Cicada 3301 — The Internet Mystery

Soumyajit Dutta
Feb 9 · 11 min read

There’s no shortage of mysterious puzzles on the Internet. Most of the time, codebreakers both amateur and professional are able to work out the meaning of the puzzle and trace it back to its origins. But for one puzzle, put out into the online world by a group or organization calling themselves Cicada 3301, the mystery has yet to come to a satisfying conclusion or maybe it never will.

The most elaborate and mysterious puzzle of the internet age. — The Washington Post

What is a Cicada ?

Cicadas are insects, best known for the songs sung by most, but not all. Once the cicada hatches from the egg it will begin to feed on the tree fluids. At this point, it looks like a termite or small white ant. Once the young cicada is ready, it crawls from the groove and falls to the ground where it will dig until it finds roots to feed on. It will typically start with smaller grass roots and work its way up to the roots of its host tree. The cicada will stay underground from 2 to 17 years depending on the species. Cicadas are active underground, tunneling and feeding, and not sleeping or hibernating as commonly thought.

After the long 2 to 17 years, cicadas emerge from the ground as nymphs. Nymphs climb the nearest available tree, and begin to shed their nymph exoskeleton. Free of their old skin, their wings will inflate with fluid and their adult skin will harden.


Now why did I give you the idea of Cicada and whats my motive behind it. So it’s kind of a rhetorical theory but its upto you , whether you want to accept it or not. Few pointers here

  1. Cicadas are insects, best known for the songs sung by most
  2. it will begin to feed on the tree fluids
  3. smaller grass roots and work its way up to the roots
  4. will stay underground from 2 to 17 years
  5. Cicadas are active underground, tunneling and feeding, and not sleeping or hibernating as commonly thought
  6. cicadas emerge from the ground as nymphs
  7. Cicadas come out in summer to mate(increase in population) and take control of trees

Now think for a minute about the above topics and maybe. I tell again maybe you will get a bit closer to the though process behind this.

What’s Cicada 3301?

It is no secret that Western intelligence agencies are actively trying to recruit agents via the Internet. In this case, the most important thing is to filter out a bunch of slag and find really worthy candidates. To do this, often conduct online competitions, offering candidates to solve some puzzle. The next competition started a division of the us Navy, which yesterday published an interesting puzzle on [only registered can see it. ]

The challenge, called Project Architeuthis like a puzzle, which offered a group of [Only registered can see it. ], also held competitions on the Internet for an unknown purpose.

The first round of selection of Cicada 3301 with crypto-puzzles began on January 5, 2012 and ended with the fact that several winners were selected, who were given individual tasks and forbidden to tell the public about them. The community was left in disbelief.

The second round of the competition began on January 4, 2013-also quite unexpectedly. A mysterious organization has published an announcement that again begins recruiting. Everything happened according to the same scenario and also ended with the selection of winners with the distribution of individual tasks. Again, the public has not received an answer, who is behind this activity.

The US Navy cryptographic contest is similar to Cicada 3301 because the puzzles are also very complex, but the award to the winner is not announced. It is logical to assume that the winners will be offered a job in the Navy. But this is just an assumption, because this is not officially declared.

The Cicada 3301 Timeline Part 1

Before diving into the details, let me clear what it’s on the very surface level. It’s a puzzle which is posted on the Internet with the intentions of recruiting “highly intelligent individuals”.

Solving which supposedly gets you recruited to the NSA, MI6, Hacker groups and the speculations go on and on; although no official prize has ever been announced.

The Puzzle is centred around Steganography, Cryptography and Data security. In laymen’s terms- computer stuff. But hey, the Cicada 3301 2017 isn’t limited just to the digital sphere, rather the clues to the solution are actually hidden in the real world! (We will explain in detail in the later sections).

It’s one of the creepiest mysteries existing on the Internet today; that’s so because no one knows who’s behind the puzzles, or what rewards solving the Cicada 3301 2017 puzzle actually bestows upon one.

It all started on January 4th, 2012. An elaborate puzzle appeared on message boards and forums which read:

This image when opened using a text editor gives out a Caesar cipher string of semi-readable text, which when deciphered leads to a Image URI

Someone surmised that the use of the words “out” and “guess” suggested that the duck image should be run through another text editor named OutGuess. Sure enough, running the image through OutGuess revealed yet another URL.

