[bambusar]

we have new mwssage , agent number 16041, standars ITA2 encryption like we are used to

http://dialer.otp22.com/2012-12-07%2020-50%20UTC%20-%20202-999-3335%20-%2016041.wav

ALSO ALL CALLS HAVE NOW (since 7th. 12. 2012.)

"LOW BATTERY 11 point 4 Volts" on beginning


new message: NOTES/DROP EXPIRED AND NOT PRESENT. PLEASE TRIGGER EMRG 48xxxxxx IF NOT YOU/NOTES/DID NOT RECEIVE SIM ACTIVATION REQUEST. AGENT CODE ON GREEN PAPER/NOTES/REQ DROPS WILL BE PLANTED REGION 6/NOTES/DO NOT BE ALARMED OF TECH ISSUE WE ARE AWARE

[bambusar]

Arduino clone (Arduino is an open-source single-board microcontroller)
http://en.wikipedia.org/wiki/List_of_Arduino_compatibles
http://en.wikipedia.org/wiki/Arduino

Device

Electronic device with mini USB connector (see pictures).
Board has been identified: https://www.sparkfun.com/products/11098
Connecting the device to a computer results in text output: one button increments the counter, the other moves to the next digit. 6 digits are accepted. Possible digits are 0123456789ABCD* (DTMF).
Successful codes have a checksum === 4 (mod 10), where the checksum is computed by simply summing the digits (* = 4, A = 7, B = 8, C = 9, D = 10)

The device will then output one of 15 different messages, depending only on the first digit of the input code. These messages are composed of 2048 lines of 5 5-grams each (10240 5-grams or 51200 characters total). The 5-grams are from a set of 25 characters excluding Z (A-Y).

0: salt = 975, output
1: salt = 287, output
2: salt = 246, output
3: salt = 558, output
4: salt = 870, output
5: salt = 829, output
6: salt = 141, output
7: salt = 453, output
8: salt = 412, output
9: salt = 724, output
A: salt = 161, output
B: salt = 473, output
C: salt = 785, output
D: salt = 744, output
*: salt = 809, output

Unsuccessful codes output "Invalid Agent Code. Check for proper application of Salt.". The device needs to be disconnected to reset.
There is not enough memory on the device (32kb) to store all of these outputs- they must be being generated somehow.

MORE INFO:
http://otp22.referata.com/wiki/Bursage_Loop_drop

Example of how output looks (similar as otp.txt from 1st drop from Lake Qswego library LINK.)

THERE IS NO LETTER Z in them, so only 25 different characters

Code:

Select Agent Code: 00133A BEGIN NEW CODE TRANSMISSION BEGIN SEQUENCE QXAAY ALYJY ARNXB UFIAN YNYRJ HPDPI WUGKN LXNHN JHIQQ UHUGQ XAIJS LHWXP QSGKP PEHFR GIRIB GHKHK JFOHV DBBYO UNSHL MMHAE ANTRN VTNGG RXMSR AJUYR IDWLG VEWJE LGUOE GOHFR CDYRH VPNVX KCSSA RPQCG MOFJS YBRYV YMWHH KQGYE FLHLW NINPB CTVAB QPOFM QQLUG TUXJS MRDKG LTKHP UMJRL ...

http://pastebin.com/khwvKBPv
http://pastebin.com/raw.php?i=c4N1LZCa
http://pastebin.com/raw.php?i=khwvKBPv

https://dl.dropbox.com/u/28940500/vegas%20box.zip <---all of them

[bambusar]

We found two codes that works so far:

counterfeitsaint 974568 Fails
counterfeitsaint 4200 Fails
counterfeitsaint 1446 Fails
counterfeitsaint 229443 Works
counterfeitsaint 45146* Works
counterfeitsaint 016041, 16041* fails

this is what we got out of them

http://pastebin.com/khwvKBPv

http://pastebin.com/N2GGY9EQ

[bambusar]

PLUGGING IT IN

Code:

