November 5th, 2012[]
Another IRC clue quickly solved using base64 by user faed.
Code:
[19:38] * Watcher_ (webchat@host-84-9-123-29.dslgb.com) has joined #BMS-ARG [19:39] <Watcher_> W1tQcm94eWhvc3RALTg0LTktMTIzLTE1NS5kc2xnYi5jb20vL2Nsb3NlZC5wcm94eS5hY2NlcHRlZC8vP09UUiwxLDMsP09UUjpbSU5DT01JTkcgVFJBTlNNSVNTSU9OIFVOS05PV04gU09VUkNFXUxFQUsgU09VUkNFIERFVEV [19:39] <Watcher_> DVEVELiBUUklBTkdVTEFUSU5HLi4uTUlYIENBU0NBREUKSE9QIERFVEVDVEVELi4uQVRURU1QVElORyBUSU1JTkcgQVRUQUNLLi4uW1RFUk1JTkFURURdIENBTk5PVCBDT05ORUNUIFRPIEhPU1QuLi5BVFRFTVBUSU5HIENPTk [19:39] <Watcher_> 5FQ1QgVE8gVVNFUiBILi4uIFNFTkRJTkcgREFUQS4gU0VDVVJJVFkgTEVWRUwgNyBBTFBIQS5bT1RSLy8zLjBdClFrRlJTMWdnU2s5QlNrY2dXRUZJUlVRZ1NVWkhTVm9nUmxwRVVFSWdWVk5ZVEVjZ1IxaElSa0VnVlVGVlYwM [19:39] <Watcher_> GdTRUpSUVUwZ1YwRllWbGtnVEZGUlVsa2dWMUpWVjFZZ1JWUlJUMHNnUWtGRFFrVWdTbGRJVFZNZ1NGWlBUbG9nU1VGSVVFRWdVMDlYUTAwZ1RFZEJWRmdnVlVWWVQxRWdSRkoKUlJVb2dRbFpNUWs4Z1JFcEpTRVVnUTFwVVNF [19:40] <Watcher_> MGdXa3RJU1VVZ1RrOU5URk1nUVZoV1ZsY0tSVlJYU1ZNZ1JWUkpSMDBnVWxoRlZrWWdVVmxCVlVJZ1ZrWkRSVUlnVUZkQ1ZVc2dSVTFPVDB3Z1Z3PT1bL11bRW5kIFRyYW5zbWlzc2lvbl18rFtUZXJtaW5hbC5dIH5+IFtUcmF uc21pc3Npb24gRW5kc11d [19:40] * Watcher_ (webchat@host-84-9-123-29.dslgb.com) Quit (Quit: Page closed)
Base64 decode:
[[Proxyhost@-84-9-123-155.dslgb.com//closed.proxy.accepted//?OTR,1,3,?OTR:[INCOMING TRANSMISSION UNKNOWN SOURCE]LEAK SOURCE DETECTED. TRIANGULATING...MIX CASCADE HOP DETECTED...ATTEMPTING TIMING ATTACK...[TERMINATED] CANNOT CONNECT TO HOST...ATTEMPTING CONNECT TO USER H... SENDING DATA. SECURITY LEVEL 7 ALPHA.[OTR//3.0] QkFRS1ggSk9BSkcgWEFIRUQgSUZHSVogRlpEUEIgVVNYTEcgR1hIRkEgVUFVV00gSEJRQU0gV0FYVlkgTFFRUlkgV1JVV1YgRVRRT0sgQkFDQkUgSldITVMgSFZPTlogSUFIUEEgU09XQ00gTEdBVFggVUVYT1EgRFJ RRUogQlZMQk8gREpJSEUgQ1pUSE0gWktISUUgTk9NTFMgQVhWVlcKRVRXSVMgRVRJR00gUlhFVkYgUVlBVUIgVkZDRUIgUFdCVUsgRU1OT0wgVw==[/][End Transmission]|¬[Terminal.] ~~ [Transmission Ends]]
The inner code is another base64, which decodes to:
BAQKX JOAJG XAHED IFGIZ FZDPB USXLG GXHFA UAUWM HBQAM WAXVY LQQRY WRUWV ETQOK BACBE JWHMS HVONZ IAHPA SOWCM LGATX UEXOQ DRQEJ BVLBO DJIHE CZTHM ZKHIE NOMLS AXVVW ETWIS ETIGM RXEVF QYAUB VFCEB PWBUK EMNOL W
User deFRAGer posted a histogram analysis, which has a tell-tale distribution of a poly alphabetic cipher. Within the IRC, the players quickly concluded that the cipher key is unlikely to be a repeating one, and agreement was reached that it's likely a running key cipher using common text.
Obvious keywords are tried as a form of dictionary attack. Eventually, user akrasuski1 brute-forced the following key/text strings:
AMAJ ORITY OFTHE PIZZA S YOUS HOULD BRING PEOPL E
which matches the code ending of
YAUB VFCEB PWBUK EMNOL W
This led to the discovery of the whole key by user pointless, a disputed quote by Giordano Bruno:
- "It is proof of a base and low mind for one to wish to think with the masses or majority, merely because the majority is the majority. Truth does not change because it is, or is not, believed by a majority of the people."
The substitution tableau used by the running key cipher (tabula recta) only uses the 26 letters of the English alphabet. Therefore, spaces and punctuation have to be omitted when encrypting/decrypting the message.
The key with spaces and punctuation removed:
ITISPROOFOFABASEANDLOWMINDFORONETOWISHTOTHINKWITHTHEMASSESORMAJORITYMERELYBECAUSETHEMAJORITYISTHEMAJORITYTRUTHDOESNOTCHANGEBECAUSEITISORISNOTBELIEVEDBYAMAJORITYOFTHEPEOPLE
The decoded message is:
THISISAMESSAGELEFTFORDRHORNJUSTTOREMINDYOUINCASEOFEMERGENCIESTHATTHEPASSWORDTOTHEHALOSFILESISBENALOHPAILLIERIHAVEPROGRAMMEDHALOSTOSENDINLEVELSEVENCASESYOUSHOULDBRINGPIZZAS
SOLUTION[]
- "This is a message left for Dr. Horn. Just to remind you in case of emergencies that the password to the HALOS files is BENALOHPAILLIER. I have programmed HALOS to send in level seven cases. You should bring pizzas."