Friday, May 3, 2024
25
rated 0 times [  25] [ 0]  / answers: 1 / hits: 8734  / 1 Year ago, thu, december 1, 2022, 5:49:00

The new cool page created by Ubuntu-adverts team http://www.thisisthecountdown.com/ displays a nice counter, and an Ubuntu logo followed by a short motto. It seems, however, that it's not counting down to the Ubuntu 11.10 Oneiric Ocelot release. So what's the time zero, and what is expected to happen when the counter reaches zero?


More From » ubuntu-website

 Answers
6

It was created by the Ubuntu Adverts team to build up some hype in advance of the 11.10 release. The counter expires at midnight 11th October in the UTC-5 timezone (US Central time). This is 6am on the 12th October in the UK. However, the release of 11.10 is expected on the 13th in the afternoon UK time.






This page seems to have been an entrance for an Alternative-Reality Game, that was played by seeking for information on a bunch of fake websites, deciphering messages, etc. The game was synced with the real time, and it progressed through many days. As of Oct 11, the game is still in progress, but considering the amount of information that has been already presented, it is unlikely that one might easily join the players and continue from that point. The game is played cooperatively with many other players, by discussing puzzles at an IRC channel - #awholenewworld (you can find logs at this answer's end)






There was a number of clues released and puzzles to solve between now and then. I think at time zero a new website, possibly with more information about Oneiric will be released, there might be a more intensive phase of the game at that point, or it might be the end of the game.



The first clue is the class of the tag which may be decoded by base64 decoding then hex to ascii to reveal "world space agency org" http://worldspaceagency.org which is a website that was labeled as under construction.



The background image at worldspaceagency.org was also an MP3 file (stereo, 22.5 Khz)



Many clues have been released through a twitter account.
http://twitter.com/#!/thisisthe




  • One may pass the class, yet not see what is in plain sight ahead.

  • If the world could sing, then man can tell his deepest secret.

  • A world by any other name will still play.

  • 0x575341 UNIDENTIFIED TRANSMISSION INTERFERENCE

  • Meine freunde, sometimes one has all the pieces but doesn't know it.

  • Sometimes you have to do things twice.



As of 10/5, the GIF at worldspaceagency.org has changed.
There is now text near the bottom that says



CynOnoceiomemdRhlnnpctiDisssunr1tooaLdoatsRgurrdsedeemaiiifiseornp&Ournlo:cotsOta:tetentr:amengYncuv



There is also a pastebin of the appended data. There is pure HEX data here There is also a permutation before the codetext: 241563 Here is the wikipedia for transposition ciphers. There is some stuff about a German cipher called übchi. pinwake has used some German before. A clue, perhaps?



After deciphering using this tool with the key 2 4 1 5 6 3:
codenameCORDOROY:instructions:donotattemptanythinguntilserversarecompromised&signalsourcefound



On 10/6 the worldspaceagency.org page changed completely and now features a simple menu, WSA logo and some news. One can access a fake console at http://worldspaceagency.org/console/ which displays some chirped messages, and play morse code message (which after deciphering is ariss/ibm/a22p).



The Morse code used to decoded to contact/ibm/a22p. The earlier version was just a red herring. The page http://worldspaceagency.org/contact/ibm/a22p is blank, with "Nice try" as the title.



ARISS is the amateur radio link to the ISS, it was running on an IBM A22P thinkpad left behind by Mark Shuttleworth in the ISS (yes, really) there is some kind of problem with it's power supply unit. http://www.rac.ca/ariss/faqariss2.htm (That might be the why the audio file was all scrambled.)



The hacker console displays what appears to be an IRC log with some random office chit chat and the message:




"Pine Lake seems to have received some more transmissions of some sort."




Possible clue: Pine Lake, GA on Wikipedia.



Full decryption of the console text is available here.



As of late 10/6 or early 10/7, http://thisisthecountdown.com has changed. The background is now different, and the bar above the countdown appears to move.



If you click the twitter link in the site, it auto-fills your tweet with the following: 0x575341 UNIDENTIFIED TRANSMISSION INTERFERENCE http://www.thisisthecountdown.com



Update 10/9:
Turns out the 404 page at http://worldspaceagency.org/ariss/ibm/a22p/ was a fake. Some text at the bottom was changed. The first characters of the text in question ended up being a phone number: '404-9 CONTAC', or '404-926-6822'. Another transmission was found upon phoning the number. Here is a digital recording.



The recording was used to decode the transmission in the console at the WSA website. The decoded transmission is here: http://paste.ubuntu.com/704729/
The transmission references Chi Sagittarii, a group of star systems, along with the Wow! Signal, which was emitted from said star systems and is considered evidence of potential extraterrestrial life.



The security link on the home page requests a username and password. The credentials are below:




  • username: The User

  • password: 43tgmbefortytwo



From that point, the game gained speed, and both the plot and the puzzles thickened, but the number of them makes it difficult to discuss them all in that answer.



Note: here's a big plot gap - please add some information on the following points




  • Case files

  • Counter changed (signal lost)

  • Background colors (HEX hint) → Traveller MP3.

  • Counter changed (reconnecting)

  • WSA background → QR code → video footage

  • EXTRACTED-CASEFILES-r1.7z (in source code rgb values were 097 108 105 101 110 114 105 102 116 102 114 111 110 = alienriftfron in ASCII an anagram for (finalfrontier) the file's password)



The counter changed once more and we found a barcode like thing below the numbers (transmission.gif). It turned out to be a sliced QR code where each red dot marks the cut point. After inverting and encoding the result, it brought us to another archive file (EXTRACTED-CASEFILES-r2.7z) via this link The file again contains updates to the three case files. The password for the protected ZIP file (eventhorizon) was found by analyzing the HTTP headers of thisisthecountdown.com. This followed after a hint given by the @ThisIsThe Twitter account, which obviously is back under pinwake's control:




taking this thing back! Nobody knows rfc 2616 like me --it's me, djohnson!




Where RFC 2616 deals with HTTP standards. The headers contain the following:




7zip: Beyond a certain point there is no return.




→ point of no return → event horizon.



In the meantime the counter was updated (the estimated time for decryption has been recalculated) and now shows only a few hours left until the decryption of the transmission will be finished (which likely will be the end of the game).






Final Result - It turned out that the countdown was indeed for Ubuntu 11.10 .






IRC logs from #awholenewworld on freenode are avaliable below, most recent at top.




[#43212] Friday, December 2, 2022, 1 Year  [reply] [flag answer]
Only authorized users can answer the question. Please sign in first, or register a free account.
cisccla

Total Points: 66
Total Questions: 134
Total Answers: 115

Location: Croatia
Member since Fri, Sep 11, 2020
4 Years ago
;