Council of 9

If you are still working on the Badge challenge, be warned! Spoilers below!

If you’d like to play along, you can grab all of the required materials for free at:

https://media.defcon.org/DEF%20CON%2028/DEF%20CON%20Safe%20Mode%20Badge.rar

Exposition:

Before getting into the badge challenge write-up, we would first like to take a moment to thank all those who helped make this possible. First and foremost, a big shout out to 1o57 for putting together these amazing puzzles every year, and the sacrifices required to make it happen. Also a big thanks to the DEFCON organizers as a whole, who allow people like us to engage in these puzzle-solving shenanigans, and giving 1o57 a place to create and foster the hacker mindset.

Finally, a big thank you and congratulations goes out to Co9’s newest members, and four complete DEFCON newbies (congrats on your first con!):

• Cr0wn_Gh0ul (@Cr0wn_Gh0ul) 
• JTobCat (@jtobcat) 
• LeFevre (@Lefevre) 
• motive (@leemsparks)

With that, let’s get into it.

The DEFCON 28 Badge 

The Council of 9, undaunted by the irregular startup routine of DEFCON Safe Mode, prepared to scuffle and rumpus against the bewildering puzzles of 1o57 once again. After purchasing our DC28 badges, the fun began.

As 1o57 puzzles go, you never have an official starting place. You have to find it. So as we found answers or interesting information, we would record it for possible future use, and move on to the next thing we could find. Eventually, the breadcrumbs resolve into a path to follow.

This years badge consisted of three physical items:

• A traditional printed cassette tape insert booklet
• An old school audio cassette tape
• The Lanyard

Booklet 

The cassette tape insert booklet had several codes printed across it.

First, looking at the track listing:

Taking the first letter of each song on the side A tracklist spells out “LOSTINTIME”. For the uninitiated, 1o57 is the longtime Defcon badge designer and puzzlemaster. These track names also contain hints for later - Keywords like Lissajous.

Color Block Sub Cipher

Written, the color boxes read

• Orange White Pink
• Purple White/Green Orange/Green
• Blue/Green Green Pink White
• Purple/Green White/Green Orange White 

and

• Orange Blue Yellow/Yellow Green/White Purple
• Green/White Green/White Yellow

By substituting the letters directly below for colors the first image, decodes to DEF CON SAFE MODE. It’s basically a key.

So the second is

Skull Text

This string of text wasn’t nearly as simple to decipher. This skull artwork was a throwback to DC21, which had us scurrying to find notes and write-ups on the Badge puzzles from that year. Ultimately, however, we found the solution by taking the text string and pasting it into a 6x6 route transposition cipher, yielding:

tIstFCOnRFoofFioumYrgureoohrDOuntlon

Which is read Come on four dot four is right in front of you

We didn’t yet know what to do with this, so we put it aside for later.

Cipher Text Page

Xbaw maek wzme pgty zvxy izwk iwhk lnhy

agrl rrlp fsis xadh uflx dsqh rzrg qegu

itwb wveq aslo moii xmzx mvea rtil yekd

lvks jrbo arvy nmjz wodi gcxe tkrr cyir

xbsu rwyf slwr ixyk lrwz sbzr zbpg rrrw

hjsi alXX 1o57

The solution to this text really came from the fact that we were paying attention to 1o57 dropping random hints in various locations - not from anything in the booklet itself. 1o57 had played a video on his Twitch channel from The Adventures of Buckaroo Banzai Across the Eighth Dimension. Most notably, Buckaroo is famous for using the phrase: “No matter where you go there you are”

Using this as an OTP key…

nomatterwhereyougothereyouarenomatterwhereyougothereyouarenomatterwhereyougothereyouarenomatterwhereyougothereyouarenomatterwhereyougothereyouarenomatterwhereyougothere

…you get another Buckaroo quote (actually written by Greek philosopher Odysseas Elytis) :

Know that as in life there is much that many have looked up on but few have seen because as my father told me and his father told him you will come to learn a great deal if you study the insignificant in depth

Cassette Tape

With the booklet sorted, we turned our attention to the DC28 cassette tape. Upon listening to the tape, there are some immediate … features… that stick out.

Tones

One of the first things anyone listening to the tape will notice is the odd tones that sound at different times, and seem to repeat. These were halves of a DTMF (Dual-tone Multi-Frequency) tone, known better by many as “touchtones”, and appeared in two (2) groups of fourteen (14) tones that repeated three (3) times. By combining these single frequency pairs back together, we restored the dual frequencies and, by examining the peak frequency of the tones, we were able to identify the keypresses that generated the given tones. The flow of tones came out as:

DTMF Numbers: 2 6 3 3 9 6 7 3 7 9 9 9 4 9

We’re not done yet, though! Not yielding any immediate plaintext, we continued checking for a second-stage decipherment. As we’ve learned from other puzzles, any phone-related cipher should be checked for T9 coding, which turned out to be exactly what we have here.