Sync   counterfeitsaint: open a text program and plug it in counterfeitsaint   ok that was weird counterfeitsaint   it does emulate a keyboard Sync   just as I said counterfeitsaint   it starts typing and deleting 0 over and over counterfeitsaint   the short answer is it wants agent codes nadando   and pushing the buttons? counterfeitsaint   it flashes zero, pressing button 1 counts up, button 2 moves to the next digit counterfeitsaint   eventually i got this: counterfeitsaint   Invalid Agent Code. Check for proper application of Salt. counterfeitsaint   green light went solid and it stopped responding counterfeitsaint   green light on the board counterfeitsaint   it requires 6 digits counterfeitsaint   yeah, button 1 counts up one, button 2 moves to next digit counterfeitsaint   its constantly deleting and refreshing the text, so you can see updates counterfeitsaint   but if you screw up the only way to start over is to unplug it counterfeitsaint   taking a pic of the red light, then i can try some codes counterfeitsaint   [url]http://prntscr.com/lcl4o[/url] joaogro   016041 im guessing this one counterfeitsaint   ok, trying that one counterfeitsaint   if you fail you get Sync   read the backlog counterfeitsaint   Invalid Agent Code. Check for proper application of Salt. counterfeitsaint   526030 also invalid counterfeitsaint   http://i.imgur.com/txIWs.png counterfeitsaint   you can't see the 5th digit cause its flashing counterfeitsaint   learned soemthing new! counterfeitsaint   incriment goes 0-9, A B C D * and back to zero again counterfeitsaint   no E or F Gwraspe   that is DTMF values Gwraspe   the ABCD chars are mostly unused chronomex   and you have to replug after failed attempts, yes? Sync   chronomex: no worries, the reset pin would work counterfeitsaint   i haven't found a way to reset it other than unplugging Sync   counterfeitsaint: because of the goo you cannot do that

counterfeitsaint http://prntscr.com/lcl4o

counterfeitsaint http://i.imgur.com/txIWs.png
counterfeitsaint you can't see the 5th digit cause its flashing

[bambusar]

inside of black box



http://i.imgur.com/X53QJ.jpg

http://i.imgur.com/a0HNM.jpg

http://i.imgur.com/FDeYs.jpg

http://prntscr.com/lcjhm

http://prntscr.com/lcjob

WE KNOW WHAT IT IS https://www.sparkfun.com/products/11098

http://www.youtube.com/watch?feature=player_detailpage&v=W9j6ZRsOUrI#t=176s

[bambusar]

MOAR IMAGES





http://imgur.com/VQIFo&cBOjE&XYqoa&HnWeI#0

http://i.imgur.com/HnWeI.jpg

http://i.imgur.com/XYqoa.jpg

Mysterious black box:



it looks home made
there seems to be some grey paste inside the box and the micro USB connector



BAR CODE ON SIM CARD

Bar code explanation

89 881 6 931200036844 3 appears on the card

89: major industry identifier- telecommunication
881: country code (satellite)
6: Iridium identifier
931200036844: account ID number
3: check digit

Dialing Direct: To call the Iridium phone from a landline phone in the U.S. you would dial 011 and then the 12-digit Iridium number. For example: 011 8816 6299 0000. This type of call is not billed to your Iridium account. The caller will be billed by their landline long distance company.
http://messaging.iridium.com/
messaging that number (931200036844)produces:
Error! The Iridium subscriber number you specified is invalid.


WE ARE OPENING THE BOX

http://i.imgur.com/Ah9gE.jpg

[bambusar]

Las Vegas Dead Drop: TRY 2



Images from start of the hike:
http://i.imgur.com/SCWgn.jpg

Tracking of our guy:
http://glympse.com/B1B-8WJ

Map of location:
https://maps.google.com/maps?q=35.977611+-115.069548&hl=en&ll=35.977687,-115.069344&spn=0.001667,0.002642&sll=42.801014,-77.808509&sspn=0.034196,0.084543&t=h&z=19

3D view:




X marks the spot:

http://imgur.com/q0six&i45C4#0


YAY we got it



http://i.imgur.com/QIXxi.jpg

Looks to me like we got SIM card for iridium SAT phone

in a 5 1/4" box of doubledensity floppies



who still keep those?




http://www.stratosglobal.com/Products/Iridium.aspx


now we need one of those

http://img145.imageshack.us/img145/2546/b202ec776333414f923f193.png

We still dont know what USB BLACK BOX thingy is, is it SIM card reader/writer? is it BLUE BOX for satelite phones? access point?

