unforum

[bambusar]

ahm
Dont rush at mansion yet... http://wikimapia.org/5608076/Marilyn-Manson-s-house

We called Charon on phone number from USB http://www.twitch.tv/mxcdonut/b/317767609
and he confirmed that IRC trans. is DISINFORMATION.
Soon after we received another IRC transmission.
(it is strange that IRC transmission also alert us about false messages)

Trans 33 from spreaker confirms that

[bambusar]

New developments

IRC transmission no. 4 was posted in #umbra channel
https://docs.google.com/document/d/1T0ALrkf-Aa-5djmwx0NEhEo2n1JwvxKOi35--xToovI/edit

It exposed one day earlier created secret, password protected IRC channel #sift. Channel was created by some players, to get rid of trolls, lurkers and enemy. But it failed badly.

Transmission exposed password and logs. http://pastebin.com/hjsa5EM9
Most players were shocked by existence of channel.
Identity of enemy/rat/troll wasn't discovered. We just know that all IRC transmissions came from same source.

People on #sift contacted Charon on phone, get his email and get him to join channel and answer questions. See log.

It appears that Charon has real military background. Some his posts were shocking.

[bambusar]

Next transmiison from spreaker/soundcloud
posted: 12 May 06:54, 22hours ago

CHARLIE ONE UMBRA
VIRGIL VIRGIL CHARON

ONE WHISKEY
0 1 2 3 4 5 6 7 8 9

INITIATE DIRECTIVE UMBRA
INITIATE DIRECTIVE UMBRA

SPOOK THE PIGEON AND FOLLOW IT
HONE
HUNT
SUS DEV DETERMINED TO HAVE LIMITED AREA OF EFFECT
RADIUS MAY VARY FROM ONE DEVICE TO ANOTHER
WHEN YOUR GODS SPEAK DO U LISTEN
DO YOU HEED THE CALL TO THE CLIFF
WHO DO YOU TAKE WITH YOU VIRGIL
SIFT MAKE CONTACT WITH CHARON IMMEDIATELY

CHARLIE ONE UMBRA

deciphered with help of 1w.jpg from USB key



From phone call to charon: We expect new "drops" of USB keys.
Probably on monday.
Possible locations: France. Michigan, California.

[bambusar]

Transmission 35:
Date: 13 May - Length 06:42, Decoded, NUMBERS TO LETTERS: ALPHABET FROM 1W.jpg SHIFTED, KEY: MOVEMENT FOR THE RESTORATION OF THE TEN COMMANDMENTS OF GOD

CHARLIE ONE UMBRA
CHARLIE ONE UMBRA

24 WHISKEY

TYPE BRAVO

0 1 2 3 4 5 6 7 8 9

FERRYMAN PUSH OFF SHORE
LET THE LAMENTERS SETTLE THEIR ACCOUNTS
OARS GREET THOSE WITHOUT FARE
THE HOLY GROW BOLD AND CARE NOT FOR THE RABBLE
DIVINE PURPOSE PROPELS THE SURE OF HEART
WHILE LESSER MEN BICKER CHASING THEIR TAILS
THE FOX SLIPS INTO THE COOP TO WHISPER THE WORDS AND WATCH FATE UNRAVEL

CHARLIE ONE UMBRA
CHARLIE ONE UMBRA
CHARLIE ONE UMBRA

shifted picture with key (hint whiskey 24 means A=24)

[bambusar]

Except spreaker transmissions from Virgil (girl, mastermind of UMBRA mission), Charon (squad leader of 5 men team) is frequently reporting and clarifying data on IRC. This is happening on secure invite only channel #SIFT, to avoid trolls.

Here are links to log files http://pastebin.com/hjsa5EM9 http://pastebin.com/v7SJY49s
Dont read it all, focus on longer Charons posts.

This C1UMBRACharon is not same person as umbra and c1umbracharon that posted 4 false IRC transmissions on channel #umbra. His IP is apparently from Okinawa.

Some info on current mission of Charon attack team. He is in Okinawa, trying to find out about Aleph activities.

<C1UCharon> Virgil makes transmissions, I receive orders.
<C1UCharon> She moves fairly constantly. Broadcasts from different locations at different times.
<C1UCharon> Virgil's transmissions, far as I can tell, targeted no one in particular. Except sift in general.
<C1UCharon> We're generating the HVT (high value target) list right now. I need intel regarding potential couriers for this splinter group in Okinawa.
<C1UCharon> Hoping to snatch a messenger sometime soon.

Messangers are using taxies of one company in Okinawa.

http://www.aleph.to/
Web page of AUM cult group. Aum Shinrikyo, currently known as Aleph responsible for 1995 Sarin gas attacks on Tokyo)

AUM Wiki http://en.wikipedia.org/wiki/Aum_Shinrikyo

[bambusar]

From now on we have #sift channel open and we have direct communication with Charon attack group. You can drop in and ask him whatever you want.

And com 36 is out on spreaker http://www.spreaker.com/user/4575714/thirty_six



Charon gave us some clues about deciphering http://snipurl.com/23iua7c


HARLIE ONE UMBRA
CHARLIE ONE UMBRA

SIX WHISKEY

0 1 2 3 4 5 6 7 8 9

INTERCEPTED EN COMM FOLLOWS
IT IS RAW AND UNALTERED, I REPEAT, IT HAS NOT BEEN FURTHER ENCRYPTED

BREAK

63 42 37 13 56 12 43 63 66 21 72 21 22 53 54 64 53 63 42 37 12 61 12 43 63 66 21 72 21 22 53 54 64 53 17 76 66 76 17 76 75 17 47 51 56 35 72 42 25 55 33 17 76 27 53 63 22 37 67 67 64 63 72 43 35 23 11 33 27 76 54 53 75 16 11 37 63 46 24 72 52 67 21 43 63 11 33 67 43 27 37 13 56 12 43 37 66 46 23 61 27 14 56 54 57 51 56 63 11 33 73 76 72 11 72 23 13 13 76 17 75 41 75 41 42 33 56 61 35 11 11 72 75 76 34 37 21 66 74 72 63 76 21 76 56 46 72 22 72 56 35 63 25 23 43 33 43 75 63 47 75 66 63 22 14 72 15 61 67 63 15 37 11 76 34 76 14 31 21 56 26 63 53 13 74 33 67 43 31 61 64 35 56 61 76 31 61 26 57 57 55 33 17 76 27 53 63 22 37 67 67 64 47 26 66 73 33


any help appreciated, visit irc http://webchat.freenode.net/?channels=sift

EDIT
translation of that transmission

[bambusar]

That last enemy message seems harder to crack than umbra ciohers, we are used to.
Looks like game starts to get harder.

We think that numbers means some kind of column,row from 7x7 table.
All digits are smaller than 8. No 77 used. 41 signs used.
Frequency analyses http://pastebin.com/nDLVLs3d, similar than hiragana

See hiragana entropy at bottom of page http://www-rohan.sdsu.edu/~gawron/crypto/lectures/hiragana.html

There is some old japan cipher that fits: http://en.wikipedia.org/wiki/Japanese_cryptology_from_the_1500s_to_Meiji

Kana has 49 letters http://en.wikipedia.org/wiki/Kana

Also note that writing can be rigt to left or bottom to top
http://en.wikipedia.org/wiki/Horizontal_and_vertical_writing_in_East_Asian_scripts



Here are some relevant clues that Charon told us regarding intercepted EN message:

[16:13] C1UCharon: Every culture has it's own habits when it comes to these things. If you're able to identify something on the level of language or format, take a minute to learn about the people that likely made it.
[16:13] C1UCharon: It's more than likely to help you along the way.
[16:13] C1UCharon: Stepping out. Phone's on.

[05:21] <SIFT> So what variants of Japanese are these Aum individuals likely to use?
[05:22] <C1UCharon> I'd imagine you'll see hiragana and kanji. Katakana only applies to "foreign" things. There's more to it than just that, but there's the down and dirty.
[05:22] <C1UCharon> I'd imagine you'll see some Russian before we're done.

