unforum

[mloo12]

News maybe?

[francinum]

We're still dead in the water here

[sepharoth213]

Has anyone seen this yet?
https://www.youtube.com/watch?v=QEn855o7wwk

[likeabillion]

I just watched all of the video - after about 10 minutes, it becomes a (quite interesting) Q&A with Jim and Rachel. I didn't notice anything weird, other than it ends mid sentence.

Unrelated, but frogfractions2.com is slightly bizarre (literally fractioned frogs).

The description tag is "Learning about fractions 2 is fun!"... the YouTube account of the video has been around for years, and has quite a few really weird seemingly educational style videos featuring a bad CG frog.

It might be nothing to do with any of this though!

[aklreaxmer]

The WHOIS data of twinbread.com and frogfractions2.com are very different (different hosts, location, owners, etc.), but frogfractions2.com was created recently (3/12/14), so it's possible it is related...

[Norgg]

So other than the embedded video, frogfractions2.com just has the text "3/4" in the page... I tried going to http://frogfractions2.com/3/4, but that (or any other sub-page) redirects to http://www.christopherjameshart.com/ with an interesting visualisation on. I can't find any other info, or anything else about Christopher James Hart other than another page on his site which comes up: http://www.christopherjameshart.com/squares/. This seems to be an interpretation of the game Mao, where you've got to experiment to place squares correctly. Feels a bit off the path though.

Edit: Found his almost suspiciously quiet YouTube stream: https://www.youtube.com/channel/UCLc89GBgMScIU35-R0mKk0Q/feed

[Norgg]

Had a chat about the compression format with a colleague of mine today and we reckon there's potentially a feasible attack on the archive based on compressing another MP4 file with hopefully similar enough headers and using it as a known plaintext attack on the ARJ encryption, which would be vulnerable to that due to being based on simply XORing the contents with the file. I haven't found much written up as to how ARJ actually compresses files though, the specific algorithm may make the attack infeasible.

[aklreaxmer]

I'm not too familiar with compression theory etc, but I did find a few sources that detail the ARJ algorithm that you may be able to make sense of...

http://cpsr.org/prevsite/cpsr/privacy/crypto/tools/docs/arj-encryption.txt/

http://www.fileformat.info/format/arj/corion.htm

https://farmanager.googlecode.com/svn/trunk/plugins/multiarc/arc.doc/arj.txt

[Norgg]

Got it.

So, I went and wrote a parser for arj files to get a feel for how they work and investigate any possible weaknesses they might have.

After figuring out how the encryption actually works (not actually as described in http://cpsr.org/prevsite/cpsr/privacy/crypto/tools/docs/arj-encryption.txt/ but the page was very useful), I took a look at the byte distributions in some unencrypted but still compressed test videos I'd grabbed. Turns out that there's a lot of similarity between the byte frequency distributions of ARJ compressed MP4 files, AND you can get closer to that distribution by guessing only a letter of the password at a time, but which isn't 100% accurate (something like 95%). Since the archive is in 5 parts though, that gave me several files to verify against each other.

So, I eventually got a script together ( http://pastebin.com/QBPVN97b ) that guesses a letter at a time for various assumed password lengths (the algorithm needs to know the total password length up front, but partially works for multiples/divisors of that length) and... we've been staring at the answer this whole damn time!

"zero four five one".

And...: https://www.youtube.com/watch?v=zx23nWRrjno

Nothing but further mysteries. Brain too fried by going deep crypto to make much sense of it.

Edit: Thanks to https://twitter.com/kitbarnes for suggesting a bunch of stuff.

[Norgg]

Can anyone make out the map at 0:56? It looks to me like there's a location there, then the next shot is of what could be a fake manhole cover being revealed beneath the red cloth. I'd take a guess at there being something under there, maybe the tablet itself?

[Norgg]

I've extracted all the frames with the map displayed: http://imgur.com/a/jDs7q

Edit: The frog hand here looks to be writing [I?]"OU" on an envelope earlier in the video.

[Killrrhubarb]

I'm guessing that the map shows somewhere in California, probably the park that some of the video takes place in. The park looks fairly unique, so it's possible that someone could recognize it. As for the arcade, it looks very similar to other arcades, so maybe no luck there. Most of the things inside the video seem to be references to the first game - there's a frog riding on a lily pad, it being surrounded by flies, a frog plush eating a butterfly, a frog riding on a turtle etc. The parts that interest me is the part with Jim Crawford making a speech, and then getting punched. The crowd cheers, then the rightmost woman in the crowd gets punched. Also the scene with the person in the chair watching the dogs on TV. And of course the original prince of Persia. It appeared in the kickstarter video, and it appears in this video too.

EDIT: Can you (or someone else) create a download file for the unencrypted stinky.mp3? I'm dumb and can't figure out how to unencrypt it (or use arj32 at all), but will still like to play around with it.

[Norgg]

Sure, the original is here: http://norgg.org/files/stinky.mp4 (I'd put the link in the YouTube description, but it got hidden under the "show more..." bit.

[likeabillion]

Holy shit Norgg nice work!

[Killrrhubarb]

So I looked at the metadata for the video using both GSpot and MediaInfo. There's some normal stuff, but it's interesting that the video was encoded on the 5th of April, 2014 at 6:55 pm. Also, using GSpot there seems to be some user "human authored" data. It says (c) ART.

If someone could confirm this, make sure it has nothing to do with GSpot itself being silly (GSpot has problems with MP4) that would be great.