By looking at a phone keypad,

Reading those indices onto the available letters, we get: CODEWORDSYZYGY

Oscilloscope

 It’s not just the obvious side of the audio that we need to examine - the audio on the cassettes had much more than meets the … ears. Based on some hints that 1o57 dropped, and our experience with past puzzles, we decided to examine the audio for any hidden waveforms or other hidden data. Using a software oscilloscope, we examined the tape audio and discovered plenty of hidden text, as well as Lissajous patterns (remember that word from the Tracklist? Ya, that was the hint to get us here). The patterns we saw included a spaceship, a heptagon, a butterfly, and some very interesting text. The text we needed was:

The full text that shows up in the oscilloscope reads:

FIND A KEY AT LOSTBOY.NET SLASH PALEBLUEDOT

These two lead us to http://lostboy.net/PaleBlueDot

When we found this, though, the site was not yet active (since DEFCON hadn’t officially started). Oh well, better solve the Lanyard while we wait.

The Lanyard 

This year’s lanyard proved to be quite tricky. We went through several iterations of attempts to make sense out of it. Pictured below is the lanyard with our attempts at dividing up and delineating each shape.

1o57 offered quite a few hints about the symbols on the lanyard - and with good reason. Finding the appropriate reading for the text was pretty difficult. Here are some of the most important hints that came out:

• …now excuse me while I go read more about French aristocrats fleeing a post 1789 revolution. 
• More hints will start flowing from the font of knowledge tomorrow after DEFCON officially starts….

These sorts of hints eventually point towards the Crackly font, hosted on emigre.com (https://www.emigre.com/PDF/Crackly.pdf). Using this font, we were able to extract the following values from the lanyard segments:

Note first those mad MSPaint skills. Note second that all of those numbers are below 26, we immediately changed them into letters, giving us:

Q X U N

E K K E

V I O Q

Q G C O

Throwing this through a ROT, because you should always ROT everything, discovered that it was ROT-24’d. (Side note: Why ROT-24? Because ROT-24 is a negative ROT-28. Tricksy)

O V S L

C I I C

T G M O

O E A M

While not immediately obvious, one observant council member noted the presence of the C-O-M series of letters when reading in the vertical 4x4 pattern. Reading it in this way gave us what we were after:

OCTOVIGESIMALCOM → http://octovigesimal.com

Octovigesimal.com 

This new page contained quite a bit of new content that we needed to sort through, and any answers were certainly not obvious.

Image filename: besidenequals2.jpg

The summation equation written at the bottom of the Goonies skull key implied that we need something that follows the pattern 1.1 + 2.2 + 3.3 + 4.4. The banner of the website implies that we need to look at the album “The Great 28” by Chuck Berry. This is further hinted at by the text “Record your answer~”, as in a record. We even think the tilde, from the latin for ‘title’ was probably part of the hint.

Upon looking at the Track list of “The Great 28” we saw that there is a track called Come On, which is right before a track called “Nadine (Is it You)”. This seems to link back to the text that we extract from the cipher text on the cassette tape insert “Come On Four Dot Four is right in front of you” Come On happens to be Section 4 track 4 of the album (4.4) and is “right in front of” (before) “Is it You”.

Going with that train of thought, and concatenating the titles of tracks 1.1, 2.2, 3.3, and 4.4:

Chuck Berry - The Great 28:

we get: MaybelleneRockandRollMusicMemphisComeOn

However, we don’t know what to do with this yet. Note it and move on.

Last on this site, but certainly not least, is another URL. Hidden right in plain sight underneath the logo is a pointer to the URL “Base-28.com”.

Alright, time to move on. 

base-28.com

The first thing to look at here is the ciphertext in the top center of the page. We have a few strings to play with from previous solves. With the earth, moon and sun being in a line on the page, we figured it was a good opportunity to try the key that we found previously (from the audio DTMF codes): SYZYGY. This ciphertext is Vigenere encoded with SYZYGY as the key, and decodes to Who are you going to call? Definitely sounds like Ghostbusters to us.

Also of note here, is that the image on the arcade cabinet was identified as being the Temple of Gozer - a Ghostbusters scene. This scene is actually Chapter 28 on the GhostBusters DVD, and is titled “Crossing Streams”. This reinforces the Ghostbusters clue that the vigenere text gives us, and will prove critical to the next step.

On either side of the website we see pictures of members of the band The Commodores. 64 of them, in fact. These two clues combined tell us that we need to look at the Ghostbusters Commodore 64 game. What specifically about it? We don’t know yet.

Visually, it looks like this…

Pale Blue Dot 

The Lissajous from the audio on the cassette tape pointed us to lostboy.net/PaleBlueDot. Upon accessing this page, we were greeted with… a wall of numbers. A giant freaking wall of numbers. Oh, and a joke.

How many Sagans does it take to change a lightbulb?

A quick google search will reveal the hilarious answer: “Billions and billions”

How it’s supposed to be solved

The numbers in the image are divided by the decimal, with a number of seemingly arbitrary length on the left, and eight (8) digits to the right of the decimal.

Left-Hand Numbers 

Noticing that the numbers, with appending a few leading 0s, can be paired into values all less than 26.

Separating them out, and converting them via Letter-Numbers

Then, Vigenere decode using the key “billionsandbillions” (from the Sagan riddle) to get the plaintext:

• ChineseTakeout
• CrunchBar 
• Eggs 
• Twinkie 
• Marshmallows 
• Popcorn 
• Pizza 
• PotatoChips 
• Gum 
• Cheezits 
• Beer 

These resulting words are the Game Franchise Username for the Ghostbusters c64 game, save bankroll amount.  This consists of the Username (left side decoded) + 8 digit account number (right side number), with the decimal separating the two.

Right-Hand Numbers 

The numbers on the right of the decimal, being 8 digits, are the account numbers for the Ghostbusters game. These can be plugged into the game (via an emulator) to discover the corresponding amount of money that is ‘saved’.

Emulator Franchise Username and account number screen:

Account Amount after validation of Username screen:

The Final Step 

Realizing that these account balances all have trailing ‘00’s, remove the 0’s and convert the remaining numbers into letters to reveal the next destination.

Numbers: 13 25 19 20 5 18 25 19 3 9 5 14 3 5 20 8 5 1 20 5 18

Letters: M Y S T E R Y S C I E N C E T H E A T E R

Also, noting that each segment in the graphic is separated by the text ‘PaleBlueDot’, place a dot between the words, to arrive at a web address.

https://mysteryscience.theater

How we actually solved it (the narrative of pain) 

One of our immediate observations was that the numbers always had eight digits on the right of the decimal. From the base-28.com site we knew about the c64 Ghostbusters game, and had the Crossing Streams chapter title as a potential hint that we needed to use clues across websites. In our reading about the c64 game, we learned that it was one of the first that allowed players to ‘save’ their game. Researching how this ‘save’ feature worked, we noted that it always used 8-digit account numbers, which curiously lined up with our 8-digit numbers to the right of the decimal. This felt like a crazy idea at the time, but we were frustrated enough to try it. Given the account numbers, we needed to find a way to reverse out the Names and Balances that would give those account numbers.

This video explains how the ‘save’ feature works: https://www.youtube.com/watch?v=_3cpbCCfK5A

Rather than digging into the algorithm, like we should have done, we discovered a Chrome extension that generated Ghostbusters accounts.

We tempted fate and downloaded the extension, only to rip out the code in order to reverse the algorithm. With that, we wrote the below brute forcer which, after inputting a Name, would try all possible account balances and then check if any of the resulting account numbers matched any of the account numbers from the image.

We immediately set out trying names that came from 1o57’s Twitch streams or other areas of the puzzle so far - and we found a few that worked:

• ‘REAGAN,RONALD’,
• 'POLLY,SKATING’
• 'SOTER,STEVEN’,
• 'MORANIS, RICK’,
• 'BROLIN,JOSH’,
• 'HOUSE,BRICK’

But note that we said ‘a few’. We couldn’t find hits for every account balance. Fortunately, these were enough to assure us that we weren’t crazy, and we began attempting to interpret our output. While working through this, we realized that we didn’t even need the names. Using the information from the aforementioned YouTube video, we learned how to derive the information we needed. Take the account number for 1o57 which is 27710104. Reverse the number by pairs to get 04017127. Then convert from octal to hex, you get 101E57. The middle byte, 1E, is the hash of the name. The account balance is the first and third byte, so 1057. We filled in the remaining few accounts to come up with a full dataset. As it turns out, the whole page could have been solved like this on a calculator.

Examining the resulting balances, and knowing that the game’s algorithm divided the balance by 100, we dropped the trailing ‘00’ and then converted the remaining numbers into letters, revealing the string mysterysciencetheater. After trying this on a few of the known sites with no luck, we discovered that this was pointing us to mysteryscience.theater The PaleBlueDot in the middle of the numbers was also a hint to look for a domain.

While we had discovered some new information, it was not a complete solution. We still hadn’t used the left-hand side numbers from the PBD image, so we now shifted our focus to those numbers. After realizing that the numbers seemed to be relatively low when split into their component digits, we tried Letter-Number conversion again. We then Vigenere’d that output with the riddle answer ‘billionsandbillions’, and came up with a list of delicious food from the Ghostbusters movie. As it turns out, these were the names we were supposed to use to get the balances via a Ghostbusters c64 emulator. oops.

The complete output was:

Mysteryscience.theater 

This page was kind of interesting in that there wasn’t really much to do with it… at least not immediately. From time to time, 1o57 will time-gate an area of his puzzles, and this is exactly what we ran into here. So, fast forwarding something like 24 hours, let’s begin examining the final puzzle-filled state of the page.

The top of the page now contained ciphertext. After a few attempts at deciphering it, we tried one of our old unused pieces of data (the concatenated list of Chuck Berry song titles) as a key and were greeted with a successful decipherment:

An y QewpFyyvRqd,

WehjhwpIclpVtme:

Ioqfig oloage.

Using OTP key: MaybelleneRockandRollMusicMemphisComeOn

On a PaleBlueDot,

WrestleWithThis:

Things change.

The meaning from this was clear! Head on over to http://lostboy.net/PaleBlueDot/WrestleWithThis

WrestleWithThis

Not much to see on this page, just the text “It’s only a tiny problem” and a YouTube video.

In the page source was the following comment:

<!- bFNhZ2FuQExv ->

And the title of the page was:

Wrestle With This y6nk3z9y

The comment Base64 decodes to lSagan@Lo

Additionally, the hint on the page about a ‘tiny’ problem, combined with the page title, resulted in a tinyurl link for our next destination:

tinyurl.com/y6nk3z9y → http://lostboy.net/PaleBlueDot/EverythingWasFineWithOurSystem.jpg

EverythingWasFineWithOurSystem

The image on this page immediately presents us with two sets of ciphertext, and a curious little man yelling at us from the corner.

As seen lightly overlaid into the blue of the car:

U2VuZCBDb3Nt =base64=> Send Cosm

And in the rear light:

TG9zdGJvWSBkb3Qgc2xhc2ggSEhI =base64=> LostboY dot slash HHH

Navigating to http://lostboy.net/HHH, we were greeted with two more youtube videos. The first one was titled “Close but no Cigar”. Immediately realizing that this meant we hadn’t interpreted the clue correctly, we Nope’d right the heck out of there. Luckily, we also knew what HHH was referencing from watching 1o57’s Twitch stream on 8/7. so we wasted no time in discovering the correct endpoint.

lostboy.net/HappyHarryHardOn 

Here we go, a YouTube video and some encoded text. This feels right. The video was of RayParker Jr. performing the GhostBusters theme song, and below it was the text “What a singer! LostboY.net/PaleBlueDot/?” Also on the page was the text “F1LZuQ9E4JQ”.

The F1… text was another YouTube video; Chuck Berry and Tina Turner performing Rock n Roll Music. In an interesting twist, we discovered that by sorting the video comments by Newest first, there was a comment from NEW SOUND AGENCY with the text “b3MgdG8gQ2Fy”.

Also, if we look at the NEW SOUND AGENCY channel on YouTube, it has just one video of 1o57 playing around with a MiniMoog. Yep, this is a clue. This text of the comment base64 decodes to “os to Car”….hmmm.. That seems to fit with the other ciphertext we’ve found so far.

As for the URL, the team immediately recalled that Ray Parker Jr. may have, probably, almost certainly, likely, stolen the Ghost Busters theme music from Huey Lewis and the News’ “I Want A New Drug”. The next URL, then, was pretty simple to guess:

http://lostboy.net/PaleBlueDot/HueyLewis/

HueyLewis (and the Solve) 

This page was pretty simple. A single ciphertext was present on the image and gave us the following:

c3Rib1kubmV0 =base64=> stboY.net

And finally, putting together all of the fragments that had been discovered:

U2VuZCBDb3Ntb3MgdG8gQ2FybFNhZ2FuQExvc3Rib1kubmV0

Base64 decodes to => Send Cosmos to CarlSagan@LostboY.net

We shot off an e-mail (several e-mails?) as directed, and got replies letting us know that Defcon 28 Badge Challenge: Complete … phew. The e-mail also linked to another video and requested that we watch it as a team.

We immediately shared a screen as a team and viewed the video together.

With that, DC28 badge challenge was complete.

@TheCouncilOf9

Co9.io

contact@co9.io