EDIT: few more clues from Charon

C1UCharon First thing: This bit was intercepted from Russia to mainland. There's a possibility some of it is broken Japanese.
C1UCharon Not by itself, but have we looked into what "The Whisperer" is in Japanese?
C1UCharon Using that, have you troubleshot the I-Ro-Ha via Ceasarian shift?
C1UCharon Japanese encryption isn't usually very complicated.
C1UCharon That being said, they love to use multiple forms of encryption.
C1UCharon Check your source on this, of course. If you read up on it and disagree, maybe we're using the wrong tool.
C1UCharon That being said, from what I know, the Japanese love double, triple, up to 10x encryption.
C1UCharon Usually simple stuff, just many types together.
C1UCharon Hah. Don't thank me yet.

whisperer- sasaya sasayaki さ さ や き

[bambusar]

36 enemy chatter still not solved!

We received 37, but it has some typos. EDIT: typos repaired

Trans 37. It has some typos. Its playfair cipher, a=1, key: whispering

c1umbra
c1umbra
papa

RECENT UNENCRYPTED EN CHATTER MAKES MULTIPLE REFERENCES TO AOR THE WHISPERER
PROBABLE RELATION TO SUS DEV
INTEL INDICATES EN ACTIVITY ON RISE
EXPECT EN TO ATTEMPT TO BOLST COMM AS INTERCEPTION HAS BECOME HIGH VIS INCIDENT
BASED ON THIS KNOWLEDGE EN DROP EXPECTED WIOIN 48 HRS
ALL SIFT OPERATIVES ARE NOW ON STAND BY ALERT

c1umbra
c1umbra
c1umbra

[bambusar]

Trans 38 is out
We got new drop point in Okinawa, charon picked it up.

CHARLIE ONE UMBRA
BRAVO

COMM REGARDING EN DROP INTERCEPTED
[52 RCQ 82988 09869]
NO IMAGE AVAILABLE
LIKELY TO BE DIGITAL DATA OR FOLDER TIME SENSITIVE

CHARLIE ONE UMBRA

On location:
http://tinypic.com/view.php?pic=2u5xttc&s=6
http://maps.google.com/maps?ll=26.303895,127.827811&spn=0.3,0.3&t=m&q=26.303895,127.827811
http://www.panoramio.com/photo_explorer#view=photo&position=25&with_photo_id=1207638&order=date_desc&user=231236



On USB two files were found: http://pastebin.com/ZdZFRwiG http://pastebin.com/Cm1XfC8C

filenames:
first: 安全な輸送 'safe transport' or 'safe transportation'
second: 旅程 'schedule'

Content:
File 1

42 64 47 21 55 75
63 64 63 74 61
51 75 52 32 11 47 22
43 55 43 75 51 75
14 63 65 22 55 76
64 66 75 41 12 76
75 52 75 11 22 47
66 57 52 32 54 17 47
47 63 64 52 76

File 2

56 46 72 22
32 47 51 21 43 43 35 75 56 56 75 23
75 56 57 72 57 75 56 56 43 35 43 75 72 76 14 13
32 56 35 11 53 75 56 57 72 57 43 75 72 76 27 15

It appears that cipher is the same as in trans 36. We need more Japanese speaking SIFT members to solve it. We still think that it is i ro ha, checkboard, but message must be somehow further ciphered. Row/Column order, Row/Column shift, Cesarian shift or something else...

[bambusar]

We recieved Two new youtube movies.
First is footage of OBJ Ambrose, in Phillipines. It was reported in Trans 21 on 25. April.

