the following replay:



It turns out that the black color was not black at all, but very dark gray, at least I would have done something already. It was a really important message to get a little harder: it was necessary to skip the picture through the well-known OutGuess, which using steganography hides different text in different files. Here is what he showed us:

As you can see from the text, the .onion site is encrypted there, the address of which was hidden in the book of Ralph Waldo Emerson in order to extract the letters, it was necessary to use the following code: x: x: x: x = (paragraph: sentence: book: letter) After long searches managed to find this address: auqgnxjtvdbll3pv.onion, clicking on which you got to a page with a collage of modified paintings by William Blake. (Try to find the cicada symbol in the image)



Again, using OutGuess, a 130-digit number and an encrypted message were found, to decrypt which, it was necessary to factorize a semisimple number and restore the RSA key from the resulting numbers. Despite the simplicity of this process, factorization took quite a lot of time, all the work was distributed between the computers of the volunteers (about 30 people) and took 8 hours. To be honest, it was fast enough compared to 1994, when a 129-digit semi-simple number was factorized by 600 people over eight months.

After decrypting the message, we received a new Tor address: cu343l33nqaekrnw.onion. This time the site turned out to be an ever-growing list of characters, into which 2 new ones were added every few minutes. We sat and waited. We waited for 23 hours. Many guys went to search the previous messages, hoping to find the information that was missed earlier. Some tried to determine the sequence of occurrence of characters, and thereby predict what will happen next. Until everything finally stopped, at this point the number of characters was 512. After a few minutes the site was a blank page, and a minute later a line appeared containing more than 360,000 characters. Ultimately, it was converted into 3 separate pictures, each of which contained a hidden message and 2 lines of mixed letters and numbers:
IDGTK UMLOO ARWOE RTHIS UTETL HUTIA TSLLO
UIMNI TELNJ 7TFYV OIUAU SNOCO 5JI4M EODZZ

Suddenly, the main chat we used to coordinate activities was filled with ideas from people who heard about Cicada only from the news and had no idea what was going on. Drowning in a huge number of ideas and questions, the real solvers spent almost the whole day deciphering, although this should have taken no more than a couple of hours. After all, the decryption of this text turned out to be a very simple rearrangement process, including columns. As a result, we received this message:
GOOD WORK
ULTIMATE TRUTH IS THE ULTIMATE ILLUSION
JOIN US AT FV7LYUCMEOZZD5J4ONIO

It is assumed that the last n of onion was specifically omitted.

Soon, a huge number of people gathered on the specified site and there began various oddities. The site greeted all visitors with a blank page. Many tried to look for any hidden information on the site. One even managed to find the server status page, which, it seems to us, we should not have found. On this page, the IP addresses of all visitors were recorded. Almost immediately afterwards, the contents of the main page changed. Every few minutes, 2 characters reappeared, just like a few days ago. Even after a day, this did not stop, and we again sit and wait. Some try to look for missing details in previous assignments, but for the most part we do nothing.

(Friday Friday January 10th)

PS Please forgive me for the brevity of this text, this is only a third of the entire 2014 investigation. And gentlemen, tell me please, would you like to continue this cycle as just a story, or in more detail, with all the slightest nuances of this investigation?

Thanks.