Stormseeker has a personal portfolio website at http://www.thestormseeker.com/, which has been connected to the ARG.
Originally, the site's front page, which had the title "Stormseekers Portfolio Site", only contained a screenshot image of what looked like a Source engine rendered scene with the text "Coming Soon..ish" below the image. The site was updated in May, 2015, some time after the Steam release of Black Mesa, adding Stormseeker's portfolio with screenshot galleries.
At the end of December, 2015, the site became unreachable, and as of January, 2016, the site is still unreachable. [1] [2] [3]
Konami Code
IRC clue 1 together with Code A led players to discover that the Konami Code could be performed on Stormseeker's website. This, in turn, led to the discovery of the terminal.blackmesasource.com website.
ba.js
var code = [], lulz = "38,38,40,40,37,39,37,39,66,65";
$(document).keydown(function(e) {
code.push( e.keyCode );
if ( code.toString().indexOf( lulz ) >= 0 ){
$(document).unbind('keydown',arguments.callee);
window.open('http://terminal.blackmesasource.com')
window.focus();
}
});
This is the Javascript source code that watches for the Konami Code input. The decimal values for "lulz" are Javascript event keycodes. If these decimal values are interpreted as ASCII the result is:
&&((%'%'BA
Note: This script currently fails to run on Stormseeker's site with the error "$ is not defined". This is due to the fact that ba.js is run before jQuery, a Javascript library that provides the global $ function, has been queued for loading.
Hidden password-protected area: /thepizzaisalie
The website has a hidden, password-protected area at the following URL:
http://www.thestormseeker.com/thepizzaisalie/
Username: drhorn
Password: 1001085139140914
The password is the combination of Codes A-D.
The message from the server (the HTTP authentication realm attribute), shown in the password prompt, is: "The Pizza is a LIE!"
When accessing the URL above, and entering the credentials, a directory index is shown.
The directory originally contained the two files listed in the table below:
| Filename | Last Modified Time Stamp |
|---|---|
1001085139140914.html
|
Sat, 03 Nov 2012 14:50:46 GMT |
grilledpizza.jpg
|
Tue, 18 Sep 2012 14:21:53 GMT |
A third file appeared after IRC clue 6 (or at the same time):
| Filename | Last Modified Time Stamp |
|---|---|
HALOS.txt
|
Wed, 07 Nov 2012 03:59:11 GMT |
More information on these files follows below.
1001085139140914.html
This page shows the image of the "grilled pizza". It also contains some hidden text (black text on black background) that can revealed by highlighting.
This is the text as it appears in the HTML source code:
They stole the lie, as if that matters to me, HALOS is far too complete to stop now. They can't hide there, not now, not now I have this, this holds the key to all things... they CAN'T hide from me. I will follow them, I'll set up a link and this to remind me. Perhaps I should hide it on the secure site, perhaps that would be best. I'll find them though and they will pay, they will definitely pay. Dr Marcel was right when he said, "When you're building a cage for Satan, you don't ask him to wait around whilst you put the doors on." Welsh is probably behind this, but he won't get away with it.
grilledpizza.jpg
grilledpizza.jpg
The image contains a hidden message encoded in binary where a white triangle represents "0" and a black triangle represents "1". Reading from left to right, top to bottom, yields the following binary sequence:
00000010 00100000 00100010 01110100 01100110 01100101 01111000 01101001 01110010 01101011 01101100 01100011 01110010 01101011 01111010 01100110 01100101 01101010 01110000 01100110 01101100 01101110 01100110 01100101 01101011 01111001 01110110 01000111 01011010 01010001 01010001 01010010 00100010 00100000 00010111 00000011
In hex this is:
02 20 22 74 66 65 78 69 72 6b 6c 63 72 6b 7a 66 65 6a 70 66 6c 6e 66 65 6b 79 76 47 5a 51 51 52 22 20 17 03
When interpreted as ASCII code, the following is revealed:
␂ "tfexirklcrkzfejpflnfekyvGZQQR" ␗␃
The first and the last two characters in the message—represented here by STX, ETB and ETX—are ASCII control codes which stand for "Start of Text", "End of Transmission Block" and "End of Text", respectively.
