[ARG] The Pizza Code Mystery

rm249 · August 11, 2020, 9:31am

asm:

Oh, before I forget it, I’ve still not managed to connect to it, but terminal.blackmesasource.com has an open SSH port.

EDIT: I can’t even access the terminal page anymore (though it seems it’s still up) so that might be the reason.

Anyway, here’s the nmap report:

[code]Starting Nmap 6.01 ( https://nmap.org ) at 2012-09-20 15:59 BRT
NSE: Loaded 93 scripts for scanning.
NSE: Script Pre-scanning.
Initiating Parallel DNS resolution of 1 host. at 15:59
Completed Parallel DNS resolution of 1 host. at 15:59, 0.14s elapsed
Initiating SYN Stealth Scan at 15:59
Scanning terminal.blackmesasource.com (64.15.147.56) [1000 ports]
Discovered open port 80/tcp on 64.15.147.56
Discovered open port 37/tcp on 64.15.147.56
Completed SYN Stealth Scan at 15:59, 7.84s elapsed (1000 total ports)
Initiating Service scan at 15:59
Scanning 2 services on terminal.blackmesasource.com (64.15.147.56)
Completed Service scan at 15:59, 6.34s elapsed (2 services on 1 host)
Initiating OS detection (try #1) against terminal.blackmesasource.com (64.15.147.56)
Retrying OS detection (try #2) against terminal.blackmesasource.com (64.15.147.56)
Initiating Traceroute at 15:59
Completed Traceroute at 15:59, 6.23s elapsed
Initiating Parallel DNS resolution of 11 hosts. at 15:59
Completed Parallel DNS resolution of 11 hosts. at 15:59, 8.89s elapsed
NSE: Script scanning 64.15.147.56.
Initiating NSE at 15:59
NSE Timing: About 50.00% done; ETC: 16:00 (0:00:31 remaining)
Completed NSE at 16:02, 144.42s elapsed
Nmap scan report for terminal.blackmesasource.com (64.15.147.56)
Host is up (0.17s latency).
rDNS record for 64.15.147.56: gman.blackmesasource.com
Not shown: 986 filtered ports
PORT STATE SERVICE VERSION
20/tcp closed ftp-data
21/tcp closed ftp
22/tcp closed ssh
25/tcp closed smtp
37/tcp open ssh OpenSSH 5.3 (protocol 2.0)
53/tcp closed domain
80/tcp open http nginx
110/tcp closed pop3
143/tcp closed imap
443/tcp closed https
465/tcp closed smtps
587/tcp closed submission
993/tcp closed imaps
995/tcp closed pop3s
Device type: general purpose|WAP|firewall
Running (JUST GUESSING): Linux 3.X|2.6.X|2.4.X (94%), FreeBSD 6.X (86%), Fortinet Linux 2.6.X (85%)
OS CPE: cpe:/o:linux:kernel:3 cpe:/o:linux:kernel:2.6.32 cpe:/o:freebsd:freebsd:6.2 cpe:/o:linux:kernel:2.4 cpe:/o:fortinet:linux:2.6
Aggressive OS guesses: Linux 3.0 (94%), Linux 2.6.32 - 2.6.35 (92%), Linux 2.6.32 - 2.6.38 (92%), Linux 2.6.38 (91%), Linux 2.6.39 (90%), Linux 2.6.18 (89%), Linux 2.6.34 (88%), Linux 2.6.32 - 2.6.33 (87%), Linux 2.6.9 - 2.6.27 (87%), Linux 2.6.35 (87%)
No exact OS matches for host (test conditions non-ideal).

NSE: Script Post-scanning.
Read data files from: /usr/local/bin/…/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 182.38 seconds
Raw packets sent: 2167 (100.162KB) | Rcvd: 61 (3.552KB)[/code]

EDIT2: https://webcache.googleusercontent.com/search?q=cache:https://terminal.blackmesasource.com/ currently gives:

Using username "bmesaroot". Error: Client IP address not found in \allow\ iptable for this location. Goodbye.

Ya… SSH is only used to manage the site/server, nothing ARG related at all. Attempting to login (and failing) will get you blocked by the firewall.

asm · November 25, 2018, 2:32am

Thank you!

Meaneh · November 25, 2018, 2:32am

Good enough for me. No more SSH for us. Back to work mortals!

Admittedly, our attempts to breakthrough the SSH were due mostly to lack of direction, lack of information and desperation. We’re getting nowhere fast tbfh.

Phlogiston · November 25, 2018, 2:32am

meh we got a new webpage to look at today at least

Kaysab · November 25, 2018, 2:32am

It looks like “the pizza is a lie” is in almost every level if not all of them. I found a pizza. a physical one in game. Doesn anyone know if there’s a pizza in every level too, or is it just the one? i’ll go look around for stuff now as i’m playing, but for now the video is up on youtube under the username Kaysab11

this was found by me messing with “bind v noclip” a couple of days ago, i didnt get round to recording it until recently

Wristwatch4 · August 11, 2020, 9:32am

THIS POST IS TO SUM UP EVERYTHING WE HAVE FOUND OUT IN THE PAST 12 HOURS, TO MAKE IT EASIER FOR UNHINGEDMOUSE0 TO UPDATE THE FIRST POST.

Phlogiston:

I’m just having a little recap really - basically the three codes we’ve found so far have all been 4 digits and encrypted in different forms:

Code A - pigpen encryption stored as a plain texture file
Code B - composite picture stored as a model with various skins
Code C - image file encoded as a sound file stored as an mp3

It’s unlikely that the final code will be in plain sight or will have reused one of the previous methods… that’s my thoughts anyways

EDIT: The thought I’m left with is… maybe an audio file encrypted into a picture? No idea how to check for these things but I have heard of them in previous ARGs - I guess if it were something like this there’d be a clue of some sort to lead us to the right image file as there was with the audio file previously - haven’t noticed anything so far so might be a dead end

EDIT EDIT: Possibly something hidden on the webpage rather than in game? Not sure if it’s been mentioned before but Horn is Stormseeker’s surname IRL, so possibly he’ll have given us an out of game clue somehow…

clutching at straws here

EDIT^3 Then again everything so far has been available in-game…probably just the coffee talking started a new irc channel on quakenet #BMS-ARG if anyone wants to chat/brainstorm on there https://webchat.quakenet.org/

EDIT^4 Bizarre - might be someone messing with me/us, or could have been Stormseeker leading us to look more closely at a current clue:

irc:

[01:51] * Dr_Horn (webchat@host-84-9-123-89.dslgb.com) has joined channel #BMS-ARG
[01:51] hello Dr Horn…
[01:51] <Dr_Horn> The Pizza Is A LIE
[01:52] * Dr_Horn (webchat@host-84-9-123-89.dslgb.com) Quit (Quit: Page closed)

could be that when looked at upside down, the word lie! looks like 1317…or could be someone messing with me xD

Phlogiston:

Just got back from being afk and on myn irc was:

irc:

[03:40] <Watcher__|afk> UHJveHlob3N0QC04NC05LTEyMy0xNjQuZHNsZ2IuY29tLy9jbG 9zZWQucHJveHkuYWNjZXB0ZWQvLz9PVFIsMSwzLD9PVFI6W0kt LS1NSS1HIFRSLS1TTUktLS1PT－iAtIFVOLS0tV04gUyMjUkNFX SBPVFI6ficvLyBEci8vLyN+YCAgQi4uQW1pIH4jIyMgfiBOb3Q gIyN+YW1pLi4uIHtpbnRlcnJ1cHR9CgorKiYqJiMvLyMvLyBLT 0 4gICwsLW1pIEMtZGUuIERyIEgtLU4gI35+IERvbl9fIyMjIExF VCBISU0gX18gZmkjZC4uLi4udXMgLiB7RHIgV2VsIyN9fn4gW1 Rlcm1pbmFsLl0gfn4gW1RyYW5z bWlzc2lvbiBFbmRzXQ==
[03:41] <Watcher__|afk> UHJveHlob3N0QC04NC05LTEyMy0xNjQuZHNsZ2IuY29tLy9jbG 9zZWQucHJveHkuYWNjZXB0ZWQvLz9PVFIsMSwzLD9PVFI6W0kt LS1NSS1HIFRSLS1TTUktLS1PT－iAtIFVOLS0tV04gUyMjUkNFX SBPVFI6ficvLyBEci8vLyN+YCAgQi4uQW1pIH4jIyMgfiBOb3Q gIyN+YW1pLi4uIHtpbnRlcnJ1cHR9CgorKiYqJiMvLyMvLyBLT 0 4gICwsLW1pIEMtZGUuIERyIEgtLU4gI35+IERvbl9fIyMjIExF VCBISU0gX18gZmkjZC4uLi4udXMgLiB7RHIgV2VsIyN9fn4gW1 Rlcm1pbmFsLl0gfn4gW1RyYW5z bWlzc2lvbiBFbmRzXQ==
[03:41] <Watcher__|afk> UHJveHlob3N0QC04NC05LTEyMy0xNjQuZHNsZ2IuY29tLy9jbG 9zZWQucHJveHkuYWNjZXB0ZWQvLz9PVFIsMSwzLD9PVFI6W0kt LS1NSS1HIFRSLS1TTUktLS1PT－iAtIFVOLS0tV04gUyMjUkNFX SBPVFI6ficvLyBEci8vLyN+YCAgQi4uQW1pIH4jIyMgfiBOb3Q gIyN+YW1pLi4uIHtpbnRlcnJ1cHR9CgorKiYqJiMvLyMvLyBLT 0 4gICwsLW1pIEMtZGUuIERyIEgtLU4gI35+IERvbl9fIyMjIExF VCBISU0gX18gZmkjZC4uLi4udXMgLiB7RHIgV2VsIyN9fn4gW1 Rlcm1pbmFsLl0gfn4gW1RyYW5z bWlzc2lvbiBFbmRzXQ==
[03:41] * Watcher__|afk (webchat@host-84-9-123-164.dslgb.com) Quit (Quit: Page closed)

not sure if more trolling…if so, I hate you guys - same ip host as the Dr_Horn message from earlier, so possibly the same person

Meaneh:

UPDATE:

[code]Proxyhost@-84-9-123-164.dslgb.com//closed.proxy.accepted//?OTR,1,3,?OTR:[I—MI-G TR–SMI—ON - UN—WN S##RCE] OTR:~’// Dr///#~` B…Ami ~### ~ Not ##~ami… {interrupt}

+&&#//#// KON ,-mi C-de. Dr H–N #~~ Don__### LET HIM __ fi#d…us . {Dr Wel##}~~ [Terminal.] ~~ [Transmission Ends][/code]

This string of text led myself to believe that the konami code (look it up) was relevent in someway. I had a look on stormseekers website, and in the HTML there was a hidden konami code in there. Also posted this up on the IRC for people to ponder.
A IRC go’er named PanMieszko took it one step further and actually put it INTO stormseekers website: https://www.thestormseeker.com/

The page then gave us a redirect straight to this page:
https://terminal.blackmesasource.com/
Which as you can see, is on the same URL as BMS is normally.

The Page itself has the following message:

If you read it carefully, the out of place capital letters spell out ‘DR HORN’.

We’re being watched ladies and gentlemen. I think we’re getting close now.

bebbosvx:

I believe there is another typo in there, the message should be:

i have hidden four
codes abcd for access
to my site - do konami
code a
one zero zero one

this way it makes sense
also, if this is true, the whiteboard with the long sequence of 5 digit numbers may be not part of the arg

TheGameOfLife:

Does BMRFpass (BWRFpass?) mean anything? If you zoom in on a few of the malfunctioning keypads in QE (Like the one in Dr. Horn’s office, only broken) at the right time, you can catch a username.

Pyro:

Wait a minute.

I just a ran a whois, and it turns out that https://www.thestormseeker.com/ is registered to OnBoardError, not Stormseeker. Interesting. It seems that someone else might be in on this.

Pyro:

Guys, did you miss my post? Anthony Stone is in on this, which means that everything he worked on is now fair game as well.

It also explains all those complaints from Dr. Horn about Anthony stealing his pizzas.

Edit: Probably irrelevant, but Sisk is also one of the devs, it seems that he did some animation and voicework.

asm:

Oh, before I forget it, I’ve still not managed to connect to it, but terminal.blackmesasource.com has an open SSH port.

EDIT: I can’t even access the terminal page anymore (though it seems it’s still up) so that might be the reason.

Anyway, here’s the nmap report:

[code]Starting Nmap 6.01 ( https://nmap.org ) at 2012-09-20 15:59 BRT
NSE: Loaded 93 scripts for scanning.
NSE: Script Pre-scanning.
Initiating Parallel DNS resolution of 1 host. at 15:59
Completed Parallel DNS resolution of 1 host. at 15:59, 0.14s elapsed
Initiating SYN Stealth Scan at 15:59
Scanning terminal.blackmesasource.com (64.15.147.56) [1000 ports]
Discovered open port 80/tcp on 64.15.147.56
Discovered open port 37/tcp on 64.15.147.56
Completed SYN Stealth Scan at 15:59, 7.84s elapsed (1000 total ports)
Initiating Service scan at 15:59
Scanning 2 services on terminal.blackmesasource.com (64.15.147.56)
Completed Service scan at 15:59, 6.34s elapsed (2 services on 1 host)
Initiating OS detection (try #1) against terminal.blackmesasource.com (64.15.147.56)
Retrying OS detection (try #2) against terminal.blackmesasource.com (64.15.147.56)
Initiating Traceroute at 15:59
Completed Traceroute at 15:59, 6.23s elapsed
Initiating Parallel DNS resolution of 11 hosts. at 15:59
Completed Parallel DNS resolution of 11 hosts. at 15:59, 8.89s elapsed
NSE: Script scanning 64.15.147.56.
Initiating NSE at 15:59
NSE Timing: About 50.00% done; ETC: 16:00 (0:00:31 remaining)
Completed NSE at 16:02, 144.42s elapsed
Nmap scan report for terminal.blackmesasource.com (64.15.147.56)
Host is up (0.17s latency).
rDNS record for 64.15.147.56: gman.blackmesasource.com
Not shown: 986 filtered ports
PORT STATE SERVICE VERSION
20/tcp closed ftp-data
21/tcp closed ftp
22/tcp closed ssh
25/tcp closed smtp
37/tcp open ssh OpenSSH 5.3 (protocol 2.0)
53/tcp closed domain
80/tcp open http nginx
110/tcp closed pop3
143/tcp closed imap
443/tcp closed https
465/tcp closed smtps
587/tcp closed submission
993/tcp closed imaps
995/tcp closed pop3s
Device type: general purpose|WAP|firewall
Running (JUST GUESSING): Linux 3.X|2.6.X|2.4.X (94%), FreeBSD 6.X (86%), Fortinet Linux 2.6.X (85%)
OS CPE: cpe:/o:linux:kernel:3 cpe:/o:linux:kernel:2.6.32 cpe:/o:freebsd:freebsd:6.2 cpe:/o:linux:kernel:2.4 cpe:/o:fortinet:linux:2.6
Aggressive OS guesses: Linux 3.0 (94%), Linux 2.6.32 - 2.6.35 (92%), Linux 2.6.32 - 2.6.38 (92%), Linux 2.6.38 (91%), Linux 2.6.39 (90%), Linux 2.6.18 (89%), Linux 2.6.34 (88%), Linux 2.6.32 - 2.6.33 (87%), Linux 2.6.9 - 2.6.27 (87%), Linux 2.6.35 (87%)
No exact OS matches for host (test conditions non-ideal).

NSE: Script Post-scanning.
Read data files from: /usr/local/bin/…/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 182.38 seconds
Raw packets sent: 2167 (100.162KB) | Rcvd: 61 (3.552KB)[/code]

EDIT2: https://webcache.googleusercontent.com/search?q=cache:https://terminal.blackmesasource.com/ currently gives:

Using username "bmesaroot". Error: Client IP address not found in \allow\ iptable for this location. Goodbye.

rm249:

Ya… SSH is only used to manage the site/server, nothing ARG related at all. Attempting to login (and failing) will get you blocked by the firewall.

END OF SUMMARY

EDIT: were all on the IRC! https://webchat.quakenet.org/ with the chatroom #BMS-ARG

sersoft · November 25, 2018, 2:32am

lol they got so desperate they tried to hack the server to uncover the mystery

good work devs

UnhingedMouse0 · August 11, 2020, 9:32am

I believe there is also one by the controls in the main laser room.

IMAGE TRANSMISSION - UNKNOWN SOURCE
Dr BonAmi is Not ami its
KONami Code. Dr HORN
Don’t LET HIM find us. Dr Wel

Filled in the gaps best I could. - I feel like we are still missing something here…
Who is Dr Wel… who is HIM?

Meaneh:

UPDATE:

[code]Proxyhost@-84-9-123-164.dslgb.com//closed.proxy.accepted//?OTR,1,3,?OTR:[I—MI-G TR–SMI—ON - UN—WN S##RCE] OTR:~’// Dr///#~` B…Ami ~### ~ Not ##~ami… {interrupt}

+&&#//#// KON ,-mi C-de. Dr H–N #~~ Don__### LET HIM __ fi#d…us . {Dr Wel##}~~ [Terminal.] ~~ [Transmission Ends][/code]

This string of text led myself to believe that the konami code (look it up) was relevent in someway. I had a look on stormseekers website, and in the HTML there was a hidden konami code in there. Also posted this up on the IRC for people to ponder.
A IRC go’er named PanMieszko took it one step further and actually put it INTO stormseekers website: https://www.thestormseeker.com/

The page then gave us a redirect straight to this page:
https://terminal.blackmesasource.com/
Which as you can see, is on the same URL as BMS is normally.

The Page itself has the following message:

If you read it carefully, the out of place capital letters spell out ‘DR HORN’.

We’re being watched ladies and gentlemen. I think we’re getting close now.

You’re a freaking genius.

^This. Unless, the misspelling was intentional to bring attention to those letters later on… but it kinda obscures the message, so why do that? Idunno

I knew OBE knew about this from the start, I didn’t know how involved he was. Looks like rm249 knows as well… I’m guessing he might have set up the terminal.

From a chat while Hubi was livestreaming his playthrough:

[code]bms_stormseeker: they found the code OBE
» the ARG is ON
bms_rm249: xD
bms_onboarderror: wow storm
bms_stormseeker: they mistranslated it so far
bms_stormseeker: yar
» its the easiest cipher there
bms_onboarderror: now they need to find the lase?
bms_stormseeker: and they still dont get it
» LOL
bms_onboarderror: laser lab oone*
bms_stormseeker: shh

bms_stormseeker: hmm
» tannocks consoles dont seem to be vry visible
bms_stormseeker: should have let me design those
» obe
bms_onboarderror: yes we can patch
bms_stormseeker: yar might have to
» ive not noticed many people not get it tho[/code]

First, this pretty much confirms the long code is relevant, thats what originally tipped me to go track it down.

Second, the part after the “shh” I didn’t think was originally relevant. (They may have gone back to talking about what was happening in-game at that moment, I forget) but might need to go figure out what consoles they are talking about. (tannock is a prop modeler) Could it be the console thing that’s in the image at the top of this post?

Edit: Thanks Wristwatch4, I just finished reading all the original posts, but the summary will be helpful, and an updated first post will be coming! lol

Wristwatch4 · November 25, 2018, 2:32am

I believe it is Dr. Welsh, who along with Horn, Foreman and Stone, are the 4 lead scientists in the QE area.

OnboardError · November 25, 2018, 2:32am

UnhingedMouse0:

I believe there is also one by the controls in the main laser room.

IMAGE TRANSMISSION - UNKNOWN SOURCE
Dr BonAmi is Not ami its
KONami Code. Dr HORN
Don’t LET HIM find us. Dr Wel

Filled in the gaps best I could. - I feel like we are still missing something here…
Who is Dr Wel… who is HIM?

You’re a freaking genius.

^This. Unless, the misspelling was intentional to bring attention to those letters later on… but it kinda obscures the message, so why do that? Idunno

I knew OBE knew about this from the start, I didn’t know how involved he was. Looks like rm249 knows as well… I’m guessing he might have set up the terminal.

From a chat while Hubi was livestreaming his playthrough:

[code]bms_stormseeker: they found the code OBE
» the ARG is ON
bms_rm249: xD
bms_onboarderror: wow storm
bms_stormseeker: they mistranslated it so far
bms_stormseeker: yar
» its the easiest cipher there
bms_onboarderror: now they need to find the lase?
bms_stormseeker: and they still dont get it
» LOL
bms_onboarderror: laser lab oone*
bms_stormseeker: shh

bms_stormseeker: hmm
» tannocks consoles dont seem to be vry visible
bms_stormseeker: should have let me design those
» obe
bms_onboarderror: yes we can patch
bms_stormseeker: yar might have to
» ive not noticed many people not get it tho[/code]

First, this pretty much confirms the long code is relevant, thats what originally tipped me to go track it down.

Second, the part after the “shh” I didn’t think was originally relevant. (They may have gone back to talking about what was happening in-game at that moment, I forget) but might need to go figure out what consoles they are talking about. (tannock is a prop modeler) Could it be the console thing that’s in the image at the top of this post?

Edit: Thanks Wristwatch4, I just finished reading all the original posts, but the summary will be helpful, and an updated first post will be coming! lol

Where did you nabb that from?

UnhingedMouse0 · November 25, 2018, 2:32am

They’re all in on it then? :fffuuu:

Actually, that wouldn’t surprise me.

Meaneh · November 25, 2018, 2:32am

We all know you have spies in our camp, whos to say we don’t have spies in yours?

OnboardError · November 25, 2018, 2:32am

yea? well did you find the pizza in office complex yet? no… see ya…

UnhingedMouse0 · November 25, 2018, 2:32am

Trying to mislead us now? …or maybe you’re not. I CANT TELL! AHHHHH

OnboardError · November 25, 2018, 2:32am

My twitch tv thing i guess?

Xappy · November 25, 2018, 2:32am

Hm… a bluff or srs?

Phlogiston · November 25, 2018, 2:32am

:fffuuu:

UnhingedMouse0 · November 25, 2018, 2:32am

Close, I actually said it was from when Hubi was livestreaming, you even quoted it in your post. haha

Meaneh · November 25, 2018, 2:32am

I call shenanigans on pizza in office complex! The pizza is a lie! You lie! Don’t confuse more than we already are!

dky.tehkingd.u · November 25, 2018, 2:32am

HEHEHEH we got OBE to break his vow of silence. :zip: