unforum

[highwind767]

Yup, completely possible.
Off the top of my head I know I tried: kepler, ophiuchus, deardani and colour

[MrToasty]

Latest update:

[Sylvia]

[highwind767]

And when slightly altered we get this:

[Oriza]

Oy. I don't think I can wait that long...

[Sylvia]

It still feels like we're missing something but it just may be me.

[MrToasty]

[dakman33]

does anyone ever look at this stuff?

[MrToasty]

^^^
All the time. Nothing useful gained in this case.

[Sylvia]

Just want to make sure we all understand the time thing.

When it turns Wednesday in the UK it will be Tuesday 7:00 pm EST, 6:00 pm CST, 5:00 pm MST, and 4:00 pm PST.

So for me it will be Tuesday 7:00 pm.

Right now for example, it is Sunday 8:35 pm for me but Monday 1:35 am for them.

[natas]

that can't be the complete decipher can it? I'm still gonna work on it.. seems weird.

[natas]

[Rogi Ocnorb]

The inconsistent apostrophe replacements are another messy bit.
I'd like to find a better message than the one we have, but don't think there is one. As for some kind of a meta puzzle using the inconsistent replacements. I'm not finding anything with that, either.

On it's face, it seems like somebody manually replaced the characters and just plain blew it on a few when they were replacing.
They obviously didn't use global replacements.

As for a meta with the letters vs numbers .
I think it'd be fairly impossible to do that and have the substitution be as clean as it is.

There could be something with capitalization ("a" vs: "A", for instance), that could hold some kind of encoding. But, I sure can't see it.

Yesterday's update is the same for me. The addition of the DDoS reply when a request from the same session within a few minutes time is definitely intentional and has nothing whatsoever to do with any kind of real DDoS protection or reporting for the site. So, it may be just to add to the "realism" and not be any kind of a puzzle to solve.

I've looked through 500.jpg with various editors to try and find any hidden base64 or other ASCII as well as binary strings common to certain file types (like all .zip files begin with "pk". most .gifs have "GIF89a" and some .jpgs have "JFIF") wondering if they could have enclosed another file within it. Whole lotta nothing.

I don't think the file is stegged with Camouflage as the ones I've seen in the past had a bunch of spaces in them just before the end of the file.

If it's stegged with some other tool, good luck on figuring it out. With all the stegging tools out there and the ease with which someone can hack one to tweak the algorithm, it's just too damn much effort to try and get anywhere with them.

If I ever wanted to truly send encrypted information I didn't want anybody to see, steganography would be the way to go. But, Camouflage uses a pretty insecure method. JPHide is much better.

Maybe the regular site updater just took the weekend off?

ETA: More info to support the "weekend off" theory...
Valid JPEGs always begin with Hex "FF D8" and end with "FF D9". There can be additional information after the "FF D9", but it being missing means it was truncated, somehow. Any image editing program or steg tool would preserve this "rule". Camouflage differs from most in that it adds it's information to the end of the file (after the "FFD9") using XOR encryption.

[Oriza]

Darkman, running a whois on it like you did just tells us that the site is registered to Domains by Proxy...and the whole point of Domains by Proxy is to NOT be able to see anything when running a whois on a site. You're only seeing the address, email and registration email of the company Domains by Proxy.

I'm just going to sit back and wait until Wednesday for the rest of this to clear up. Rogi, you could teach me a thing or two about decoding images
BTW, what is a Meta?

[Oriza]