[bambusar]

ITA2 has been decrypted.
We have new drop:

Z 020030Z DEC 12
SECRET//PRJMLPL//PRJMLPL//
MSGID/DRPUPDT//
SUBJ/AGENT 16041//
DROP/xxxxxxxxx/xxxxxxxxxx/xxxx/xxxx//
GENTEXT/REMARKS/1. PICKUP DROP BEFORE 060000Z DEC 12//

Spoiler (Rollover to View):

Z 020030Z DEC 12SECRET//PRJMLPL//75X5[LF][CR]MSGID/DRPUPDT//[LF][CR]SUBJ/AGENT 16041//[LF][CR]DROT/35.977611/-115.069548/X/SE//[LF][CR]GENTEXEQGREMARKS/1. PICKUP DROP BEFORE 060000Z DEC 12//

we need somebody from Las Vegas to pick it up!



pic from location
http://i.imgur.com/Dx4ed.jpg
http://imgur.com/a/dWp2j



map:
https://maps.google.com/maps?q=35.977611+-115.069548&hl=en&ll=35.977687,-115.069344&spn=0.001667,0.002642&sll=42.801014,-77.808509&sspn=0.034196,0.084543&t=h&z=19


our guy is already there:, but drop is few hundred meters from road and he didnt have time to walk...


http://glympse.com/Y04-R8T

video from that exact spot:
http://www.youtube.com/watch?v=-Nw3U2mGyZ4&list=UL#t=3m41s

[bambusar]

NEW SONG RECORDING (4th one) message 03:00GMT December 3, 2012

We discovered new song message at 02:40 GMT on 202 nimber and Agent number 16001

http://dialer.otp22.com/2012-12-03%2001-59%20UTC%20-%20202-999-3335%20-%2016001.wav


Song is only on 202 number, 303 number is playing old ITA2 message.

Were previous "song messages" only on one number or both?


Song in message:

Porcelain And The Tramps - Redlight District



Spectorgam

...

List of parts

...

ITA2

DECODER : http://bagud.dk/arg/horns/ita2/

[03:59] LordHeinrich Here is the isolated code
[03:59] LordHeinrich http://vocaroo.com/i/s0cvJin7cm7q
[03:59] LordHeinrich I ran it through both a low and high pass filter at 2kHz

Images of Porcelain (Alaina)
"if britney spears, and maralyn manson had a kid - alaina (porcelain) would be the consequence" comment on youtube







http://j-julien.blogspot.com/2010/04/porcelain.html
http://www.last.fm/music/Porcelain+and+The+Tramps/+images/40051167

[bambusar]

One of us wrote nice summary:
http://pastebin.com/K6QRjUyy

Code:

In September 2012 a strange phone number(303-309-0004, out of Colorado) gained attention when it was posted on an anonymous forum. A group quickly gathered to work on the codes and messages received. The project came to be known as OTP22,in reference to OTP being said in the first phone messages. Since then, there have been several stages with different types of codes, an automated agent system, four different phone numbers, SSTV images, and even a live person.  Currently, we appear to be recieving messages intended for an "Agent Bourges". We have also noticed that sometimes we can reach a "Message Desk" with a live person who, when given a positive integer, will reply with another number, a town name, and even, once, an encoded message in NATO alphabet.          Initially, the phone number asked for "Agent Codes". After finding a valid code, the system would recite a long series of 2-digit numbers. The phone messages were decoded and found to mention GPS coordinates for locations labelled "TROOP", "AGENT", "SHIP", etc. Over observation, a ship convoy appeared to be heading north toward through the Bering Strait and toward Svalbard despite complications when a "MIG BOGEY" appeared.       Information about a drop in Oregon lead to the recovery of  a CD with tools to solve a new type of code, a series of letters given in NATO alphabet and frequently seperated into 5 letter sections. Another dead drop was found at a phone booth in Maine, and its contents led to the discovery of a third drop in Minnesota.The third drop was simply an index card, in a plastic bag, with the phone number 709 700 0122.       A strange series of chirps and tones on the 709 number were decoded to be information on a series of 6 drops across the world. Drops in California, Rhode Island, and Finland were successfully recovered and consisted of a set of strange metal parts in a sealed bag. The drop in Bellwood, Chicago, eventually yeilded a broken CD and a strip of paper with "97 BA 16041-97 BA 16241".       At around the same time as the 709 number was found, the coordinates system shut down. The 202 and 303 numbers started giving strange "horn" tones instead. After several days the "horns" were decoded and revealed yet another phone number, this one in Poland. The Poland number asked for a "Bell Agent Code" in order to "reactivate the system". Finally, this was deduced to be "97BA16041", and we were informed that system reactivation was immenent. All three US numbers switched to strange recordings which sound like encrypted conversations. We have yet to solve them.         Promptly, the 202 and 303 numbers were switched back to the original agent system. However, old codes were no longer accepted. Using code 16041, we were given a binary tone, much like the ones on the 709 number, welcoming "Agent Ai Bourges" back and informing her that the assignment had been cancelled. The newest agent system is more organized than the original, with a "Directory" which gives agent codes to use in order to access "AiBourges", "AgentInstructions", and "Upload". We are monitoring all of these for changes.      The most recent development is the Message Desk, which the 202, 303, and +42 numbers sometimes directly forward to. Sometimes it can also be accessed using agent codes #16044 or #16244. At the other end of the line, a live person answers "Message Desk" and prompts you for a number. He will respond with another number, a town name, and occasionally something else. The message desk has been up for a few hours every night since we discovered it on 11/23, but the times have varied greatly.  We continue to try numbers and record responses.

[bambusar]

Since we got some proves that MD guy is part of this ARG here are some interesting things we got from him. Last night we got location of next DEAD DROP from him in form of NATO message encrypted with files from CD found in Lake Oswgo Library (1st dead drop)


Some interesting recordings of calls to MD guy from first two nights:

•MD asking for number on which he return calls later http://vocaroo.com/i/s1mpRkNi0T9X

•GAY SEX SOUNDS at the end http://vocaroo.com/i/s0qsga6uyCOr http://vocaroo.com/i/s0AW2efV7Kxx (suspected troll, as MD guy commented later)


•After one guy tried to mock MD guy about sex tape, he was put on hold for more tha 1 hourhttp://vocaroo.com/i/s1JRwDUcGY8i

LOGS from last night:

https://www.dropbox.com/s/nlbvoww1c56lku3/ARGLOGSMDNNATONEWNUMBER.rar

Interesting calls from last night

• /in/526030/5030111 or /N/526030/5030111 or /10/526030/5030111
no recording, could be coordinates
http://maps.google.com/maps?ll=52.6030,50.30111&spn=0.05,0.05&t=m&q=52.6030,50.30111

•Background russian/poland unidentified speech http://vocaroo.com/i/s0dVLWIuEBlS

•Comment from MD about gay porn sounds http://vocaroo.com/i/s0erCVtIFaDs
'are you gonna start playinh porn sounds like you did the other night again'


•Nato message http://vocaroo.com/i/s1iKyHQYJZwi

[2012-11-28 05:09:24] <moonima> 6933: hold music azoenyjvsakkmbvhcnmoemlkhuhvnsllj salt 797

AZOEN YJVSA KKHBY HVHCN MOSML KHUHV NSLLJ

Decrypted with p3.txt file from CD no1. (Lake oswgo library drop)

"JJPRE PDROP LIMAV ICTOR ANDRE PORTP OSJJJ " = preparing drop lima victor(LV = Las Vegas) report position


YEEEAAAHHH!

So we are expecting next dead drop in LAS VEGAS. We got two messages about it so far.

PREP CROP LV REPORT POS
and
YR/NOTES/AI THNX FOR TAKING THIS A LTTL MORE SERIOUSLY. YOUR ID WILL BE PLACED IN THE DROP/NOTES6P.S. KEEP AWAY FROM THE BLACKJACK TABLE THIS TIME AND STAY WITHIN BUDGETXV

If some Unfiction reader is living in Las Vegas please offer us help for pick up.

[bambusar]

[bambusar]

We received intelligence report on that message guy:

http://imgur.com/rXgTP

http://i.imgur.com/NeCHs.jpg

attachment:

http://imgur.com/a/ifsUA#0

^just fan art

[bambusar]

As you probably already know on we found a way to reach LIVE PERSON (we call him MD guy) through out numbers and Agent system.

http://otp22.referata.com/wiki/Message_Desk

The guy always replied with "message desk" and then asked about the "number". Depending on number given he answers with another number or "you will have to call (some city with airport/radar/ECHELON)"

He dont like is we ask about number 43, and he is saying that number 43 is in the BOOK.



Our OTP22 Elite librarian team obtained that book:

THE BOOK

https://www.dropbox.com/s/6tztjzm3czx4k28/THE%20BOOK.pdf


ORIGINAL BOOK:
http://imgur.com/8Zhbs
http://imgur.com/nCjXP

[bambusar]

New message on 16041

YR/NOTES/NOORDERSWAITING

New message on 160410

YR/NOTES/ACTIVATIONSUCCESSFUL/NOTESKMONITOR16041



Also yesterday we uploaded SSTV on Agent code 16241



Today we are preparing new one.