The quoted string of letters found in the message
tfexirklcrkzfejpflnfekyvGZQQR
is a message encoded with a simple shift cipher. Substituting each letter with the corresponding letter in an alphabet shifted (rotated) by 9 reveals:
congratulationsyouwonthePIZZA
Hashes of grilledpizza.jpg
If the pizza is a lie, then the above message is congratulating you for winning the lie, i.e. nothing. Perhaps it is just a red herring, and the actual "key to all things" is the JPG itself. For example, 384 bits from SHA-384 provides 256 bits for a key, and 128 bits for an IV when using AES-256.
| Digest | bits | Result |
|---|---|---|
| MD5 | 128 | 47dba39227afdcd69963a77fd06da7f5 |
| SHA-1 | 160 | bf112cd90db119e276f6f07a8a7a5b7bb06f0fc7 |
| Tiger | 192 | 54a25ac619b9d69944ac3d994bf821ce8387f4aedeccaa9b |
| SHA-224 | 224 | 02180d675a44f14edf2fc87c2d26e81cb1450442651b149f8b31d552 |
| SHA-256 | 256 | 1f9715bbb3a46698b038b8cb210630518cc0ac0e9d9845bf9583868c53b515d5 |
| SHA-384 | 384 | 50ca9a3e5399efd49ba1125e19e308dea1f6c9da8ab58a31407c98fffd73920eff911b6afda59f9dcf674583f1e67220 |
| SHA-512 | 512 | 119bcaab817532a89466fb403420c08c013050fb9db67be1748629f5ec13d683ded060588e58ad6b60b182a81a4933615c07bee009e76aac77be4e8978955227 |
| Whirlpool | 512 | a35aebe6aad00ae058ff6e2a5351464801305178e95d7a8bac2292a4382a5ef611c1fbfa2d4f7105f82dac77a755e763c8699a30cf336c4043d7682a77dc1d55 |
HALOS.txt
This file was added after IRC clue 6.
<~$<p_2Ec62JBQ%s65V4rP/NGC;1,CL<1c6mrF)5Ju/n8g:0/$gODf]K#/oYiLG^1oM@q0(hF Ceu900`63;CjUT1b:je<)Pb]8PVWK9hA)M+B26):/akY;c?7`:*;nt5uU]R7S-$:+B)'9;F<l Y;cQ.V771#s5u'^>=]7mj+>"^878?-98P`>b/g+(a<(.p*7Rg'C:.6cf/hSb/+:9_R/pgE8Bl .:!Gp$$sEcu#7F!+8%ATDU*@:Wq[I4d-)+B;?/;BS7m<(U+V<(Tk\+AtX*<Cp(W6nU)E+Ab@& ;aX>K73G/s:fUI;7Sco);b9qW+@/@o8QJ,V8P`)(;FOG_8Q%uF/hSa`;ajY.7Sco)7S-?@9H[ ;';cFl95u^fP;GJhs/hRJs:-hQV;b9n16VgEQ9LVoL5!D.Q>=2(M;c?7W8OZ#i8PV`N;GBGV8 P`)(9LVuN9HZ<#>>J3r0/#.70O5#p1GWDn0Jd,n2.C!)A2Z>'2`G5%1h/6sAn*hU3A<?J1Gh" #0f(Om2e+^%@U_;PAnGU.1M&6q1,^jE2`EZN1cIEM1LsuN0kN=!@q7DN3&5&*0k3"K1,_(#2) I1!@UihXA79((1,^jE0ed,pAS#:)AN2VYA2?#O2e+d*0f(O?0KEWQ1bq$EAR[JO1c&Ys0f:e" 0JkUu3FcYZ1-%7'3FZT42`!HQAMc2'0KD*OAn<kV1,(Lp@5)5'1b^[D3+=[P2)Jo&A7T1.3B& g-@5'NM2`*NS1c],%@5]ku3Ak5*Ai;G!@PB`$2*!BIA7[GL2)Af"@:<Y%3&kD)2.g;XA2lG#@ qK:40f([D0k<1P0K:jK3+apU3&i]M11<-tAn5L-0JYUBA2Z2T@q9(+An<o41cAcR3A=r#0k3( N3&!7"1bg^C1hAI!@:D5P@lZG,2DSht2E5/"@kflO0KD-R0Od!t3&+hq0P"TN3AEC#2E,5Z1g r-nAi2S/@PDCK@Q%aR3&*EJ1Li@Q3AiTP@qB401H@0H1hJR!2)[0u@6$)S1hL;X2)/VrAMQ(t @q7PYAi2;R2E<WP0f_3Q2_d*H@5h[N2.9p&A2dsS0JG=?3AN?D0f1U@0OZsrAhc4uAi;PW@q% 6(0f(gH2D\c#AN;G)@5BiN@5p/$An!MS3&!4%@lZJ(0k2mt@lRsW3A<?MAN)V01GE5o0K(dF2 I\Eu@l[sU1-&f!2IeLPAMR[N@V%AUAi2P.@5Bi"An>F11GNKO1gsiK1,WPr0fV!L@qI\\AMQ8 #An!MS0f(UG2_\_q2D[6G3&EQN@5p8&3&!'uA7RSXAi2D'3B1M+AMmpS0K(jH2J+j+2Dno$Ai F<V1,:^tARRE+@50Jn0P4m*2DA`$2)$sG2)7!C@l?>'2E<WS3&>)T@PTZL2J-E1AS,C\3&P," 3B8fS1cR0F2ISHu@Pq['>;'8d7;cWY<,uDbF)>W4F(oQ1?$sMj><tSO;H-4g74qjgIXWDD<,u DbF)>W4F(oQ1+@U0YF'W&~>
User Matherunner noticed the "<~" start and "~>" end, as well as lack of ASCII characters 118 to 126 (v w y z { | } ~). He concluded that this is a simple ASCII85 encode.
ASCII85 decode
[[Proxyhost@-84-9-123-345.dslgb.com//closed.proxy.accepted//?OTR,3,4,?OTR:[INCOMING TRANSMISSION CLASSIFIED SOURCE]SUBJECT ANALYSIS - TENACIOUS. SITE OFFLINE......
...{Primary Servers Overloaded}... USER ACTIVATION REQUIRED... PASSCODE INPUT FOR SITE ACTIVATION REQUIRED...
SET FOR FINAL TEST PATTERN....
ANALYSIS COMPLETE>>> [CLASSIFIED INFORMATION LEVEL 8][OTR//4.0]
b32b003a35badd66577c24c14fc919064346d131a7c54bb82ffe03e022615777247923dc21f62cd4182e91c3b267b545abcaedaf0261510d4eea1e87cd33c7c77131309cc4280eb4243d1154f044f9cf6296d9bff7397e4390987fe63203da0de40278b3a54f5ddc6975fa04f749849e1a62595a9f630b0795913de0153e3aac388c45fb9d850cfe913541d6c08398f2c88332a82fdf00281d62fcdc4fe7e46ae90c51c5c806b41164e33ab92c96862e068b0c16c09990b8381a00da7915b67fe4a20f599b0f1b6d481913c7b9538cee639144f41561ba92e4fe751d1e242cd88f51d695519887136a7c15aabd7b40044922014130a91f170f66ccb3c139463a7e909a37aa863fb27805fc9731c09c8c79067e79930a406546b24c9a629b26c2ce2a4be48f589a375feb731fc4ab225c11848cf89e291fb27133970c063618474a892801edd68f54698c5e5b506746f6765a6f7f1225dea4da1140feb60f650745241c693695883dcb21e6fbfefbb85a2991948036a52b5d
[/][End Transmission]|¬[ABORTIVE.] ~~ [Transmission Ends]]
See 752 Hex Code for more information.
A hint found in JavaScript files
On January 2, 2015, a message from Stormseeker containing a hint was discovered in each and every JavaScript file located in a directory index at http://www.thestormseeker.com/js/.
/*! *Oh hai there, someones bein a nosy bounder aren't they... *Looking for ARG related stuffs? *I have a hint for you *21 goes into 1 *Don't trust anyone, it's not safe. */
See the table below for a list of the JavaScript files in question.
| Filename | Last Modified Time Stamp |
|---|---|
pl.js
|
Mon, 25 Nov 2013 02:20:01 GMT |
plbp.js
|
Mon, 25 Nov 2013 02:23:18 GMT |
plqe.js
|
Mon, 25 Nov 2013 02:23:19 GMT |
plst.js
|
Mon, 25 Nov 2013 02:23:18 GMT |
plxm.js
|
Mon, 25 Nov 2013 02:23:19 GMT |
For more information, see 21 into 1.
A second password-protected area: /wibble
A second password-protected area on Stormseeker's site has been discovered at http://www.thestormseeker.com/wibble/. This, however, has been confirmed by Stormseeker as not related to the ARG.
For more information, see Wibble.