Cicada 3301: The hunt continues in 2014

The first part .

Despite fears that publicity in the media would prevent this, Cicada began a new recruitment on January 6, 2014.

The high popularity of this quest meant the appearance of a huge number of fake pictures from people posing as “Cicadas”, which actually happened. From the first days of January, 4chan began to fill with "black pictures with white text" posing as new tasks. However, on January 5, a day after the usual publication of the first assignment, when everyone had already begun to disperse, and the last hope was lost ...

After almost a year of inactivity, from the Twitter account on which the tasks of previous years were posted, posted a picture with the following text: “Hello. Epiphany is upon you. Your pilgrimage has begun. Enlightenment awaits. Good luck. 3301. ", which can be translated as" Hello. Behold the Epiphany. Your pilgrimage has begun. Enlightenment awaits. Good luck. 3301. "
')


In the picture, as usual, the path to the next task was hidden, but this time it was not there. Having played a little with Photoshop I managed to get the following image:



It turns out that the black color was not black at all, but very dark gray, although at least I had already done something. The really important message was to get a little more difficult: it was necessary to skip the picture through the well-known OutGuess, which with the help of steganography hides different text in different files. Here is what he showed us:

As can be seen from the text, there is an encrypted .onion site, whose address was hidden in the book of Ralph Waldo Emerson, to extract the letters, it was necessary to use the following code: x: x: x: x = (paragraph: sentence: book: letter) After a long Searches were able to find this address: auqgnxjtvdbll3pv.onion, clicking on which you got to the page with a collage of modified paintings of William Blake. (Try to find the cicada symbol in the image)



Again using OutGuess, a 130-digit number and an encrypted message were found, to decrypt which, it was necessary to factor the semisimple number and recover the RSA key from the resulting numbers. Despite the simplicity of this process, factorization took a lot of time, all the work was distributed among the volunteers' computers (about 30 people) and took 8 hours. Let's be honest, it was quite fast compared to 1994, when a 129-digit semi-simple number factored 600 people for eight months.

After decrypting the message, we received a new Tor address: cu343l33nqaekrnw.onion . This time the site had an ever-growing list of characters, in which 2 new ones were added every few minutes. We sat and waited. We waited like this for 23 hours. Many guys went to search the previous messages, in the hope of finding the information that was lost earlier. Some tried to determine the sequence of the appearance of characters, and thereby predict what would be next. Until finally everything stopped, at this point the number of characters was 512. A few minutes later the site was a blank page, and a minute later a line appeared containing more than 360,000 characters. Ultimately, it was transformed into 3 separate images, each of which contained a hidden message and 2 lines of mixed letters and numbers:
IDGTK UMLOO ARWOE RTHIS UTETL HUTIA TSLLO
UIMNI TELNJ 7TFYV OIUAU SNOCO 5JI4M EODZZ

Suddenly, the main chat that we used to coordinate actions was filled with ideas from people who had heard about Cicada only from the news and had no idea what was going on at all. Drowning in a huge amount of ideas and questions, real solvers spent most of the day decoding, although it should have taken no more than a couple of hours. After all, the decoding of this text was a very simple process of rearrangement, including columns. As a result, we received this message:
GOOD WORK
ULTIMATE TRUTH IS THE ULTIMATE ILLUSION
JOIN US AT FV7LYUCMEOZZD5J4ONIO

It is assumed that the last n of onion was intentionally omitted.

Soon a huge number of people gathered at the indicated site and various oddities began there. All visitors to the site welcomed a blank page. Many tried to search the site for any hidden information. One even managed to find the server status page, which, as it seems to us, we should not have found. On this page, the IP addresses of all visitors were recorded. Almost immediately after this, the contents of the main page changed. Every few minutes 2 symbols appeared again, just like a few days ago. Even after a day it did not stop, and we again sit and wait. Some try to look for missing parts in previous tasks, but for the most part we do nothing.

(Condition on Friday, January 10th)

PS Please forgive me for the brevity of this text, this is only a third of the entire 2014 investigation. And, gentlemen, please tell me, would you like to continue this cycle as a simple story, or in more detail, with all the slightest nuances of this investigation?

Thank.