This image when passed through Outguess:


Here is a book code.  To find the book, and more information, go to http://www.reddit.com/r/a2e7j6ic78h0j/

1:20, 2:3, 3:5, 4:20, 5:5, 6:53, 7:1, 8:8, 9:2, 10:4, 11:8, 12:4, 13:13, 14:4, 15:8, 16:4, 17:5, 18:14, 19:7, 20:31, 21:12, 22:36, 23:2, 24:3, 25:5, 26:65, 27:5, 28:1, 29:2, 30:18, 31:32, 32:10, 33:3, 34:25, 35:10, 36:7, 37:20, 38:10, 39:32, 40:4, 41:40, 42:11, 43:9, 44:13, 45:6, 46:3, 47:5, 48:43, 49:17, 50:13, 51:4, 52:2, 53:18, 54:4, 55:6, 56:4, 57:24, 58:64, 59:5, 60:37, 61:60, 62:12, 63:6, 64:8, 65:5, 66:18, 67:45, 68:10, 69:2, 70:17, 71:9, 72:20, 73:2, 74:34, 75:13, 76:21

Good luck.

3301

Subreddit

That link led to a subreddit containing Mayan numerals, a mishmash of letters, and two images that were labeled “WELCOME” and “PROBLEMS.”

Each one contained an OutGuess message. Welcome’s was this:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- From here on out, we will cryptographically sign all messages with this key.

It is available on the mit keyservers. Key ID 7A35090F, as posted in a2e7j6ic78h0j.

Patience is a virtue.

Good luck.

3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJPBRz7AAoJEBgfAeV6NQkP1UIQALFcO8DyZkecTK5pAIcGez7k
ewjGBoCfjfO2NlRROuQm5CteXiH3Te5G+5ebsdRmGWVcah8QzN4UjxpKcTQRPB9e
/ehVI5BiBJq8GlOnaSRZpzsYobwKH6Jy6haAr3kPFK1lOXXyHSiNnQbydGw9BFRI
fSr//DY86BUILE8sGJR6FA8Vzjiifcv6mmXkk3ICrT8z0qY7m/wFOYjgiSohvYpg
x5biG6TBwxfmXQOaITdO5rO8+4mtLnP//qN7E9zjTYj4Z4gBhdf6hPSuOqjh1s+6
/C6IehRChpx8gwpdhIlNf1coz/ZiggPiqdj75Tyqg88lEr66fVVB2d7PGObSyYSp
HJl8llrt8Gnk1UaZUS6/eCjnBniV/BLfZPVD2VFKH2Vvvty8sL+S8hCxsuLCjydh
skpshcjMVV9xPIEYzwSEaqBq0ZMdNFEPxJzC0XISlWSfxROm85r3NYvbrx9lwVbP
mUpLKFn8ZcMbf7UX18frgOtujmqqUvDQ2dQhmCUywPdtsKHFLc1xIqdrnRWUS3CD
eejUzGYDB5lSflujTjLPgGvtlCBW5ap00cfIHUZPOzmJWoEzgFgdNc9iIkcUUlke
e2WbYwCCuwSlLsdQRMA//PJN+a1h2ZMSzzMbZsr/YXQDUWvEaYI8MckmXEkZmDoA
RL0xkbHEFVGBmoMPVzeC
=fRcg
-----END PGP SIGNATURE-----

and Problems’ was this:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

The key has always been right in front of your eyes.

This isn't the quest for the Holy Grail. Stop making
it more difficult than it is.

Good luck.

3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJPCBl3AAoJEBgfAeV6NQkPo6EQAKghp7ZKYxmsYM96iNQu5GZV
fbjUHsEL164ZLctGkgZx2H1HyYFEc6FGvcfzqs43vV/IzN4mK0SMy2qFPfjuG2JJ
tv3x2QfHMM3M2+dwX30bUD12UorMZNrLo8HjTpanYD9hL8WglbSIBJhnLE5CPlUS
BZRSx0yh1U+wbnlTQBxQI0xLkPIz+xCMBwSKl5BaCb006z43/HJt7NwynqWXJmVV
KScmkpFC3ISEBcYKhHHWv1IPQnFqMdW4dExXdRqWuwCshXpGXwDoOXfKVp5NW7Ix
9kCyfC7XC4iWXymGgd+/h4ccFFVm+WWOczOq/zeME+0vJhJqvj+fN2MZtvckpZbc
CMfLjn1z4w4d7mkbEpVjgVIU8/+KClNFPSf4asqjBKdrcCEMAl80vZorElG6OVIH
aLV4XwqiSu0LEF1ESCqbxkEmqp7U7CHl2VW6qv0h0Gxy+/UT0W1NoLJTzLBFiOzy
QIqqpgVg0dAFs74SlIf3oUTxt6IUpQX5+uo8kszMHTJQRP7K22/A3cc/VS/2Ydg4
o6OfN54Wcq+8IMZxEx+vxtmRJCUROVpHTTQ5unmyG9zQATxn8byD9Us070FAg6/v
jGjo1VVUxn6HX9HKxdx4wYGMP5grmD8k4jQdF1Z7GtbcqzDsxP65XCaOYmray1Jy
FG5OlgFyOflmjBXHsNad
=SqLP
-----END PGP SIGNATURE-----

Both of them were signed with PGP signatures, which are basically a completely secure method of ensuring that the message has come from the confirmed sender.

But in the subreddit In the header here, there was the following string given:

10, 2, 14, 7, 19, 6, 18, 12, 7, 8, 17, 0, 19, 7, 14, 18, 14, 19, 13, 0, 1, 2, 0

Later was found that key was derived from King Arthur text. Translate each digit to a letter (from alphabet starting with A = 0) and you get kcohtgsmhirathosotnabca. Each letter is first letter in lines of decrypted text.

This was the ‘key’ that Problems mentioned, being the code to the shift cipher to be applied to the lines of text in the subreddit. If this is confusing, it basically means that each letter in each string was meant to be shifted by the number corresponding to it’s location in the text. This produced the following story.

The Number

These all led to a phone number. Which in the Cicada community is now termed as The Number. The code in the original message, as mentioned to be a book code, was applied here. If you’re not familiar with book codes, the first number is the line, and the second number is the character in that line. Applying the book code to the text with the full stops removed gave the following string of text:

Call us at us tele phone numBer two one four three nine oh nine six oh eight

This was obviously a telephone number, specifically 2143909608 . This number has since deactivated. Calling this number initially gave the following message:

Very good. You have done well. There are three prime numbers associated  with the original final.jpg image. 3301 is one of them. You will have to  find the other two. Multiply all three of these numbers together and  add a .com to find the next step. Good luck. Goodbye.https://youtu.be/k24ZrFR2IUQ

The original image had the dimensions of 509 and 503, both of which are prime numbers. These when multiplied with 3301 is equalto 845145127, which gave us http://845145127.com . Note that 845145127 is also in brackets in the GPG key’s name.

The Website

Going to this website led to an image of a cicada and a countdown. Using OutGuess on the image produced the following message:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

You have done well to come this far.

Patience is a virtue.

Check back at 17:00 on Monday, 9 January 2012 UTC.

3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJPCKDUAAoJEBgfAeV6NQkPf9kP/19tbTFEy+ol/vaSJ97A549+
E713DyFAuxJMh2AY2y5ksiqDRJdACBdvVNJqlaKHKTfihiYW75VHb+RuAbMhM2nN
C78eh+xd6c4UCwpQ9vSU4i1Jzn6+T74pMKkhyssaHhQWfPs8K7eKQxOJzSjpDFCS
FG7oHx6doPEk/xgLaJRCt/IJjNCZ9l2kYinmOm7c0QdRqJ+VbV7Px41tP1dITQIH
/+JnETExUzWbE9fMf/eJl/zACF+gYii7d9ZdU8RHGi14jA2pRjc7SQArwqJOIyKQ
IFrW7zuicCYYT/GDmVSyILM03VXkNyAMBhG90edm17sxliyS0pA06MeOCjhDGUIw
QzBwsSZQJUsMJcXEUOpHPWrduP/zN5qHp/uUNNGj3vxLrnB+wcjhF8ZOiDF6zk7+
ZVkdjk8dAYQr62EsEpfxMT2dv5bJ0YBaQGZHyjTEYnkiukZiDfExQZM2/uqhYOj3
yK0J+kJNt7QvZQM2enMV7jbaLTfU3VZGqJ6TSPqsfeiuGyxtlGLgJvd6kmiZkBB8
Jj0Rgx/h9Tc4m9xnVQanaPqbGQN4vZF3kOp/jAN5YjsRfCDb7iGvuEcFh4oRgpaB
3D2/+Qo9i3+CdAq1LMeM4WgCcYj2K5mtL0QhpNoeJ/s0KzwnXA+mxBKoZ0S8dUX/
ZXCkbOLoMWCUfqBn8QkQ
=zn1y
-----END PGP SIGNATURE-----