OBJ AMBROSE PACIFIED
HVT NEUTRALIZED
ASSAULT ON OBJ DOCUMENTED IN FULL AS REQUESTED
VIDEO OF ASSAULT AND AA TO FOLLOW AFTER EXTRACTION FROM HOST NATION
EXTRACTION WILL OCCUR NLT THAN 1200 2012-04-30
RECOMMEND EMPLOYMENT OF DROP LOCATION IOT FACILITATE DISSEMINATION OF INFORMATION TO SIFT OPERATIVES
WETWORKS ON STATION 2012-04-30 TO 2012-05-01
PAST 38 RS ON OBJ AMBROSE CONFIRMED PRESENCE OF SUSPECT DEVICE
SEVERAL DETAINEES TAKEN FOLLOWING ACTIONS ON OBJ
EACH DETAINEE NOW KIA DUE TO INTERFERENCE OF AN UNKNOWN NATURE
BODIES DISFIGURED AND BADLY BURNED
GARRM
SA DETAINEE KIA
FRIENDLY CASUALTIES
CONDUCTED EXFIL AT 1300 UNDER COVER OF SUPPORTING A FIRE
ARRIVED FOB SCHRADER APPROX 2100
CHARON



AND IT LOOKS FUCKING REAL, WHAT KIND OF ARG IS THIS?


Second movie is showing Charon chasing Daiichi taxi that is supposedly making some kind of transports:

[2012-05-14 01:13:58] <C1UCharon> They seem to wait outside the Palace Main, it's a local mall.
[2012-05-14 01:14:22] <C1UCharon> It's there that they pick up mostly servicemembers and take them to Tsuji. On who's command? Don't know. [2012-05-14 01:14:26] <C1UCharon> They all stop at the same hotel.
[2012-05-14 01:28:48] <C1UCharon> It's "Cream Play Spot"

http://g.co/maps/e96vn



everything seems so real...

[mycroftxxx]

Jeebus, congratulations /x/. You guys have either stumbled upon the world's most-awesome military ARG, or have run into the worst operational security ever.

I have no idea what to tell you. Generally, though, real good & bad guys use things like public-key encryption or one-time pads. Noone uses SSTV to hide images since the sound is pretty damn distinctive.

Those are the only things I can see that still spell "game" to me. Otherwise the folks involved have managed to generate a creepy amount of realistic-seeming content.

[bambusar]

Trans 39 is out

CHARLIE ONE UMBRA

BRAVO

En encryption methods rudimentary in the past employing cesearian shift and i-ro-ha we have reason to believe methods have not changed.
En drop recovered by charon likely to contain list of names and movement details of hvt.
Find those names.
Charon to compare against previously compiled list and move against targets immediately.
No more the gentle breeze.

CHARLIE ONE UMBRA

So with this hint we were mange to decipher ENEMY code. File 1 on USB was list of names:

Miyakita, Keshi (already captured and currently being interrogated by Charon)
Kaya, Kasuo
Yoshimoto, Akira
Ikeishi, Yoshi
Nakamura, Ken
Yamashiro, Ren
Shimoshi, Araki
Matsumoto, Hiteki

Cipher that enemy used is I RO HA checkerboard and cesarian shift by -1.
To decipher it you must convert number (row/column) with i-ro-ha checkerboard to hiragana letters. Then shift those hiragana letters by one letter back in hiragana alphabet chart.
i---a u---i ... but you alwasy stay in same row a---o ka----ko



This is one step chart with inplemented -1 cesarian that you can use



this is the result that we are translating
T36, FIle1, File2 http://pastebin.com/2Z6EsP19

[vriska]

An interesting note about the Iroha itself--

While it codifies the Japanese syllabary, it was originally written in a now-obsolete script called manyougana. When you take the last syllable of each line of the poem written in manyougana, you get one further hidden message.

"Toga nakute shisu" or "to die without wrongdoing.

If you need anything translated you can PM me, I speak Japanese.

[GuestUser17]

[bambusar]

UPDATE
Recent logs of conversations with Charon

http://snipurl.com/23kpn5n

Here is one version of translation

T36 and FILE1

http://snipurl.com/23kpfeh

After Vriska and Bannana translated FILE 1, Charon checked if any of that names occures in his documents provided by intel.