124: Solving Cicada 3301: Decoding the Internet's Greatest Mystery
35:56 Share

Plug in a Hyundai EV and the extraordinary happens.

From the charge time and range in the Ioniq 5 and 6 to the adventurous spirit of the Kona Electric to the 601 horsepower Ioniq 5N, Hyundai EVs make the extraordinary electrifying. There's joy in every journey. EPA estimated 303 mile driving range for 2024 Ioniq 5 SE SEL Limited Rear Wheel Drive and 361 mile driving range for 2024 Ioniq 6 SE Long Range Rear Wheel Drive with fully charged battery. Actual range may vary. Visit HyundaiUSA.com or call 562-314-4603 for more details.

Hardy Fiber Cement Siding handles conditions that can cause damage to vinyl. From fire to hail, Hardy Siding stands tall through it all, helping trade professionals look their best when they recommend Hardy Siding and Trim. See the proof at jameshardy.com. Early in the morning of January 4th, 2012, a strange message appeared on the internet. Just a few lines of text on a black background posted anonymously. Hello. Hello.

We are looking for highly intelligent individuals. To find them, we have devised a test. There is a message hidden in this image. Find it, and it will lead you on the road to finding us. We look forward to meeting the few that will make it all the way through. Good luck. 3301.

Many speculated that it was a recruiting tool for the NSA, the CIA, MI6, or even the Masons. But who was really behind this? And what was its purpose? And did it even have a purpose? Whether it did or not, it didn't matter. Because when you post a puzzle on the internet looking for highly intelligent people, that's a challenge that's simply impossible to resist. So the hunt for Cicada 3301 was on.

On January 4th, 2012, the first puzzle was posted on 4chan by a self-identified group called 3301. The post was simply an image with text. "There is a message hidden in this image. Find it and it will lead you on the road to finding us."

The puzzle was open to anyone and everyone. As you solve each clue, you move on to the next level. The image that was posted on 4chan was the first clue. Solvers tried various methods to extract this secret message. Some used Photoshop to view the pixels. They applied different filters and techniques to see what could be hidden in the image. But the solution to the puzzle wasn't visual. It was plain text.

When an image is opened in a text editor, it looks like nonsense, strings of characters and symbols. But to a computer, these symbols make sense. It's a binary format representing pixel placement, color information, metadata, and all kinds of other stuff. And when the 3301 image was opened in a text editor, there was a string of characters at the end of the file.

Because of the repeating characters and the name Tiberius Claudius Caesar, people quickly and correctly guessed the message was encoded with a Caesar cipher. A Caesar cipher works by shifting the letters of the alphabet a fixed number of places down or up. You choose a shift value, for example, three. And for each letter in the original text,

replace it with the letter that's located three positions down. If you reach the end of the alphabet, you wrap around to the beginning. For example, using a shift value of three, A becomes D, B becomes E, C becomes F, and so on. The Caesar cipher is easy to crack with modern methods and isn't considered secure, but it's historically significant and often used as a basic introduction to cryptography. Such was the case with the first puzzle. When the

When the message was decoded with a shift of four places, the result was a URL, which turned out to be another image. - Whoops, just decoys this way. Looks like you can't guess how to get the message out.

The participants hit their first wall. Opening this image in a text editor showed nothing. Turned out that the image contained two keywords that hint at how to get the real message out: the words "guess" and "out." Those keywords indicated you needed to run the image through OutGuess, a small application used for steganography.

Throughout this complicated scavenger hunt, Outguess would become a favorite tool of Cicada 3301. Now, steganography is hiding a message, image, or file within another message, image, or file. Unlike encryption, which scrambles data so that it's unreadable without the correct key, steganography conceals the fact that a secret message exists at all. Imagine you have a digital photo and you want to hide a text message in it. You could subtly change the color values of certain pixels to encode the text.

To anyone looking at the image, it appears normal. But someone who knows where and how to look could extract the hidden message. Outguess revealed a page on Reddit and a different clue, a book cipher. Book ciphers are almost impossible to crack without the book. But 3301 knew how to give us just enough information to keep us hooked. And people were hooked. So when solvers finally made it to Reddit, they realized that Cicada 3301 was just warming up.

When the image of the duck was processed without guess, it revealed a URL and a book cipher. A book cipher is a type of encryption where the key to deciphering the code is a specific text, such as a book or article. Each word or letter in the secret message is replaced by a coordinate that points to its location in the chosen text.

For example, if the word "apple" is found on page 42, line 5, word 3 of the book, you'd replace "apple" in your message with the coordinates 42, 5, 3. The Beale ciphers are a set of three ciphertexts that

that supposedly reveal the location of 43 million dollars of hidden treasure somewhere in Bedford County, Virginia. They were first published in 1885 and the second text was actually decoded using the Declaration of Independence. The other two texts are still a mystery, but over a hundred years later people are still looking. - Yeah, 43 mil keeps you motivated. - It does.

So to decode 3301's book cipher, we'll need the book, which could be found on Reddit. But when you got to the page on Reddit, it was full of posts with encrypted titles. There was also an odd image in the header. Even the page had a title that looked like random characters. But by now, everyone knew there was nothing random about it. There were also several lines of text and two additional images. Using Outguess on the welcome mat image gives us this.

This information was extremely important to the people following the clues. There were a lot of imposters popping up pretending to be Cicada 3301.

But because 3301 implemented PGP encryption, new messages could be authenticated. PGP stands for Pretty Good Privacy, and this is an encryption system used for sending emails and sensitive files. How it works is, you create two keys. One is public, which you share with everyone. The other is private, which only you have. So if someone wants to send you a secure message, they encrypt it with the public key that you shared, and then you use your private key to decode the message.

3301 would encrypt all their clues going forward, like the clue hidden in the second image, which was a stereogram, which is an optical illusion that creates a 3D image when viewed in a specific way. This stereogram kind of looked like the Holy Grail. - Cute. - And this image also contained a secret message.

The key has always been right in front of your eyes. This isn't the quest for the Holy Grail. Stop making it more difficult than it is. Good luck. 3301. The subreddit also contained many lines of what appeared to be encrypted text. The question that everyone faced was, which cipher method had to be used and how do you find the key? The hidden message provided a hint. The key was literally in front of your eyes. It was the image in the header.

Those symbols are actually Maya numbers. The title translates to... Kokis mirathosat nabka. What are you talking about? The clue. I'm going to solve this one. Okay, what is it? Kokis mirathosat nabka? Yeah. That's a... That's a Mayan word for something, right? A Mayan word for goat kiss? No. The letters make up a... The Mayan word for lettuce? No, they make up a... The Mayan word for makeup?

- The Mayan word for makeup? - No, it's a key. - The Mayan word for key? - It's not a Mayan word, it's an encryption key. - Okay, okay, don't get your panties in a wad. Key to what? - Remember the subreddit was full of posts with encrypted titles? It was determined that they were encoded with a Vigenere cipher, which is another letter shifting encryption technique. Vigenere encoded text needs a key. The string of letters made from the Mayan numbers was that key.

Without the key, decoding a visionary encrypted message is almost impossible. Even with the key, it would take a long time. And if you miss just one letter, you end up with meaningless texts. So your translation has to be perfect. But there's no reason to do it manually. It takes a lot of processing power, but computers can eventually guess most visionary keys.

But if you already have the key, computers can easily decode the message. There are even websites to help you do this. The decoded text was from Thomas Bulfinch's mythology. This was a classic work based on the tales of King Arthur, the Knights of the Round Table, and their hunt for the Holy Grail. So now the solvers knew the book that was needed to decode the book cipher. But this time it wasn't a message or a webpage or an image. It was a phone number.