And so the solvers waited. And waited. And waited. And finally, after what seemed like years, the website changed. Reapplying OutGuess on the cicada image produced a new message, containing co-ordinates, as well as two which were written on the website itself:

52.216802, 21.018334
48.85057059876962, 2.406892329454422
48.85030144151387,2.407538741827011
47.664196, -122.313301
47.637520, -122.346277
47.622993, -122.312576
37.5196666666667, 126.995
33.966808, -117.650488
29.909098706850486 -89.99312818050384
25.684702, -80.441289
21.584069, -158.104211
- -33.90281, 151.18421
36.0665472222222, -94.1726416666667
37.577070, 126.813122

These returned locations across the globe, meaning that unless you had access to all these locations, you’d be forced to collaborate with other users, like the main IRC channel on n0v4. At each of these locations, brave solvers found a sheet of paper stuck to a telegraph pole, with a QR code and an image of a cicada.

It took a while for this to sink in with the community, that this wasn’t just a talented neckbeard in a basement, that this was actually a global organisation of some very very talented people.

Images:

Upon scanning these QR codes 2 different messages were revealed. These are:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In twenty-nine volumes, knowledge was once contained.
How many lines of the code remained when the Mabinogion paused?
Go that far in from the beginning and find my first name.

1:29
6:46
the product of the first two primes
2:37
14:41
17:3
27:40
the first prime
2:33
1:1
7:45
17:29
21:31
12:17
the product of the first two primes
22:42
15:18
24:33
27:46
12:29
25:66
7:47

You've shared too much to this point. We want the best,
not the followers. Thus, the first few there will receive
the prize.

Good luck.

3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJPB1luAAoJEBgfAeV6NQkP9oAP+gLu+FsRDf3aRcJtBkCOU2MX
r/dagOTvCKWtuV+fedy0enWUZ+CbUjXOr98m9eq2z4iEGqKd3/MBXa+DM9f6YGUE
jPum4wHtQDSJlZMazuYqJOVZGw5XmF25+9mRM6fe3H9RCiNDZpuXl3MzwdivYhcG
B5hW14PcdHHteQf3eAUz+p+s06RDs+q1sNGa/rMQIx9QRe71EJwLMMkMfs81kfJC
tCt21+8ud0Xup4tjUBwul7QCcH9bqKG7cnR1XWsDgdFP6a4x9Jl2/IUvp1cfeT7B
YLS9W3lCM8thMemJr+ztQPZrpDlaLIitAT2L0B3f/k4co89v5X2I/toY8Z3Cdvoi
hk0AdWzMy/XLDgkPnpEef/aFmnls53mqqe9xKAUQPMrI73hiJ+5UZWuJdzCpvt+F
BjfQk15EJoUUW16K2+mBA1cSd+HJlnkslUTsjkq0E36XKChP+Cvbu/p6DLUMM2Xl
+n3iospCkkHR9QDcHzE4Rxg9A435yHqqJ/sL2MXG/CY8X4ec6U0/+UCIF9spuv8Y
7w66D05pI2u9M/081L7Br0i0Mpdf9fDblO/6GksskccaPkMQ3MRtsL+p9o6Dnbir
6Z2wH2Kw1Bf0Gfx4VcpHBikoWJ5blCc6tfvT+qXjVOZjWAL7DvReavSEmW1/fubN
C3RWcjeI4QET2oKmV2NK
=LWeJ
-----END PGP SIGNATURE-----

and

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

A poem of fading death, named for a king
Meant to be read only once and vanish
Alas, it could not remain unseen.

1:5
152:24
the product of the first two primes
14:13
7:36
12:10
7:16
24:3
271:22
10:7
13:28
12:7
86:17
93:14
the product of the first two primes
16:7
96:4
19:13
47:2
71:22
75:9
77:4

You've shared too much to this point. We want the best,
not the followers. Thus, the first few there will receive
the prize.

