unforum

[bambusar]

Troll the NSA - Funny Puzzle (http://nsa.org/)

[Pixiestix]

I'm struggling not to move this to "time wasters". There may very well be a crazy conspiracy theorist's puzzle - but I'm doubting ARG. I also won't open a zip file on my phone, so until someone can spoiler tag and post what is going on I'm going to keep my eye here.

[catherwood]

I clicked on the "Donate" button, hoping to see who was behind it, but it sends you to the real PayPal site without details and returns an error.

Time to dig further...

So far, I see this text on the page:

[bambusar]

I am still putting decent post together we found few stuff already, dont move it to waste yet. Looks like some interesting people are involved it might be fun experience. Stay put ill post what we found out until now.

Lol i have seen 3 different versions of transcribed numbers

[catherwood]

Thank you for all of that data. I recommend adding replies from now on, rather than further edits of the top post, as people won't know when you've added more info. (But you might as well delete the block of numbers that you know have a typo.)

My only other observation is that the cow .jpg has some more texture in the white area if you play with the contrast, but nothing looked like data to me, just a quick attempt to cut out the background.

[bambusar]

OK lets look into site history. Domain is used since 96. And it looked fun through whole history:

1996: http://web.archive.org/web/19961222001357/http://www.nsa.org/

1999: http://web.archive.org/web/19990423142146/http://www.nsa.org/

1999: http://web.archive.org/web/19991012034518/http://nsa.org/

2000: http://web.archive.org/web/20000510192754/http://www.nsa.org/

2000: http://web.archive.org/web/20001019061139/http://www.nsa.org/

2002: http://web.archive.org/web/20020803001103/http://nsa.org/

2002: http://web.archive.org/web/20020603093545/http://www.nsa.org/

2005:http://web.archive.org/web/20051024010713/http://www.nsa.org/

2008: http://web.archive.org/web/20080517034927/http://www.nsa.org/

2012: http://web.archive.org/web/20120314052908/http://www.nsa.org/

2005: http://web.archive.org/web/20051109220956/http://www.nsa.org/index.hbsa.yellow.html

Browse thosearchived pages, you might found something new. Page was changing alot and every version was somehow funny.


Last time Page was modified: 13 July 2013

Whois info (192.241.201.158):

Admin Name:Chris Fisher
SOMA Residences | Managed by: SOMA Residences
1045 Mission Street
San Francisco, CA 94103
(415) 864-7368

http://www.whoismind.com/email/chris.fisher@gmail.com.html


http://whois.net/whois/nsa.org

Image found on nsa.org in 2005

[mrshomersimpson]

stepped out from lurking here to say that i did try and open the zip file but it is password encrypted... if you want me to open it and find the password i can help there - goes back to lurking

[blaqueice]

a keystroke of luck. The password is:

[bambusar]

.k file looks mysterious


some poeple are suggesting it can be open as image with software called Iris on OSx or Iphones.

We need somebody to try that. Nobody of us owns any apple device.

http://www.corrupteddatarecovery.com/Repair/IRIS-Editor-Format-File-%28eurobraille%29-File-Repair-K-Data-Conversion.asp

http://www.file-extensions.org/k-file-extension

http://k.file-extension-library.com/


Could also bi this: http://forums.arcgis.com/threads/63744-.k-file-%E2%80%93-ISYBau

[blaqueice]

As interesting as this is, it's definitely not an ARG...

[Pixiestix]

yeeeeeaaaahhhhh, no.

Moved to time wasters. I think the wayback machine history shows this is just a guy who does "mock the government" type things.... but not an ARG.

[bambusar]

Yeah it sure isnt standard ARG with PM watching our every move. But is is still worth solving. Mystery is a mystery.

Here is standard deviation of .k file: http://i.imgur.com/YhceaMQ.png
<crash_demons> it doesn't seem useful to XOR the digits against the Kfile, since one seems nonrandom; it's random, within its range; it doesn't seem to always make use of all 256 bytes, it has a lot of printable characters

hex statistics http://prntscr.com/1jtlfl

jpgsnoop of picture https://infotomb.com/zy0nj


XORING numberstring with file didnt produce any plaintext results.

We tried to convert numberstring to binary suitable to XOR in two ways: https://infotomb.com/1szey# https://infotomb.com/712of#

Tools we used:
http://code.google.com/p/otpxor/
http://home.paulschou.net/tools/xlate/

Stego also didn yield anything else then false positive detections. And we dont have any clue what sort of stego tool or what the password would be.
Tools:
http://www.jjtc.com/Steganography/tools.html


original cow




Few quotes from history of web page:

[bambusar]

Maybe this is turning into ARG after all. Red Herring suggests so. Not sure if changes on web page were triggered by increased traffic or were preplanned, but it seems like somebody is mocking us a bit.
Sadly this thread being in TimeWasters doesnt spark much attention on UF.


Anyways; new things on webpage http://nsa.org/ :

Last time Page was modified: Thursday, August 08, 2013 11:53:47 AM

Image of red herring :

http://nsa.org/redherring.gif




New address:

2817 WEST MAIN ST. 59718

Taco Bell, 2817 West Main Street Bozeman MT 59718 - Taco Bell Again



New hint on bottom:

8=2


If you want to join community solving this ARG join: http://webchat.freenode.net/?channels=verite, or post in this thread.

[Pixiestix]

Uhm... Red herring by no means was started by UF , not sure at all why you feel that has to be a mocking reference to us.

And again, puzzle does not an ARG make.

[bambusar]

Sorry pixiestix for interfering and criticizing your job. You are right. Puzzle is not ARG, all I wanted to say was if author starts to interact with researchers than it is moving closer to ARG field.

I didnt mean to suggest red herring has anything to do with UF, I meant that traffic on the page becasue of us was noticed by author and he put on additional info. Red Herring is just common thing at puzzles, suggesting that page IS a puzzle to be solved and we are on right path.

I was just a bit buthurt because Timewasters get so much less attention than threads in News. And me personaly posted few lame ARG attempts threads in News that fall apart after two weeks after creators figured out that making an ARG is not as easy as it seems. Those threads deserve more to be removed.

Thing is when those mysterious secretive wannabe ARGs start is hard to tell what is what and how long it will be.

No hard feelings. Keep up the good work! Thx for all the time.