At first, people thought Cicada 3301 was just an online troll pumping out puzzles to waste everyone's time. But there was just too much work put into it. Whoever was behind the puzzles was someone with computer skills and advanced knowledge in cryptography. So the duck image led to a book code and a page on Reddit. And the page on Reddit led to two more images, Maya numbers and the book cipher. And the book was about King Arthur's quest for the Holy Grail. Get on with it. Yes, get on

Now we can use the book code mentioned in the outguessed message from the initial image. A book code encodes each letter with two numbers, the line number and the character index in the line. By applying the book code to the text, we get the following text string. Call us. Telephone number 214-390-9608. When the book cipher revealed a phone number in Austin, Texas, codebreakers thought they'd finally learn who was behind Cicada 3301.

Very good. You have done well. There are three prime numbers associated with the original final dot JPEG image. 3301 is one of them. You will have to find the other two. Multiply all three of these numbers together and add a dot com on the end to find the next step. Good luck. Goodbye.

No answers, just another clue. Cicada 3301 was a series of intricately woven puzzles. Each puzzle got progressively more complex, but future puzzles often referred back to earlier ones, indicating this entire process was thought out well in advance. The length of the scavenger hunt also weeded out casual participants. Only those with patience would continue. It was natural selection.

Solvers went back to the original image, looking for anything that would indicate a prime number. Outguess revealed nothing. Scanning the image with Photoshop and other forensic tools also provided no help. People counted the characters and the spaces in the text. They converted the characters to ASCII. They ran the text through every cryptography algorithm you could think of and still nothing.

But like many of the Cicada puzzles, the answer was hidden in plain sight. The original image looks like a square, but keen observers noticed it wasn't a perfect square. The image was actually 509 pixels wide by 503 pixels tall.

509 and 503 are prime numbers. Multiply 509 by 503 by 3301, and you get 845145127. Add a .com, just like the voicemail said, and that's where we see the infamous cicada image for the first time.

Under the image was a timer, and it was counting down. When the countdown reached zero, the timer was replaced with a list of coordinates. 14 locations in 5 countries all over the world, with an invitation to find the location nearest you. Up until now, the puzzles existed exclusively on the internet, but now Cicada 3301 was going out into the real world.

The list of 14 locations around the world indicated that Cicada 3301 was a global organization, or a handful of people with the time and money to create complex puzzles and travel the globe. But by taking the next round of puzzles into the real world, Cicada created another filter. In order to move forward, not only did you have to be excellent at cryptography, you had to have the means to travel to one of the locations provided, and only the most committed could proceed.

At each of the coordinates was a poster containing the Cicada image and a QR code. Scanning the QR code resulted in a link to another JPEG file. Like before, running the image through Avgess revealed secret text. The image also included a warning.

Considering the difficulty of the puzzles and the mystery surrounding them, it was only natural that people were talking and sharing information and collaborating. If you didn't live near one of the Cicada locations, you almost had no choice but to ask for help.

But Cicada 3301 was clearly watching, and if you got caught teaming up, you'd be out. And it didn't take long to identify the text referred to by the last clue. It was the poem Agrippa by cyberpunk novelist William Gibson. Agrippa is a very Cicada type of poem. It was originally distributed on floppy disk, and after you read the poem, it encrypted itself. "Meant to be read only once and for all." Solving the book code resulted in another URL.

But this one was different: a .onion extension. Onion routing makes the data's source and destination untraceable by encrypting the data multiple times, like the layers of an onion. Onion pages aren't accessible with a regular web browser. You need a specialized browser designed specifically to access pages hosted on the Onion Router Network, or Tor network. In other words, the dark web.

When most people think of the dark web, they imagine a place full of illegal activities, a place where people can buy and sell drugs, weapons, and worse. And it's true, those things exist on the dark web, but that's only a small fraction of what's there.

The dark web is actually a part of the deep web, which is all the unindexed parts of the internet, including private databases, email accounts, and subscription services. In fact, most of the data on the internet exists on the deep web. The dark web is specifically the section of the deep web accessible only through specialized tools like the Tor browser, which makes web traffic anonymous. Before it was made public, Tor was used by the US Navy to secure government communications.

Later, it became a beacon for privacy advocates and anyone looking to shield their online activity from prying eyes. Not just criminals, though. Journalists use the dark web to communicate with activists in oppressive countries. Whistleblowers have used the dark web to remain anonymous. If you want to remain anonymous and untraceable, you go to the dark web. It's only natural that a group like Cicada 3301 would end up there.

So Cicada solvers who made it this far typed the Onion link into their Tor browser and were greeted with the following message.

Congratulations. Please create a new email address with a public free web-based service. One you've never used before and enter it below. We recommend you do this while still using Tor for anonymity. We will email you a number within the next few days in the order in which you arrived at this page. Once you've received it, come back to this page and append a slash and then the number you received to this URL.

33-01. This would be the first time that Cicada would communicate directly with people. Very few made the cut, but those that did received an email a few days later. This message will only be displayed once. Here is a message that has been encrypted with RSA. The encrypted message is a number. Break the decryption key, then come back to the same URL and enter the decrypted message to continue.

Each person who has come this far has received a unique message encrypted with a unique key. You are not to collaborate. Sharing your message or key will result in not receiving the next step. Good luck. 3301. Since each participant was assigned a unique number, Cicada 3301 was able to track who was sharing information. If you got caught, you were out. Hello.

But those who were able to solve the puzzle, and solve it alone, received an email. The email contained the following text, along with a piece of music:

The music was encoded as a MIDI file.

MIDI is music expressed as code. It was found that there were two tracks that provided two different messages. Each message had fewer than 26 combinations of pitch and tone, which hinted that each combination could represent one letter. The music was decoded into a cryptogram, which could then be broken.

Very good. You have proven to be most dedicated to come this far to attain enlightenment. Create a GPG key for your email address and upload it to the MIT key servers. Then, encrypt the following word list using the Cicada 3301 public key. Sign it with your key. Send the ASCII armored ciphertext to the Gmail address from which you received your numbers.

Everyone who received this email was also given a set of 50 unique words. Those words were to be encrypted and emailed back. What happened after that is unknown, but about a month later, the image on the subreddit changed. Hello. We have now found the individuals we sought. Thus, our month-long journey ends. For now.

And just as cryptically as the Cicada puzzle started, it finally ended. It was assumed that the mysterious group, whoever they were, finally found the highly intelligent individuals it needed. Cicada 3301 stopped posting messages and was largely forgotten.

But a year and a day after the first puzzle was posted, Cicada 3301 was back. Cicada was quiet for a year, but on January 5th, a new image was posted to 4chan. Hello again. Our search for intelligent individuals now continues. The first clue is hidden within this image. Find it, and it will lead you on the road to finding us. We look forward to meeting the few that will make it all the way through. Good luck. 3301.

Like before, running the image through Outguess led to a book code, which led to a URL, which led to a file. A large file. This file was its own mini operating system. When you booted it up, it displayed the prime numbers up to 3301 and then restarted the computer. It would do this indefinitely. But there was also a message within the numbers. The key is all around you. Good luck. 3301.

Those numbers led to a Twitter account that was posting tons of encrypted text that nobody could decode. But on the mini operating system, someone realized that you could break the boot sequence and browse the file system. In one of the folders, there was a song, this time an MP3 file. ♪

According to the ID tags, the title of the file was "The Instar Emergence". Software's tried all sorts of techniques on this file to search for hidden meanings. They played it backwards, they isolated frequencies, they even ran the sound through spectral analyzers, but they found nothing.

There were hidden messages and odd mini-poems all over the place, but nothing seemed connected. Then someone determined that the messages from the Twitter feed were actually lines of binary code, which could be assembled into a file. But it was encrypted and nobody could figure out how to decode it. It turned out that the messages were encoded with the binary data from another file as the key. That file was the song.

So using the song, the Twitter data was decrypted into an image.

A rune table. The rune table image also contained secret text, which led to more puzzles, which led to the dark web and to more posters around the world with different coordinates. In order to move forward from here, you'd need to have solved every puzzle so far. Now on the posters, there were phone numbers, and each phone number required an access code that you decipher using the rune table. Once you got past the access code, a computerized voice then read you a string of letters and numbers, which turned out to be a hex code.

and then the hex code converted to a page on the dark web which had a test for you to take. There were 19 questions in total, some mathematical, some logical, some philosophical. Very few people made it past this test, but those that did received an email. Congratulations. Your testing has finally come to an end. We hope you have enjoyed the vacation over the last few weeks. You will be very busy now should you choose to join us. You have all wondered who we are, and so we shall now tell you.

Cicada 3301 was pretty well known by now and was being connected to hacker groups, and this was addressed in that email.

We do not engage in illegal activity, nor do our members. If you are engaged in illegal activity, we ask that you cease any and all illegal activities or decline membership at this time. We will not ask questions if you decline. However, if you lie to us, we will find out.

But the big question was why? What does Cicada 3301 even do? We are much like a think tank in that our primary focus is on researching and developing techniques to aid the ideas we advocate. Liberty, privacy, security.

And if you choose to accept membership, we are happy to have you on board to help with future projects. So that was it. Cicada 3301 found a few more recruits and went dark. But the following January, people eagerly waited to see if Cicada would return. And they did not disappoint. After being inactive for a year, in January 2014, the Cicada Twitter account tweeted a link to a new image.

Hello. Epiphany is upon you. Your pilgrimage has begun. Enlightenment awaits. Good luck. 3301.

During the time Cicada was quiet, there were lots of fake puzzles floating around claiming to be from Cicada 3301, and they all turned out to be fakes. But running this new image through Outguess revealed a new message that proved to be authentic. Cicada 3301 was back, and they followed their familiar format. They embedded messages and images that could be extracted with Outguess. These images led to more clues on various web pages and the dark web.

And a new piece of music was also discovered. This one was called "Interconnectedness." Using some familiar techniques, as well as some new ones, Cicada solvers concluded that Cicada was focusing on a single document.

It's called the Liber Primus, or First Book. As more puzzles were solved, more pages of Liber Primus were uncovered. The book was written using the runes found in earlier puzzles. But the solution to every puzzle seemed to be a clue to yet another puzzle. People went back to the music file. They found more clues. From image files, they extracted more codes and more puzzles like magic squares and anagrams.

All of those were decoded to reveal strange poems, which were nothing more than more clues. "Liber Primus" is 59 pages and only a handful have been solved. And the pages that are solved are still mysterious. January 2015 came and went with nothing from Cicada. Some people speculated that Cicada had enough recruits for whatever it was they were doing. Others thought that Cicada would stay silent

until all of LibrePremis was solved, and they could be right. In January 2016, Cicada tweeted a link to a new image. Running the image throughout Guess proved it was authentic.

Hello? The path lies empty. Epiphany seeks the devoted. Liber Primus is the way. Its words are the map, their meaning is the road, and their numbers are the direction. Seek, and you will be found. Good luck. 3301. Beware false paths.

Many speculated that their numbers are the direction was the major clue, but still no progress was made. In 2017, a user stumbled across a message from Cicada in Google's cached pages that nobody had noticed. Beware false paths. Always verify PGP signature 3301.

And that was the last anyone heard from Cicada 3301. It's been a few years with no solution to Libra Primus and no further contact from Cicada. This was disappointing to a lot of people. After all this, over several years, we were still no closer to finding out who Cicada 3301 was or what they did. But Libra Primus was the third quest. The first two were solved. And the people who solved them? They started talking.

When that first image appeared on 4chan looking for highly intelligent individuals, the chase was on. The mysterious group known as 3301 presented clues and challenges that thousands of techies and puzzle solvers found impossible to resist. Each mystery became more complex. The clues that connected Julius Caesar and King Arthur to cryptography were genius and easy enough to solve that people became hooked.

The solutions that led to phone numbers and geographic coordinates made the search even more real. But over time, it became clear that 3301 was looking for a specific type of person. To solve Cicada, you needed knowledge of the concepts and the tools used in encryption. You had to have computer skills, understand operating systems, and be handy with programming. It also didn't hurt if you had expertise in Maya numerology and pre-Christian literature. Yeah, who doesn't?

But who was Cicada? A popular theory was that this was a recruiting effort for a government intelligence agency like CIA, NSA or MI6. There was plenty of precedent for that. During the Second World War, the top secret government code and cipher school used crossword puzzles printed in the Daily Telegraph to identify good candidates for Bletchley Park. Those recruits, along with Alan Turing, went on to solve the Enigma machine, which helped the Allies win the war.

NSA and CIA ran similar contests over the years. Companies like Google and Microsoft have also used cryptography and puzzles to recruit. But one of the early winners said Cicada was none of these.

After solving the final round of puzzles in 2013, he received an email with a username and password along with a site address on the dark web. The site had two parts: a message board and a chat room. The message board had various topics, including a welcome section and an area for Cicada's goals and current projects. The chat room had about 20 members. According to a couple of the winners, Cicada wanted to further the use of cryptography so more people would have access to internet privacy.

Cicada had some big goals, but in the short term, they wanted to recruit highly technical people to develop open source cryptography software. All that to find people to write free software? Yep.

And I think this was Cicada's big mistake. The recruits didn't want to write software. They wanted to solve puzzles. And when the puzzles stopped, the membership dwindled. There were spikes in membership when new challenges appeared, but it was the same story. The winners weren't interested in writing software. They weren't driven by ideology. They didn't care about politics. They just wanted to solve puzzles.

The same thing happens when NSA, CIA, GCHQ, and other intelligence organizations do recruitment drives. Many of the winners are offered positions in one of these agencies, and many of them refuse. They don't want to work in government. Yeah, they're too smart to work in government. Well, that might be part of it,

but really they just want to solve puzzles. Whenever you achieve a task, your brain rewards you with a hit of dopamine. This could mean finishing a workout, completing a school project, or figuring out an escape room. Achieve a goal, get some dopamine. Our brains love dopamine. It turns out that solving problems is one of the biggest

if not the biggest source of dopamine for the brain. Solving puzzles like those presented by Cicada reward us with dopamine while we're working on them. And when we actually solve one? Well, Cicada solvers describe that feeling as nothing less than exhilarating. Now, plenty of people are interested in politics and ideology, but not too many of them would describe their interest as exhilarating. Puzzles make us happy. When was the last time politics made you happy?

And although two of the goals of this channel are to educate and inspire, the primary goal is to entertain. In other words, the Y-Files is here to make you happy, P. So that's why I've included a cicada-type puzzle in this video. Think you can find it? Thank you so much for hanging out with us today. My name is AJ. That's Ecclefish. Coke is mirithosa napkin.

That's the Mayan word for a, hey, how you doing? This has been the Y-Files. If you had fun or learned anything, do us a favor, like, comment, subscribe, share. That stuff really helps the channel. And like most topics we cover here, today's was recommended by you. So if there's a story you'd like to see or learn more about, go to the Y-Files.com slash tips. And if you need more Y-Files in your life, check out the Y-Files Discord. It's free to join and there's thousands of people on there.

And special thanks to our patrons who made this episode possible. I couldn't do any of this without you, so from the bottom of my heart, thank you. Now, if you'd like to support the channel, consider becoming a member on Patreon. It's only three bucks a month, you get all kinds of perks, like early access to the videos with no commercials, and you get your name in the credits. Check those out. If you're not much of a joiner, maybe buy something from the Y-Files store. Get a great hecklefish t-shirt and coffee mug, or one of these hecklefish plushie-talking...

fish toys that's gonna do it until next time be safe be kind and know that you are appreciated you

so