Good luck.

3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJPB/nmAAoJEBgfAeV6NQkPEnEQAKl5qtb3ZE5vs+c08KuzAi4a
tQEE71fvb65KQcX+PP5nHKGoLd0sQrZJw1c4VpMEgg9V27LSFQQ+3jSSyan7aIIg
SDqhmuAcliKwf5ELvHM3TQdyNb/OnL3R6UvavhfqdQwBXCDC9F0lwrPBu52MJqkA
ns93Q3zxec7kTrwKE6Gs3TDzjlu39YklwqzYcUSEusVzD07OVzhIEimsOVY+mW/C
X87vgXSlkQ69uN1XAZYp2ps8zl4LxoaBl5aVtIOA+T8ap439tTBToov19nOerusB
6VHS192m5NotfQLnuVT4EITfloTWYD6X7RfqspGt1ftb1q6Ub8Wt6qCIo6eqb9xm
q2uVzbRWu05b0izAXkHuqkHWV3vwuSfK7cZQryYA7pUnakhlpCHo3sjIkh1FPfDc
xRjWfnou7TevkmDqkfSxwHwP5IKo3r5KB87c7i0/tOPuQTqWRwCwcWOWMNOS7ivY
KQkoEYNmqD2Yz3Esymjt46M3rAuazxk/gGYUmgHImgcu1zzK7Aq/IozXI7EFdNdu
3EoRJ/UL9Y0l0/PJOG5urdeeTyE0b8bwgfC2Nk/c8ebaTkFbOnzXdAvKHB03KEeU
PtM6d6DngL/LnUPFhmSW7K0REMKv62h9KyP/sw5QHTNh7Pz+C63OO3BsFw+ZBdXL
hGqP6XptyZBsKvz2TLoX
=aXFt
-----END PGP SIGNATURE-----

Which the solvers knew to be book codes along with a description of each book. They also included a warning about too much collaboration, saying that only the first few, or the active few, that make it to the end will receive entry.

The second code was found to have led to the poem Agrippa by typing in keywords from the description. This poem, found here, spat out the following after the book code was applied:

sq6wmgv2zcsrix6t.onion

Which most will know to be a hidden service on the Tor network. By entering this page into a tor-equipped browser, users found the following message:

Congratulations!

Please create a new email address with a public, free web-based service. Once you've never used before, and enter it below. We recommend you do this while still using tor, for anonymity.

We will email you a number within the next few days (in the order in which you arrived at this page). Once you've recieved it, come back to this page and append a slash and then the number you recieved to this url. (For example, if you recieved "3894894230934209", then you would go to "[http:// http://sq6wmgv2zcsrix6t.onion/3894894230934209]")

3301

Finally the website closed with a line saying “We want the best, not the followers”. Soon there was a month of silence and then this Image was posted on the subreddit on Cicada.

According the Cicada they have found the people they were looking for. But the community out there was not satisfied because of the lack of ending to what was this all about. And many termed it as a wild goose chase and waste of time. But did we know, this was just the beginning?

Conclusion:

A theory of a user on subreddit claims he might have a clue. Read Below

“In twenty-nine volumes, knowledge was once contained. How many lines of the code remained when the Mabinogian paused? Go that fair in from the beginning and find my last name.” So I went and I searched for a Mabinogian.pdf, downloaded it, and did a highlight search for pause. At about line 255 with around 1242 lines left, might be different in translation, there was the word pause. So when you subtract 255 from 1242 you get 987. From here I went to the first sentence 29 volume book which stored knowledge. This is an encyclopedia. I then went to my bookshelf and opened up the A volume. What then happens took me a good 10–15 minutes to do, and that was count every individual line from A. At line 987 the word is Arthur. Meaning the writers name in Arthur. This is interesting for a few reasons. 1. Arthur mentions King Arthur a few times a few clues back. 2. In context of the Mabinogion the king is the one who pauses. 3. This means the person that wrote has a god complex.

The guys name is Arthur unless you can prove otherwise.

Tune in to know what happened next in Part 2 of Cicada 3301.

Soumyajit Dutta

Written by

I am a professional Backend and DevOps Developer I mainly work on NodeJS and Python based Backend. On Cloud I have my forte on AWS and Azure.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade