Cipher analysis shows it may be a running key or digrafid
“MIX CASCADE” = Cascade cipher? That could hurt . . . .
Holy shit, we are getting really efficient at decoding these.
Hahaha I think it’s probably partially related to the fact we spent weeks looking at the SECOM cipher from so many angles that we’ve built up a repertoire of "could-be"s, and now we have multiple modes of attack memorized.
Histogram Analysis of <IRClue.txt>. File size 206 bytes.
Descending sorted on frequency.
Sorry for all the edits, couldn’t get the text formatted properly.
So, I’ve updated the blog a bit to reflect this new cipher. I’ve also added a post that shows the top ten ciphers that potentially match this one.
I sincerely hope this cipher isn’t a mix of two cascade ciphers (or even one, for that matter), but I know Storm wouldn’t give us an impossible code and expect us to solve it. That said, I’m leaning more towards it being a mix between two complex ciphers.
EDIT:
“Security Level 7 Alpha” might be a reference to Star Trek security levels: Command codes chart
Also, after a little more careful analysis of the new IRC code, I’m thinking we are going to need further information at some point, perhaps from the BMRF.US site or a related site. I say that because if I’m correct, the cipher is related to a One-time pad / Vigenere cipher, which requires a keyword or key phrase input to be able to solve. Unlike the SECOM cipher where we had one, we don’t have one that is as obvious with the new IRC clues. That said, I expect we will hear more soon about this cipher, either from Storm or from someone discovering a newly-created lead.
I’m pretty sure Gunsrequiem is right about that it is a One-Time-Pad cipher. After wasting some time I managed to decode the last bit of the message: using a key of: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaamajorityofthepizzas (the a’s in the beginning are just an offset) - and you get decoded “YOUS HOULD BRING PEOPL E”. There is of course a lot more to decode, but I thought I’d share my progress.
Yes I was trying to sove the message using https://sharkysoft.com/misc/vigenere/ and I got up to ING PEOPLE
using key the pizza.
I dont think majorityofthepizzas is correct, but bring people does make sense for the code of yofthepizzas may be correct. The problem is, we can make it say pretty much whatever we want unless we get the key.
Well, if both the key and plaintext make sense, we may be pretty sure that it is correct. Coincidence in such a long text is almost impossible.
Thanks to the work of akrasuski1 and the remark of bobsayshilol that it’s probably majority of people, not majority of pizzas I discovered the whole key.
It’s a disputed quote by Giordano Bruno
“It is proof of a base and low mind for one to wish to think with the masses or majority, merely because the majority is the majority. Truth does not change because it is, or is not, believed by a majority of the people.”
And the decoded message is
THISISAMESSAGELEFTFORDRHORNJUSTTOREMINDYOUINCASEOFEMERGENCIESTHATTHEPASSWORDTOTHEHALOSFILESISBENALOHPAILLIERIHAVEPROGRAMMEDHALOSTOSENDINLEVELSEVENCASESYOUSHOULDBRINGPIZZAS
This is a message left for Dr. Horn. Just to remind you in case of emergencies that the password to the HALOS files is BENALOHPAILLIER. I have programmed HALOS to send in level seven cases. You should bring pizzas.
So the password is BENALOHPAILLIER. Bring on the halos files!
By the way, Benaloh and Paillier refer to some kinds of partially homomorphic cryptosystems. https://en.wikipedia.org/wiki/Homomorphic_encryption#Partially_homomorphic_cryptosystems
So the login to the bmrf site is halos, the password is benalohpaillier. The question is where to put it.
Nice work, folks!
So, now we have to find out how to access the bmrf site . . . .
This is really random but I found something interesting in the BM SDK:
point_bonusmaps_accessor
An entity that relays bonus maps changes.
Anyone know what this does or where it’s used in the mod?
IRC clue #6
[05:10] == Watcher_ [webchat@host-84-9-122-98.dslgb.com] has joined #BMS-ARG
[05:11] <Watcher_> W1tQcm94eWhvU3RALTg0LTktSTIzLTM0NS5kc2xnYi5jb20vL2Nsb3NlZC5wcm94eS5hY2NlcFRFZC8vP09UUiwzLDQsP09UUjpbSU5DT01JTkcgVFJBTlNNSVNTSU9OXVRoRXBJelphSXNhTGlFLi4uSEFMT1NbVHJhbnNtaXNzaW9uIEVuZHNdXQ==
[05:11] == Watcher_ [webchat@host-84-9-122-98.dslgb.com] has quit [Quit: Page closed]
base64
[[ProxyhoSt@-84-9-I23-345.dslgb.com//closed.proxy.accepTEd//?OTR,3,4,?OTR:[INCOMING TRANSMISSION]ThEpIzZaIsaLiE...HALOS[Transmission Ends]]It’s probably just a reference to the new file which has appeared on thestormseeker.com/thepizzaisalie
https://thestormseeker.com/thepizzaisalie/HALOS.txt
<~$<p_2Ec62JBQ%s65V4rP/NGC;1,CL<1c6mrF)5Ju/n8g:0/$gODf]K#/oYiLG^1oM@q0(hF
Ceu900`63;CjUT1b:je<)Pb]8PVWK9hA)M+B26):/akY;c?7`:*;nt5uU]R7S-$:+B)'9;F<l
Y;cQ.V771#s5u'^>=]7mj+>"^878?-98P`>b/g+(a<(.p*7Rg'C:.6cf/hSb/+:9_R/pgE8Bl
.:!Gp$$sEcu#7F!+8%ATDU*@:Wq[I4d-)+B;?/;BS7m<(U+V<(Tk\+AtX*<Cp(W6nU)E+Ab@&
;aX>K73G/s:fUI;7Sco);b9qW+@/@o8QJ,V8P`)(;FOG_8Q%uF/hSa`;ajY.7Sco)7S-?@9H[
;';cFl95u^fP;GJhs/hRJs:-hQV;b9n16VgEQ9LVoL5!D.Q>=2(M;c?7W8OZ#i8PV`N;GBGV8
P`)(9LVuN9HZ<#>>J3r0/#.70O5#p1GWDn0Jd,n2.C!)A2Z>'2`G5%1h/6sAn*hU3A<?J1Gh'
#0f(Om2e+^%@U_;PAnGU.1M&6q1,^jE2`EZN1cIEM1LsuN0kN=!@q7DN3&5&*0k3'K1,_(#2)
I1!@UihXA79((1,^jE0ed,pAS# :) AN2VYA2?#O2e+d*0f(O?0KEWQ1bq$EAR[JO1c&Ys0f:e'
0JkUu3FcYZ1-%7'3FZT42`!HQAMc2'0KD*OAn<kV1,(Lp@5)5'1b^[D3+=[P2)Jo&A7T1.3B&
g-@5'NM2`*NS1c],%@5]ku3Ak5*Ai;G!@PB`$2*!BIA7[GL2)Af'@:<Y%3&kD)2.g;XA2lG#@
qK:40f([D0k<1P0K:jK3+apU3&i]M11<-tAn5L-0JYUBA2Z2T@q9(+An<o41cAcR3A=r#0k3(
N3&!7"1bg^C1hAI!@ :D 5P@lZG,2DSht2E5/"@kflO0KD-R0Od!t3&+hq0P"TN3AEC#2E,5Z1g
r-nAi2S/@PDCK@Q%aR3&*EJ1Li@Q3AiTP@qB401H@0H1hJR!2)[0u@6$)S1hL;X2)/VrAMQ(t
@q7PYAi2;R2E<WP0f_3Q2_d*H@5h[N2.9p&A2dsS0JG=?3AN?D0f1U@0OZsrAhc4uAi;PW@q%
6(0f(gH2D\c#AN;G)@5BiN@5p/$An!MS3&!4%@lZJ(0k2mt@lRsW3A<?MAN)V01GE5o0K(dF2
I\Eu@l[sU1-&f!2IeLPAMR[N@V%AUAi2P.@5Bi'An>F11GNKO1gsiK1,WPr0fV!L@qI\\AMQ8
#An!MS0f(UG2_\_q2D[6G3&EQN@5p8&3&!'uA7RSXAi2D'3B1M+AMmpS0K(jH2J+j+2Dno$Ai
F<V1,:^tARRE+@50Jn0P4m*2DA`$2)$sG2)7!C@l?>'2E<WS3&>)T@PTZL2J-E1AS,C\3&P,'
3B8fS1cR0F2ISHu@Pq['>;'8d7;cWY<,uDbF)>W4F(oQ1?$sMj><tSO;H-4g74qjgIXWDD<,u
DbF)>W4F(oQ1+@U0YF'W&~>
EDIT: some characters were missing for some reason
Not a cipher?
that looks like what happens when you turn a image file into a word file… of course all that stuff looks like that to e.
The contents in HALOS.txt is encoded in ascii85. Decoder: Online or C.
Decoded text:
[[Proxyhost@-84-9-123-345.dslgb.com//closed.proxy.accepted//?OTR,3,4,?OTR:[INCOMING TRANSMISSION CLASSIFIED SOURCE]SUBJECT ANALYSIS - TENACIOUS. SITE OFFLINE......
...{Primary Servers Overloaded}... USER ACTIVATION REQUIRED... PASSCODE INPUT FOR SITE ACTIVATION REQUIRED...
SET FOR FINAL TEST PATTERN....
ANALYSIS COMPLETE>>> [CLASSIFIED INFORMATION LEVEL 8][OTR//4.0]
b32b003a35badd66577c24c14fc919064346d131a7c54bb82ffe03e022615777247923dc21f62cd4182e91c3b267b545abcaedaf0261510d4eea1e87cd33c7c77131309cc4280eb4243d1154f044f9cf6296d9bff7397e4390987fe63203da0de40278b3...
[/][End Transmission]|¬[ABORTIVE.] ~~ [Transmission Ends]]
Those "OTR"s in the message refer to off-the-record messaging. No idea whether it is relevent.
deFRAGer posted another histogram analysis for HALOS.txt - https://pastebin.com/97w2qwVt
Only ASCII characters v w y z { | } are missing from the code. Additionally, “~” only appear twice, at the beginning and at the end. These characters are ASCII code 118 to 126, so them missing by chance is low.
Looks like a good point of attack. Maybe we need to rotate the code first?
Edit 1
Long strings that appeared twice:
<,uDbF)>W4F(oQ1
v8p`)(
7Sco)
1,^je
An!MS
0f(o
@5bi
;c?7
EDIT 2
Mathrunner dropped by and note that HALOS.txt is encoded using ASCII85. Mystery solved here is the decoded text: https://paste.kde.org/598874/28447813
Solution to IRC Clue #6
[code]
[[Proxyhost@-84-9-123-345.dslgb.com//closed.proxy.accepted//?OTR,3,4,?OTR:[INCOMING TRANSMISSION CLASSIFIED SOURCE]SUBJECT ANALYSIS - TENACIOUS. SITE OFFLINE…
…{Primary Servers Overloaded}… USER ACTIVATION REQUIRED… PASSCODE INPUT FOR SITE ACTIVATION REQUIRED…
SET FOR FINAL TEST PATTERN…
ANALYSIS COMPLETE>>> [CLASSIFIED INFORMATION LEVEL 8][OTR//4.0]
b32b003a35badd66577c24c14fc919064346d131a7c54bb82ffe03e022615777247923dc21f62cd4182e91c3b267b545abcaedaf0261510d4eea1e87cd33c7c77131309cc4280eb4243d1154f044f9cf6296d9bff7397e4390987fe63203da0de40278b3…
[/][End Transmission]|¬[ABORTIVE.] ~~ [Transmission Ends]] [/code]
The inner code:
b32b003a35badd66577c24c14fc919064346d131a7c54bb82ffe03e022615777247923dc21f62cd4182e91c3b267b545abcaedaf0261510d4eea1e87cd33c7c77131309cc4280eb4243d1154f044f9cf6296d9bff7397e4390987fe63203da0de40278b3...
752 char HEX
Holy crap. I go away for a little while to finish my degree and I come back to this?! You guys are frickin sweet. Suppose I should start lending what help I can again 
OTR 4.0 might refer to this: https://www.cypherpunks.ca/otr/
Yes, apparently it is, as OTR seems to use long HEX keys.