Another defcon has come and gone. It’s two weeks later and I finally feel like I’m starting to be halfway normal again. For the second year evilpacket and I competed in the LosT@con Mystery Challenge.In this series of posts we’ll go over the Mystery Challenge in detail, from registration right through to the end

Registration

So this year’s registration started off with a post from LosT on his ten-five-seven.org site on June 1st.. The post included a picture by an artist named eddie the y3t1. evilpacket and I started looking at the image, and quickly concluded that it was not just an image. Embedded in the image was a .rar archive containing a single text file, named DeadBeef. This file contained a quote from Willy Wonka, and a block of ciphertext. We attacked the ciphertext several ways, but wound up discovering that it was simple ROT13. LosT left us a clue to this, as the last word in the Willy Wonka quote was “rotten”. Once we deciphered the block, we had instructions for where to send an email to register. A few minutes later we were happy to see Team Psychoholics added as the second successful registration.

Over the course of the next several weeks we watched as other teams were given some clues, and some red herrings. At some point he mentioned that people should hang out in #mysterychallenge on UnderNet, so we started doing that. We obsessed about whether or not we were actually registered, due to some comments by LosT. Eventually, we wound up meeting some really cool people, in the forms of chaoskitty, krux, and PunkAB. Chaoskitty and krux were still trying to get registered when we met, and they seemed like cool people. Chaoskitty managed to figure out the registration just before the deadline and added Team Halibut to the list of registered teams. PunkAB was also still working on registration, having come into the game a bit late. He also managed to figure out the puzzle right before the deadline, sliding in as an alternate. After getting to know these folks evilpacket and I decided to invite them to join our team, since we only had three people, and they were teams of 2 and 1, respectively. We had previously invited an employee of one of our clients to help, as this was going to be his first defcon, so gunslingor was along for the ride, too. After all was said and done we had a team of 6 people, with very diverse skill sets, ranging from instrumentation and controls engineering to system administration to hardware hacking to consumption of large quantities of alcohol (that was mostly my job…)

For the next several weeks we hung out in the IRC channel and got to know our new teammates better, and trying to outthink LosT. Every hint he posted was deconstructed, every comment disassembled. Eddie the y3t1 posted the phrase “n0t 4ll m4gn3t5 4ttr4ct” (this is “leetspeak” for “not all magnets attract”). A google search for this phrase turned up exactly one other webpage, which just happened to be a picture on Eddie the y3t1′s deviantart page. This page contained two binary strings which had several interesting characteristics. PunkAB spent MANY hours trying to decode the binary strings, and we finally decided that we had stumbled on this clue early and we shelved it for later. LosT posted a clip from the film Primer. This led us to find the movie, rent it, and watch it. Good movie, incidentally. After watching the movie evilpacket decided that in order to win the Mystery Challenge this year we were going to have to solve time travel. Many other leads were followed and discarded as dead ends, or filed away for later use.

Arrival

We arrived in Las Vegas Thursday so we could register early and make sure we got the cool badges. We met up with our new teammates and started talking about the challenge. As soon as we registered and started looking at the defcon program we found a few things which stood out. The first was on page 9, it was a small picture:

Image from page 9 of the defcon program

The text reads:

“Not all who wander are LosT

When you look into the eyE

gray skies seem clear

You may find truth when you begin to question

what you base your beliefs ON

OFten we defeat ourselves”

Even though the contest hadn’t yet started, we suspected this might have something to do with the challenge. Our first clue was that the guy in two of the pictures is LosT… IT turns out that this design is something called “gray code“. A couple people started working on this, trying to figure out what it might mean. In the meantime, we also had another clue. On page 25, we found this image:

Image from page 25 of the defcon program (click for larger version)

The first thing we tried with this was a frequency analysis, and it sure looked like English to us, but as with a lot of things in the Mystery challenge we were over-thinking it, and spent a LOT of time trying different things before we finally deciphered it. At this point the contest still hadn’t started, so we all decided to turn in early and get lots of rest before the official start of the Challenge.

Stay tuned for part two, where the contest starts, and we all lose a little piece of ourselves…