Cicada 3301: The web's toughest and most creepy crypto-puzzle is BACK

Just who is behind this baffling and arcane mega-code-riddle?


Poll The internet is full of daft things. Animated cat GIFs, stupid headlines, NSA spies, etc.

But the online world isn't just fields of mindless dreck. For instance, you could always take a crack at the web's toughest crypto-puzzle: the ever-baffling Cicada 3301.

Appearing each year since 2012, these strange series of challenges have stumped clever netizens the world over. By solving the riddles, it appears you eventually get in touch with the quizmasters, who are no doubt interested in people with your skills.

Now 2014's puzzle is underway after this image was linked to by this Twitter feed, which has been spewing raw data in tweets for the past few days. The picture shows this text: "Hello. Epiphany is upon you. Your pilgrimage has begun. Enlightenment awaits. Good luck. 3301."

If you fiddle with the image to enhance the shadows, it reveals a winged cicada insect that featured in last year's contest. But that's just a distraction. If you run the original JPEG through steganography analysis tool OutGuess, you get a quote from the essay Self-Reliance by Ralph Waldo Emerson – plus a sequence of numbers separated by colons and a cryptographic signature generated by the PGP key used in the past by the Cicada 3301 team.

Each line of those numbers hidden in the JPEG file refers to a paragraph, sentence, word and letter in that Emerson text, which is used to gradually build up a URL. So, for instance, 1:2:3:1 means take paragraph 1, sentence 2, word 3, letter 1, which is an 'a'.

The whole sequence constructs the URL auqgnxjtvdbll3pv.onion which refers to a web server running within the Tor network. That hands out another graphic that again uses steganography to hide a "good luck" message, RSA encrypted data and cipher variables that are needed to crack the encryption key to move on to the next part.

Crouching cipher, hidden lesson ... the cicada insect revealed in the original image

If you want to see how far down the rabbit hole this goes, a bunch of code-crackers are documenting their ongoing progress here. In fact, last year's puzzle is just as fascinating, involving finding bootable Linux CD images hidden online and locating and decoding posters on lamp posts dotted around the world.

It's not entirely clear if anyone successfully passed the 2013 test, but how it was unravelled reads like a plot from an extremely nerdy novel. An IT security expert called Joel Eriksson managed to defeat the 2012 challenge, but arrived at the final server too late – the Cicada 3301 team had already found their winners. It's believed those who arrive first are asked for their contact details, possibly revealing the whole thing is a job interview from hell.

You'll notice that knowledge of cryptography, steganography, programming, computer networks, obscure literature and runes, and mathematics is essential in order to get anywhere at all.

No one knows who is behind the spooky tests, or if they do, they're not telling. Apparently, it first surfaced on a grim 4chan.org discussion board about the paranormal, with the message: "We are looking for highly intelligent individuals."

Perhaps, then, it's just a 4chan prank, but Kenny Paterson, a crypto-professor at Royal Holloway, University of London, believes it's too well organised to be a practical joke.

"There's been several such competitions in the past. Google used to post puzzles on billboards beside the highways in Silicon Valley to attract people to come and work for them. A few years ago, our own GCHQ had a set of puzzles for people to solve as a way to recruit people with bright minds," he told BBC Radio 4.

"It's unlikely to be a spoof due to the lengths [Cicada 3301] have gone to. They are really sophisticated; they have all kinds of amazing, esoteric references in there to the work of [occultist] Aleister Crowley, for example, paintings by William Blake, and Maya numerals. It takes a long, long time to set up puzzles like this. It's not something you can do in your spare time."

So, what better way to decide what on Earth this thing is, than to put it to our Reg readers. Vote away in the poll below or pop a comment in the forums with other bright ideas, if you so wish. Or better yet, solve the mystery and tell us (PGP) what you found. ®

JavaScript Disabled

Please Enable JavaScript to use this feature.


Other stories you might like

  • Experts: AI should be recognized as inventors in patent law
    Plus: Police release deepfake of murdered teen in cold case, and more

    In-brief Governments around the world should pass intellectual property laws that grant rights to AI systems, two academics at the University of New South Wales in Australia argued.

    Alexandra George, and Toby Walsh, professors of law and AI, respectively, believe failing to recognize machines as inventors could have long-lasting impacts on economies and societies. 

    "If courts and governments decide that AI-made inventions cannot be patented, the implications could be huge," they wrote in a comment article published in Nature. "Funders and businesses would be less incentivized to pursue useful research using AI inventors when a return on their investment could be limited. Society could miss out on the development of worthwhile and life-saving inventions."

    Continue reading
  • Declassified and released: More secret files on US govt's emergency doomsday powers
    Nuke incoming? Quick break out the plans for rationing, censorship, property seizures, and more

    More papers describing the orders and messages the US President can issue in the event of apocalyptic crises, such as a devastating nuclear attack, have been declassified and released for all to see.

    These government files are part of a larger collection of records that discuss the nature, reach, and use of secret Presidential Emergency Action Documents: these are executive orders, announcements, and statements to Congress that are all ready to sign and send out as soon as a doomsday scenario occurs. PEADs are supposed to give America's commander-in-chief immediate extraordinary powers to overcome extraordinary events.

    PEADs have never been declassified or revealed before. They remain hush-hush, and their exact details are not publicly known.

    Continue reading
  • Stolen university credentials up for sale by Russian crooks, FBI warns
    Forget dark-web souks, thousands of these are already being traded on public bazaars

    Russian crooks are selling network credentials and virtual private network access for a "multitude" of US universities and colleges on criminal marketplaces, according to the FBI.

    According to a warning issued on Thursday, these stolen credentials sell for thousands of dollars on both dark web and public internet forums, and could lead to subsequent cyberattacks against individual employees or the schools themselves.

    "The exposure of usernames and passwords can lead to brute force credential stuffing computer network attacks, whereby attackers attempt logins across various internet sites or exploit them for subsequent cyber attacks as criminal actors take advantage of users recycling the same credentials across multiple accounts, internet sites, and services," the Feds' alert [PDF] said.

    Continue reading

Biting the hand that feeds IT © 1998–2022