So I’ve gone through the forums and made some note of interesting posts relating to Storm’s “Someone is already close” comment and JohnNotJohn’s comment here.
For Storm’s comment, I was looking prior to May 22, 2013 (when the comment was made) and a year prior for JohnNotJohn’s post (February 28, 2015).
Here are the posts prior to Storm’s comment that I found interesting:
quattro’s post–“level seven cases” and the number of capitalized letters in “ThEpIzZaIsaLiE”
faed’s post–takes the TEIZILE idea a bit further by suggesting that “[[ProxyhoSt@-84-9-I23-345.dslgb.com//closed.proxy.accepTEd//?OTR,3,4,?OTR:[INCOMING TRANSMISSION]ThEpIzZaIsaLiE…HALOS[Transmission Ends]]” also contains the word “SITE” in capital letters.
It’s important to note that the reference to the site may have just been to let us know to return to the site to get the HALOS.txt file.
And a post from about a year prior to JohnNotJohn’s post:
Storm’s post–"CSM Cyberdyne Systems Model (Terminator)
I like that one best, it seems to suit the theme.
It’s not random bytes btw, but its definitely designed to look that way.
I wouldn’t give you an unsolvable puzzle, just a really hard one. I even gave you a hint somewhere."
I was really intrigued by this one, because JohnNotJohn’s post said to look at the 80’s and 90’s references, and mentioned looking about a year prior. This post by Storm was on April 6th of 2014, about a year prior to JohnNotJohn’s February 28, 2015 post. Also, where is this hint he’s talking about? Is it possible that it is in the comment itself? He says that it’s “designed to look that way,” as if the appearance of random bits is actually a mask. If that is the case, then this isn’t about decryption, but rather about conversion and shifting–or some other measures a bit simpler than decryption. JohnNotJohn’s post might lead us to that answer, because he mentions acronyms, algorithms, anagrams, analyzing static, and large amounts of numbers in regards to the 80’s and 90’s eras.
In regards to the Terminator reference, this may also be our most important IRC clue yet:
“[[Proxyhost@-84-9-123-155.dslgb.com//closed.proxy.accepted//?OTR,1,3,?OTR:[INCOMING TRANSMISSION UNKNOWN SOURCE]LEAK SOURCE DETECTED. TRIANGULATING…MIX CASCADE
HOP DETECTED…ATTEMPTING TIMING ATTACK…[TERMINATED] CANNOT CONNECT TO HOST…ATTEMPTING CONNECT TO USER H… SENDING DATA. SECURITY LEVEL 7 ALPHA.[OTR//3.0]THISISAMESSAGELEFTFORDRHORNJUSTTOREMINDYOUINCASEOFEMERGENCIESTHATTHEPASSWORDTOTHEHALOSFILESISBENALOHPAILLIERIHAVEPROGRAMMEDHALOSTOSENDINLEVELSEVENCASESYOUSHOULDBRINGPIZZAS[/][End Transmission]|¬[Terminal.] ~~ [Transmission Ends]]”
Here we see the word “TERMINATED”, the term “LEVEL 7” twice, the word “TERMINAL” and a possible reference to cascade ciphers with “MIX CASCADE HOP DETECTED.”
I’m glad to see we are getting back to the basics here, and I really think it’s important we stick to what we know–versus what is possible. With so much information, we really need to concentrate on the things that have been directly fed to us–or at least hinted at–by the ARG’s creator.
EDIT: Something that “MIX CASCADE” may refer to is this: Protocols for Anonymity
The part about “ATTEMPTING TIMING ATTACK” seems to support this, as the presentation notes that the mixes “[n]eed traffic padding and buffering to prevent timing correlation attacks.”
Both of these suggest that whomever sent this message is trying extremely hard to remain undetected.