Another phone numbers station: 415-704-0402

June 1, 2006 @ Michael Hampton → 184 Comments

Yesterday I reported on what appeared to be a numbers station which, instead of being on shortwave radio, was located on an ordinary telephone line. These shortwave numbers stations, should you tune one in on the radio, read endless strings of numbers or letters, frequently in foreign languages. Most people believe that they are coded messages, but it’s not always clear for whom they’re intended. That’s certainly the case with the odd telephone numbers stations. Now there’s a second one.

And again, it was with a posting to Craigslist on Monday that it all began. As of right now, the posting is still there, but it’ll probably go away shortly.

For Mein Fraulein

Mein Fraulein,

You must call me again soon.

///415///704///0402///

Anyone who calls the telephone number will receive this recording (MP3). It’s much like the previous one. It starts with some music, reads groups of numbers, each group read twice, ends with more music. The same pattern again. Here is what you receive when you call the number. Again, I’ve cut each duplicate block for clarity.

Group 617
06107 80020 21085 00601 30690
06079 01201 50240 07006 01601
70690 95000 01702 40050 14024
00908 70220 67089 07401 00820
10086 07801 30240 04016 02707
30130 15006 09306 91120 20084
00000 00210 03070 03107 60490
65023 02706 70000 07016 01201
7

The telephone number 415-704-0402 is registered to Pac-West Telecomm, another VoIP wholesaler. This doesn’t tell who retailed the number, or to whom.

And the questions remain. Who’s sending these messages? Who is receiving them? What’s the purpose? And what’s in the messages?

Maybe Ryan was right about them being love letters. Or maybe we’ve stumbled across something bigger than that. Anyway, since I now know where the next Craigslist posting will appear, albeit not when, I’ll be watching for it.

If you get bored listening to these two phone numbers stations, spend some time listening to recordings of shortwave numbers stations.

(Thanks to Rob for the lead.)

Update: And now there’s a third phone numbers station as well.

Share this story:

184 Comments → “Another phone numbers station: 415-704-0402”

Laurence Martin

Jun 01, 2006

Hmmm…
White Pages reference

Hilanavision Productions

20566 Kittridge St
Winnetka, CA 91306-4121
(818) 704-0402
Laurence Martin

Jun 01, 2006

Crap, wrong area code. Please ignore the above comment.
I still have a feeling this is a cool prank.
Michael Hampton

Jun 01, 2006

I’ve been watching people go at these two messages, and even from the limited progress they’ve made so far, I’m fairly convinced it’s going to turn out not to be a prank at all.
Nick

Jun 01, 2006

Any theories? And any known relations in the music to previous numbers stations?
name

Jun 01, 2006

Regarding the music, anyone analyzed the original (before mp3 compression) sound wave for hidden information, like audio images (see http://www.bastwood.com/?page_id=10 if you don’t know what it is)?
hey

Jun 01, 2006

It’s pretty clear that the characters are really groups of 3, not groups of 5 as repeated. The highest number is 125. Looking at number frequencies in both messages (the frequencies are pretty much the same, this just gives a larger sample), we see 013 is the highest at around 5%, still way too small to be E, but large enough to be statistically significant. The numbers are almost exclusively 0-30 and 65-95.
atomicthumbs

Jun 01, 2006

Mein Fraulein translates to “My woman wife”… Possibly communication fo overseas spouses?
Anonymous

Jun 01, 2006

4157040402 = 11110111110001110110011100010010 = 248.203.103.18
Dragon

Jun 01, 2006

Mein Fraulein = “My woman wife”

hmmm.
manus

Jun 01, 2006

hey may on the right track.
Here’s a hint: “meinfraulein” is 12 characters, which can be converted to numbers (a key, maybe?).
There are 84 3-digit blocks when you rewrite the numbers.
Hmm, looks like you can somehow get 7 numbers… (and you already have the area code)

that is all,
manus
Wilcox

Jun 02, 2006

Notice how its group 617, and if you remove the Zero’s from the first set of numbers it is also 617. Perhaps 06107 is a key for the agent to solve this cypher.
Daniel

Jun 02, 2006

Now when you call the number it says “Your account balance is too low. Goodbye!”

And that is it.
manus

Jun 02, 2006

Just a clarification — my comments were meant for the first message, and are also probably (at least) partially wrong. :]

-manus
Dr Who

Jun 02, 2006

I think Hey was right,
if it’s groups of 3, the highest is 125, 13 is common, and most are 0-30 and 65-95, then this is clearly UTF-7 encoded ASCII

I didn’t look deeply into the code, but can someone consider this and have a look?
Wilcox

Jun 02, 2006

061 078 002 021 085 006 013 069 006
079 012 015 024 007 006 016 017 069
095 000 017 024 005 014 024 009 087
022 067 089 074 010 082 010 086 078
013 024 004 016 027 073 013 015 006
093 069 112 020 084 000 000 021 003
070 031 076 049 065 023 027 067 000
007 016 012 017
Wilcox

Jun 02, 2006

I have 112 as my highest number not 125.
Drew

Jun 02, 2006

Both this company and RNK Telecom, the provider of the last number, are “large” VoIP resellers. In this case Pacwest actually owns the phone number – which you can check by doing a publically available NPA-NXX lookup (area code plus first 3 digits). Generally speaking, these places require deposits in the thousands of dollar range. Unless those numbers have been aquirred by a reseller of RNK or Pacwest, then they have a large pre-paid account or a line of credit. It doesn’t make much sense considering there are places out there where you can get a number setup for a few bucks a month. Not to mention they have to have to have some sort of media server setup somewhere to play the actual recording. Granted, that’s easy to do – but still ultimately linked to an IP address.

It’s not very likely, but if one of these numbers was setup with a company that uses SIP peering, you might be able to figure out the IP of the endpoint by calling it via a SIP carrier that has peering with them. Kind of a longshot though.
anonymouse

Jun 02, 2006

People, chill.

While number station operators were early adpoters of technologies, they are clearly not early adpoters of VoIP, they are late.

Using telephone numbers, even though, “rented”, “leased”, “resold” or whatever is too easily traced, not that these guys were ever concerned about that as transmitting from fixed locations, on regular schedules, at 10 to 100kW PEP is traceable

My two cents about this; “Fraulein” is an old, German word that is dead by now. It is no longer used. As the wired guy said, the most that this can be is a “love” game between two cryptanalysts, but that is probably untrue as it would be something out of a Neal Stephenson or Dan Brown book, it’s just too perfect to be that.

My conclusion, this is just a hoax, don’t spend your life on it
No One

Jun 02, 2006

Wil Wheaton made an interesting observation: The “Group ###” idenitifes where the next message will appear. First was “Group 415″, which was the area code for New York. Next is 617, which is the area code for Boston.

http://slashdot.org/comments.pl?sid=187276&cid=15451631
No one

Jun 02, 2006

Oops. I meant 415 is the area code for San Francisco, which is where on Craigslist the second message was posted.
amlethae

Jun 02, 2006

This is just an amateur’s thought: if it is a spy, or anyone at all needing to crypt-up something why wouldn’t he/she use 128-bit encryption that has been around for over a decade? That being said: what if the entire sound clip [perhaps the first and second repetitions combined] make up the entire coded message – which is actually found in the absolutely minute variations in the repeated numbers as can be seen on a spectrograph. If that’s the case, then perhaps the entire sound clip is processed through a piece of software as the message, the PGP-type key to which is the number sequence you’ve been scratching your heads about. Therefore you’ll never get anything out of it… and sure the group thing might point to where the next phone number can be found… If I’m right about all of this then there’s no way anyone is going to crack this unless they had the software containing the correct algorythm for decrypting the message with the key.
Jer

Jun 02, 2006

I would agree that the numbers represent ASCII characters that have simply been ran through a one-time pad, a simple XOR operation with a truely random number. Ciphers like this techically aren’t breakable unless the random number used with the XOR operation was not so random.
Fry-kun

Jun 02, 2006

this may be an “easy” method for spy to send a message back to base. tugging around radio transmitting equipment is very suspicious – but this method may be reasonable enough for the spy to use. of course i’d rather send an encrypted message by posting it on a blog, but that’s just me… maybe the spy is deliberately staying away from computers… or maybe it’s someone who’s forbidden from using computers by (ZeroCool/CrashOverride
Ben

Jun 02, 2006

Just a thought – I do speech analysis and I thought it would be interesting to see if the audio in this case was the important part of the message, not the number content. I was wondering why each block of numbers was repeated. I loaded the recordings up into an audio editor and split blocks of numbers and their subsequent repeat on to separate channels so I could compare. *There is a difference between each number block* – that is, the first time ’12345′ is said, the sound wave is subtely different to the repeat ’12345′ which comes after it.

What’s interesting is that this difference is visually obvious but not audible; and the difference is visually evident both in the waveform and the spectrogram. Even phonemes (speech sounds, /s/ or /e/ or whatever) of similar classes or features can sometimes not be distinguished on a waveform, only on a spectrogram. This suggests that the difference is in the signal, not the phonetic information.

Also, the samples are your typical 0-5KHz cycle (~11KHz sample rate) and 16bit of below dynamic, which are very typical settings for speech recordings for research and other databases – speech information really doesn’t exceed 8KHz, so recording speech with these settings is fine. The audio is sampled at 16000KHz, but speech sound doesn’t go above 5.5KHz, suggesting it’s been surplanted.

Someone has not recorded this off daytime radio – they have gone through a database of speech samples (which is why there are no background sounds behind the speech, and why the samples are mashed together without clicks or artifacts, because they’re cleanly recorded, probably all with the same settings and equipment). It would be interesting to see if there are any easily accessible (eg. through a university) sample databases out there containing north american males saying single digits.

As for the music which is placed at the start and finish of the recordings: it’s one melody, played over and over (seems to occur 2-3 times). The beginning and end musical bits are identical – interesting, because the first one starts abruptly, but then fades out; and the ending piece does the same, rather than, say, fading in and then ending abruptly. The beginning and ending musical bookends are also subtely different – same content, but waveforms are subtley different.

Changing the view to spectrogram, it’s easy to see the pitch of the different notes in the melody. They are curiously mathematical to me. Assuming the mid tone is the 0 baseline, as a ‘code’, the notes of the melody play out as these numbers:

(long flat line of ’0′) 1 1 2 -1 -2 -1 0 0 1 1 0 -1 -1 -2 -2 1 1 2 -1 -2 -1 (long flat line of ’0′) repeat

Really just a progression in notes, but who knows. There’s also acoustic instrumental stuff going on down at the lower frequencies, which is also uniform like any drum beat.

My guess is this tune is just taken from a database of phone muzac.

It occurs to me that the difference in the waveforms between repeats of the same information could just be an artifact of the process of converting them to mp3. An interesting thing to do would be to see what format the original is recorded in, or take a sample of the raw audio in wav.

Hope some of this has been helpful or interesting.
Mika

Jun 02, 2006

Like Dr Who commented about the mostly used intervals (0-30, 65-95) … could it be that these 7-bit values would carry 2-bit + 5-bit parts of information. If that 2-bit part would be mostly 00 or 10 and the 5-bit part would be, for example, alphabet table that would give us mostly values between 0-31 and 64-95?

Both codes seem to end with 0 7 followed by three numbers.

I hope we get more of these.
Michael Rogers

Jun 02, 2006

061 078 002 021 085 006 013 069 = N STX NAK U ACK CR E b u f m
006 079 012 015 024 007 006 016 ACK O NP SI CAN BEL ACK DLE f l o x e d p 017 069 095 000 017 024 005 014 DC1 E _ NUL DC1 CAN ENQ SO q q x e n 024 009 087 022 067 089 074 010 CAN HT W SYN C Y J NL x i v j 082 010 086 078 013 024 004 016 R NL V N CR CAN EOT DLE j m x d p 027 073 013 015 006 093 069 112 ESC I CR SI ACK ] E p m o f 020 084 000 000 021 003 070 031 DC4 T NUL NUL NAK ETX F US t u c 076 049 065 023 027 067 000 007 L 1 A ETB ESC C NUL BEL w g
016 012 017 DLE NP DC1 p l q
Dragon

Jun 02, 2006

Care to explain what that is and how you got it?
Michael Rogers

Jun 02, 2006

Sorry for the broken formatting on the previous comment. The first line is the numbers broken up into groups of three: every group except one starts with a zero. The second line is the ASCII characters – too many control chars for it to be plain ASCII. The third line is the Caesar cipher equivalents of the codes between 1 and 26 (a=1, b=2 etc). Lots of Ps and Qs – try ROT-13. This only leaves a handful of non-alphanumeric chars, mostly nulls and escapes (27), which could correspond to spaces and full stops, plus a bracket, and underscore and an equals sign (which suggests it might be reversed base 64).
Space Rogue

Jun 02, 2006

Another posting in Boston

For Mein Fraulein

Reply to: pers-167168282@craigslist.org
Date: 2006-06-02, 7:21AM EDT

Mein Fraulein,

I am anxious to speak with you.

///617///973///3463///

I suspect it is a copycat though as the number goes to the Fed Res bank.

- SR
Alex

Jun 02, 2006

“FrÃ¤ulein” is the German equivalent of “Miss”. It is still used. It does not mean “my woman wife”. The usage here is odd, though. I suspect it’s meaningless and just an arbitrary title.

248.203.103.18 is an IANA reserved range, so it’s not that unless that’s a deliberate injoke – perhaps a love letter to someone on the ICANN? (Not a serious analysis, btw.)

The first line, using that ASCII, is =O[ctrl-B][ctrl-U]U[ctrl-F][ctrl-M]E[ctrl-F], which isn’t very promising unless there’s a further layer of encryption.
Alex

Jun 02, 2006

@Michael Rogers: are you sure it’s not in l33tsp3ak?
Zenon_P

Jun 02, 2006

“Fraulein” has nothing in common with any “wife” indeed, neither young nor old. It means : miss, young lady.
Rob

Jun 02, 2006

This is just total speculation, but could this be some sort of art protest? With all of the attacks on file sharing networks and utilities, could these messages be ‘packets’ in the distribution of a copyright file, maybe an MP3? This would show that any communications medium could be used for the ‘transmission’ of copyrighted materials and therefore tools like BitTorrent or eMule are no different.

We are not sure that we have the first message, nor are we sure that they are in order, but if we did have the first ‘packet’ then we could inspect the header to see if it matched any particular file format. Of course we would need to know how the binary format is encoded
rjm

Jun 02, 2006

are you all on crackrock?
kenny

Jun 02, 2006

if you take that code above from comment 15, and stick in a text file, change the extenstion over to an executable file(exe) and try to run it, you can alot of errors =P

perhaps if you took all the combined messages into a single file and did it. something might happen!
Tuner

Jun 02, 2006

The music is a sample of the bridge of a-ha’s Little Black Heart from the album Major Earth, Minor Sky and starts about 2:35 into the track.
boston craigslist

Jun 02, 2006

http://boston.craigslist.org/mis/167168282.html
Jon

Jun 02, 2006

While Tuner above seems to have identfied a specific track, melodically, the music loop that plays before the speech appears to be a sped-up version of the loop in the flash sight of the Hando Foundation, the artificial protagonist in ABC’s Lost.

Viral ad for the new Lost game or whatever?
Jon

Jun 02, 2006

Der, that would be the Hanso Foundation…
billybob

Jun 02, 2006

Open the mp3 in a wav editor and look. mp3 compression might have messed this up but why wouldn’t they hide the message in the sound data itself? Look at the odd wave forms after each number.

http://img166.imageshack.us/img166/7936/wav4ym.jpg
Michael Hampton

Jun 02, 2006

If there was anything to be gained from analyzing the sound, I doubt there is now. The file was recorded in 8KHz GSM and upsampled and re-encoded to 22KHz MP3. Given that it would be in 8KHz GSM for part of its transit over the telephone call, I don’t think hiding anything in the sound itself would be useful. You certainly don’t do this for shortwave, which is noisier, for much the same reasons.
rob fitzgerald

Jun 02, 2006

I think it’s worth mentioning that if you convert the 3-digit sets into forced 8-bit binary, and then convert that into ascii, you get garbage, until…you start trying to offset the binary code by different numbers of bits. Coincidentally, I’m supposed to be studying for my Mod/Demod final, so I can’t put too much busy work into this, but just computing the first little bit yielded:
101010011100000001000010101010101010000011000001101010001010000011000111

to be

©ÀBª Á¨ Ç

(by taking a bit from the front and putting on the LSB tail of the bit stream)

does this look like anything to anyone?
rob fitzgerald

Jun 02, 2006

i apoligize that this forum is processing the text i inputed to look like garbage. go to this website and input this binary and you will see what i mean:
http://www.roubaixinteractive.com/PlayGround/Binary_Conversion/Binary_To_Text.asp

101010011100000001000010101010101010000011000001101010001010000011000111
rob fitzgerald

Jun 02, 2006

http://www.roubaixinteractive.com/PlayGround/Binary_Conversion/Binary_To_Text.asp

input

101010011100000001000010101010101010000011000001101010001010000011000111
rob fitzgerald

Jun 02, 2006

i retract my theory
CodeBreaker

Jun 02, 2006

Who says it has to be an ASCII representation? why not something like GSM 7-bit, this is optimised for sending text without wasting much space – there are only 3 control characters – newline, carriage return and “escape” for accessing the extended alphabet.

I’m sure there are a few other alphabet encodings out there that do a similar thing.

OTOH it could just be a really cheap trick to promote some film…
Cory Whitesell

Jun 02, 2006

I suspect it is an OTP cipher. “Group 617″ probably identifies the pad to use to decipher the message. Unless you have a lot more samples of messages using Group 617, this will pretty much be uncrackable.
Scott

Jun 02, 2006

Here’s my bet: it’s a book cipher. The “Group 617″ part of the message indicates what text to reference (the US Constitution, Genesis 4, the ingrediant list of Oreo cookies, etc.), the integers indicate what word to choose, the 0′s indicate spaces between words, 00′s indicate a sentance end:

61 78. 2 21 85. 6 13 69. 6 79 12 15 24. …

Now to infer the right book. Which is, of course, impossible.

-Scott
E

Jun 02, 2006

“Mein Fraulein” is not proper German. German is a language with gender. Referring to a young woman “fraulein” you would use “meine” which is the feminine version of “mein” or “my”.

These messages are not done by a native Deutsche speaker.
renaudtrudel

Jun 02, 2006

[quote]â€œMein Frauleinâ€ is not proper German[/quote]
actually, it is.
“FrÃ¤ulein” ‘s gender is neutral, not feminine as one might expect.

This would rather tend to indicate the messages are by a native speaker.
Dragon

Jun 02, 2006

The group ### could be just a way to tell where the next message will be, the first from 212-796-0735 contained group 415 and the 415-704-0402 contained group 617 so that could mean that the next phone number will be 617-###-####…
just a thought
ironbear

Jun 03, 2006

Both of the ‘numbers’ station recordings show some interesting…and different…subaudible audio digital-type encoding when viewed with an audio spectrum analyzer (I used a freeware one called VisualAnalyzer). The “Group 415″ recording shows considerable activity in the 4.0 to 4.4 kHz. range, changing at the same rate as the numbers are ‘spoken’, but different when each number is repeated. The “Group 617″ recording has occasional databursts mostly unrelated to the program audio, in the 4.5 to 7.5 kHz. range. Capturing these stations with sufficient audio bandwidth seems like a good idea.
Michael Hampton

Jun 03, 2006

As I said before, you can’t get the stations with sufficient audio bandwidth since they’re coming over an 8KHz channel and compressed with a very lossy GSM codec.
ironbear

Jun 03, 2006

Thanks for the disinfo, Michael Hampton.
Michael Hampton

Jun 03, 2006

Excuse me? What “disinfo” are you referring to? And what agenda are you trying to push in referring to it as “disinfo”?
ironbear

Jun 03, 2006

The recordings speak for themselves, when viewed with a spectrum analyzer. It is exactly that analysis which, through a spurious argument, you are recommending that people not do. What’s your interest in doing so?

An 8 kHz. channel encompasses the entire bandwidth in question, and who cares what the original codec was. Lossy or not, it clearly works sufficiently well in this case. Indeed, these are not necessarily signals which originated as audio at all.
Michael Hampton

Jun 03, 2006

My interest in doing so is to persuade people not to waste their time. Clearly you can ignore me and waste your time all you want.

If you actually come up with anything on the “occasional databursts” I’ll be quite surprised.

Maybe there’s something there, maybe there isn’t. By all means keep looking for it, if you wish, but I still think it’s a waste of time.
ironbear

Jun 03, 2006

What an astonishing reply. So, from your point of view, you’ve posted the material but you heartily recommend not looking at it scientifically: that’s a waste of time? Last I heard, this is a technology site, not a meeting of the Flat Earth Society. Have you not actually looked at the signals by now?
Michael Hampton

Jun 03, 2006

Oh good grief. I DID take a look at the signals, and that’s why I think it’s a waste of time. If you think I’m wrong, go find something in there.
ironbear

Jun 03, 2006

No one outside the NSA is likely going to be able to _decode_ the subaudible signals, if that’s now the required standard of ‘proof’. Heaven forbid they might be uninteresting short of producing actual text. Fact is, something quite unusual is embedded in these audio files. For the curious, you can see for yourself with an audio spectrum analyzer, such as the freeware one at: http://www.hitsquad.com/smm/programs/VA/

As for your position on this, Michael: it’s at least as much of an enigma as the ‘numbers’ voips themselves.
Michael Hampton

Jun 03, 2006

I’ve made my position perfectly clear several times. If you’re still confused, there’s nothing I can do for you at this point.

The comment box, of course, remains open, should you actually find something of interest.
DuntDuntDuh

Jun 03, 2006

Mein Fraulein = German name
Germany = 9/11 hijacker’s staging point

Could it be that bin laden is planning the next 9/11 using the same service we use to meet loose women??
just a thought

Jun 03, 2006

why would such a public forum be used to transmit super sensitive data? just a gut feeling, but if one were going to all of this trouble, you could use random blog comments by setting up a pointer in each message directing to the ip of the next transmission point. just seems like using cl for a top secret purpose would raise plenty of unecessary attention like….this.

definitely interesting. if it is a new viral ad that says “watch qvc” or some shit i’ll not be completely surprised.
Teh Noob

Jun 03, 2006

Has anyone thought that maybe the encoded message (if there is one) *isn’t* in english? Used a bit of german for the beginning, then the rest in english, but that doesn’t mean that the message itself is in english.
Ben

Jun 03, 2006

Another thought.
If this is a prank, or an advertisement, then the message should be able to be easily deciphered. It wouldn’t be an ironic joke if there wasn’t something you could find, without going to the ends of the earth, to solve it – the prankster wants you to solve it, so you can get their joke or obscure reference; likewise it wouldn’t be an advert unless it was able to be solved, otherwise nobody would see the point of it, or get the hidden messages which might be ‘watch lost’ or ‘adama is a cylon’ or something.

with reference to the waveform picture in message 38. – it should be noted that this ‘unusual tail’ occurs after the same piece of cut+pasted speech – eg. it only occurs after the recorded says ’5′ (or whatever it is) and this always occurs before ‘blank’ space.

If this is aspiration, post-aspiration ‘lip-smack’, or any other kind of aperiodic sound from speech production (eg. hash-like noise from non-vocal-chord sound) then it’s perfectly feasible that the waveform looks weird, and occurs after the main body of the number (which you would *think* contains the whole piece of speech, but might not). Aspirated sounds (eg. /s/, /f/) are the quitest class of speech sounds – something that looks like a little tail or murmur may be an actual ‘letter’. It is useless to look at speech sounds as waveforms, waveforms of different sounds are sometimes indestinguishable; also, a speech sound as a waveform may be extremely small and quiet, or very loud and abrupt, or periodic (organised) or aperiodic (hash) – they aren’t continuous, as waveforms they don’t look like proper sound, they’re counter-intuitive.

Seems to me like the sound-as-code theory might be debunked, unless the code was hidden, as in comment 49., in very *obvious*, abrupt sound information that wouldn’t be destroyed by sampling, transport noise, etc. The notes of the melody would be perfect examples of this, in my opinion, but they seem to be a part of a known song as in comment 36.

I’m going to have another look at the low frequencies.

Thought: could these numbers be unencrypted? ie. put them into the right filter, and they just spell out a message? Maybe they’re UTF8, BIG-5, etc. not ascii, or strangely encoded ascii, or encrypted ascii?
bjuhn

Jun 03, 2006

i’m pretty sure the first and second repetition of the numbergroups are not equal, i looped a single digit from a first repetition for a while, the the same digit from the repetition. it seemed like some sort of flanger was applied the second time. i did this with a couple of digits, it seemed to be the case for the ones i tested. i also tried to do the same with to differend ‘zero’s from the same group of numbers, but i couldn’t hear a difference, ether with the two zeroes from the first nor the second repetition
kura

Jun 03, 2006

I’ve seen this type of messages in digg and also slashdot

I’ve seen on the net where you can search for certain sequences of numbers through google? could anyone do it and look for the earliest of these messages?(just like credit card number and social security number sequences)

and actually the three number theorem and the fact that the numbers only vary 31 numbers are really intriguing factors.

I’d really love to find the result:D
Network Geek

Jun 03, 2006

For Mein Fraulein

Mein Fraulein

My first thought when I saw it was to say the words out loud. It’s been a long time since HS German, but my pronunciation was always pretty good according to my teacher. To me, it sounded almost like numbers…
For Mein Fraulein = 4 9 4 9
Mein Fraulein = 9 4 9

Could the encoding be that subtle? Could there be something addtional from that angle?
Lou

Jun 03, 2006

Hey kura if you look at the german alphabet there are 30 standard letters and including the period there would be 31 standard variations like you suggested. look http://german.about.com/library/anfang/blanfang_abc.htm
eggegg

Jun 03, 2006

It’s like a Far Side cartoon. “Upon seeing the obituary, Special agent Wilsonovich realized his boss may have meant for the message to be put on his now-dead coworker’s to-do list rather than the well-known classifieds site.”
nada

Jun 03, 2006

this is exciting. i agree with the sentiment that if it were some sort of a joke/prank, it would be more logical for the those who made the message to give us a few hints as to how to solve it.

also, i find interesting the ideas that Ben posted, about answers possibly laying in the sounds, not the numbers. that could just be a perfect dupe.

and i think it’s very important to keep in mind that the key may not be in english.

i dont know anything about cryptology, but this is really cool
bjuhn

Jun 03, 2006

lou, wouldn’t it make more sense to have space rather than period?
Meanderthal

Jun 03, 2006

Something from a laymon’s standpoint.

If I were playing a joke and there was no message to be found in this, and it was a complete hoax, I wouldn’t really find it that funny or entertaining.

There has to be information in this.

Also, if I were transmitting secret(confidential) data, that I didn’t want anyone to understand…I would definitely throw out decoys after I found out people were paying close attention to the initial message.
ossie

Jun 03, 2006

Any ad placed on craigslist gets massive response. Nobody would place an ad expecting only one person to call the number. Its assured that lots of people would call it just to find out about it or to prank it themselves.

Therefore the message was placed with the intention of you all geeking out over it.

Modern secret transmissions use data encoded in JPEGs, stuff like that.

Mein fraulein is perhaps a playful reference to the east german days when this shortwave number communication was often used, thus piquing your interest further. To crack it you should research what number systems were used then. Its probably one of those. You require a key.

Fraulein isn’t used by young people any more, its a relic of war time germany.
pascal

Jun 03, 2006

Maybe it’s Google trying to find new highly skilled personnel?
Joe West

Jun 03, 2006

interestingly enough, group 617 first result on google is to do with amnesty international.

Meet Second Tuesday of every month 7:00 p.m. hosted by Amnesty International Local Group 617
Paseo Verde Library
Coffee Shop
Henderson, NV.

the next result:

Creative Leverage Group – Web Design and Graphic Design in Nashville
617 Dutchmans Drive
Hermitage, TN 37076

later on down the results page:

http://617pg.com/home/ a production group.

given that the message is obviously meant to infer a german poster, the second result is interesting.

could this have something to do with amnesty international? perhaps someone whos feeding them info? in that case, the music and numbers could mean nothing, and its just a signal of where a person intends to be met. AI could provide someone with several thousand dollars without any trouble.

or, it could be that this is indeed some spook stuff. having an excellent sense of humor, they decide to meet at the amnesty international meeting to engage in another step in world domination. lol.

given the date these were posted, this would allow plenty of time to get to the meeting, which will be held on the 13th if my calender is correct.

or AI could have nothing to do with it at all.

it is interesting how many ppl are saying this is a waste of time.

a search for ‘group 415 amnesty’ again brings up amnesty international as the first couple results.

meanwhile, just searching for group 415 brings up an accounting company as the first result.

as an aside, there seems to be alot of marketing surrounding this. im not going to go into great detail here, but just give the searches a look. why is this interesting? i think we can all agree that this isnt some marketing campaign at this point. however, DoD has used private datamining firms before because there setup was superior to the one they apparently possess[ed].

this is of course all speculation.

as an aside, i read somewhere on these 2 pages about an eclipse. could this be a very vauge refernce to a crescent?
Jun 03, 2006

The 212-796-0735 mystery - Homeland Stupidity
Joe West

Jun 03, 2006

also, for what its worth:

since this originally appeared on may 8th, guess what day the 9th was?

the second tuesday of may.
kura

Jun 03, 2006

you guys also need to understand that the first message wasn’t from this may.

there was one in slashdot that even dated back to 2001.

it contained HELLO WORLD and number sequences following it.

however, that sequence had very little amount of zeros.

let’s crack this guys:D
kura

Jun 03, 2006

BTW, I do not think group 617 is part of the codebreaking mechanism.

someone else has pointed out that in the previous one, the 415 was the area number that starts This number. and in the previous messages, only HELLO WORLD or OUTGOING existed.

my guess is, that these are only clues to where the next message will be.

I think that before, they were using google to spot hello world and had lengthier series of numbers because the message itself contained the information on where to search for next one.
Andrew

Jun 03, 2006

I don’t know if ayone has played with this yet but if you take out the “/”s from the first message (and leave them in the second one where they pad the outside of the number) it’s character length is identical with that of the number of 3 digit sequences.. could that be the key or pad?

dum dum dahhhhhhh
Jun 03, 2006

Attack Of The Killer Alpacas » Blog Archive » Group 617: 06107 80020 21085 00601 30690…
murphy

Jun 03, 2006

if the 415 number was in san fran – the next 617 will be in or around boston – look for the next one on craigslist there…

just a hunch…
manus

Jun 03, 2006

Probably on the 19th of June..
Rafael Castro

Jun 04, 2006

Why don’t you translate ‘Mein Fraulein’ from German to English in Google? … I’ll save you some time… it means: “my woman wife”

I s’pose the sender and the ‘receiver’ are a woman agent and a man agent. (XD)
Anonymous

Jun 04, 2006

“my wife” would be “Mein FrÃ¤u”…

Don’t believe everything you read on Google, especially an automated translator.
Ben

Jun 04, 2006

Some more interesting ideas:

1 – mein freulin refers to the message being in german. could this mean: ‘mein freulin’ is the key; method of encryption is similar to something the germans use(d); something to do with wwII; codes refer to the part of the UTF block containing german alphabet characters; clear message is in german etc.

2 – the ‘group’ number appears to relate to the telephone area code, so probably has nothing to do with deciphering the message. someone mentioned ‘group’ was a number station convention to indicate the number of digit groups in a series – it’s not being used this way here. it’s there to make it *look* like a reproduction of a number station broadcast, but it’s not. if it was a prank, this might be a clue that these elements are to just to give it the look of a secret code – it has nothing to do with number stations.

3 – music is hard for a computer to identify. the music intro/outro is meant for a human to hear. it’s either to confirm this message is a legitimate one (because person A told person B their secret messages would have this music at the beginning and end); or the music has significance in the decryption.

virtually anything about it could be significant – the lyrics, the name, the year it was made, trivia about the song or the band, the notes themselves, the melody, the drum beat. what interests me most about it though is the fact that’s it’s *unpolished*. the intro and outro snippets are actually the same piece of music – starting abruptly, and then fading out — rather than, say, the intro starting and fading out to numbers; and the outro fading in and ending abruptly at the end of the message. the melody in the original a-ha song does not fade out at this point – it has been artifically faded out, but then this pre-made snippet is then repeated.

4 – all the voice samples of digits are *male*. I like my theory that it’s taken from a speech research archive – can anybody check this out? it’s pretty hard to tell the dialect of the speakers from such short samples, but we’re obviously talking english speaking males, probably north american (they sound like that to me, but I’m not American). the samples do *not* appear to be from connected speech – sounds in connected speech sound utterly strange in isolation, and are usually unintelligable. i think they were recorded in isolation, which fits with them being part of an archive of speech data.

5 – everyone seems to be ignoring a very key fact, which is that *everything is being repeated*. as stated, even the intro/outro are the same sample repeated. I think this could be significant. Now, maybe information was placed in the audio, and adding together the waves of the first and second utterence of two identical number groups would yield a soundwave containing a message or something, or meaningful data – and if this is so, the fact things have been downsampled and shifted around by recording into mp3 is unfortunate, maybe we *have* in fact lost the original info. but if this is a real secret message, why would it be on craig’s list – moreover, in the form of a puzzling and obvious geek-bate? if you were in the NSA, wouldn’t you leave messages in places or forms people *wouldn’t* flock to in the thousands? and if this is a prank or clever marketing, why would it be this complex to unencrypt? so: a fiendishly complex message not intended to be easily figured out wouldn’t be on craigslist; a hoax/marketing ploy would be much simpler.
bjuhn

Jun 04, 2006

further speculations…
4 – each number seems to be from different males
5 – the obvious reason for repeating the numbers would be to give the recipient a chance to validate the numbers. this is smart on actual radio stations, but in this case, why not just call the number twice? i notes earlier that theres a difference between the first and second repetition af the numbers, there might be something hidden in the sound
Ben

Jun 04, 2006

check this out:

both messages end with:

000 007 xxx xxx xxx

arranging the two messages into 3 numbers at a time, 5 per row, (with the 000 0007 separate at the end) you get:

013 056 051 012 079
046 065 010 093 000
082 039 013 094 069
012 078 108 017 028
017 069 022 073 038
014 017 015 015 073
004 020 068 012 013
125 100 054 004 091
014 013 015 086 022
096 081 066 002 082
055 070 002 000 000
022 083 029 008 022
012 004 071 013 065
027 094 019 029 014
022 008 002 011 083
073 003 026 019

000 007 000 000 086

061 078 002 021 085
006 013 069 006 079
012 015 024 007 006
016 017 069 095 000
017 024 005 014 024
009 087 022 067 089
074 010 082 010 086
078 013 024 004 016
027 073 013 015 006
093 069 112 020 084
000 000 021 003 070
031 076 049 065 023
027 067

000 007 016 012 017

something going on here? a key, a delimiter?

also, notice the phone numbers to recieve the messages are written differently in each craigslist posting. in the first:

212 //// 796 //// 0735

in the second:

///415///704///0402///

are these keys? are the slashes significant – eg number of slashes = offset of each number block in the message? a guide of how to count them?

also – the first has spaces before the slashes, the second has no spaces. could this mean the postings are written by different people?
jo

Jun 04, 2006

http://www.greatwardifferent.com/Great_War/A_Journey_to_Brussels/A_Journey_to_Brussels_01.htm

Thought this was kinda odd
Michael

Jun 04, 2006

Assuming three-digit groups, here are the group frequencies for the first message:

000-009 ***************
010-019 **********************
020-029 ***********
030-039 **040-049 *050-059 ****
060-069 ******
070-079 *******
080-089 *******
090-099 *****
100-109 **
110-119
120-129 *

Second message:

000-009 **************
010-019 ****************
020-029 ***********
030-039 *
040-049 *
050-059
060-069 ********
070-079 *******
080-089 ******
090-099 **
100-109
110-119 *
120-129

The frequencies are far from uniform – if a one-time pad is being used, it’s not being used in a secure way (modular addition). If it’s a book cipher, there’s a large area in the middle of the page without many useful words! The frequencies of both messages are similar: in particular, the groups 0, 12, 13, 15 and 17 are common. Both messages end with 07xxx, and this is the only time 7 occurs. All of this suggests that both messages are using the same or similar keys, eg the text of the personal ads as Andrew suggested.
Tobias

Jun 04, 2006

Doing a little digging on Wikipedia made me conclude this is a Number station and there fore this will be read:

Numbers stations are shortwave radio stations of uncertain origin. They generally broadcast people reading streams of numbers, words, or letters (sometimes using a phonetic alphabet).

The last part ( [sometimes using a phonetic alphabet] ) really got my interest, and i found a link telling this: http://www.bckelk.uklinux.net/phon.full.html
This might be a little hint on what it can be, and how it can be deciphered.
jo

Jun 04, 2006

i wish i wasnt so tired im usually pretty good with crypt stuff
Shawn

Jun 04, 2006

I personally think they are love letters, I’d really like to see them fully decrypted, I really think its amazing that someone would go this far to send love letters back and forth for a person
Ben

Jun 04, 2006

Just had fun analysing the messages again. I’ve found some interesting things.

Firstly, we divide the numbers into groups of 3. Now:

- No number in either messages exceeds 125.
- The numbers in either message do not have uniform distribution – eg. though the frequencies of number *ranges* are uniform (see comment 89.), the frequencies of the numbers aren’t. Most appear once, the largest number of times any number appears is like 4. There are no regularly appearing numbers which might indicate spaces or common letters like ‘e’. Therefore, if we are indeed meant to read these numbers as decimals appearing as numerals in groups of three, whatever is underneath is encrypted by a *key*.

- Each message has the pattern:

group xxx
(several groups of numbers)
000
(several groups of numbers)
000 000
(several groups of numbers)
000 007 xxx xxx xxx

Coincidence? Highly unlikely. 007 appears only once before this last magical ’000 007′ group of numbers, in the 415-704-0402 message — but it does not appear with an accompanying ’000′.

breakdown for messages is:

group 415
9 sets of 3 numbers
000
43 sets of 3 numbers
000 000
24 sets of 3 numbers
000 007 000 000 086

group 617
19 sets of 3 numbers
000
30 sets of 3 numbers
000 000
10 sets of 3 numbers
000 0007 016 012 017

Here is my meagre theory: each set of three numbers in either message represents a decimal number between 0 and 127 (0r, 1 and 128, since 000=0=delimiter). The key is the last 3 groups of numbers after 000 007, which are intended to be added or subtracted from numbers in the message continuously, cycling at the 127/128 border (eg. 120+15=7 not 135).

eg:

key: 016 012 017 016 012 017 016 012 017 …
msg: 061 078 002 021 085 006 013 069 006 …
sum: 077 090 019 037 097 023 029 081 023 …
sub: 045 066 113 005 073 117 etc …..

Why the obsession with 128? This is 2^7. No number is above it. A couple of numbers approach it. Plus – values between 0 and 127 (1-128) can represent characters from the first half of the ASCII table (control codes, 0-9, ?-!, A-Z, a-z, etc.) or *perhaps* the second set of 128 characters from any one of the various extended ASCII tables.

Now, considering we have the clue ‘mein freuline’, perhaps this means we should be looking in the extended ASCII table used for German? However, this is part of the ISO-859-1 / LATIN 1 character set, which is standard ASCII + some letters used in french/german/etc. (umlouts, e with crcumflex etc.) and a bunch of crazy maths symbols.

So… any ideas? I know my theory doesn’t involve prime numbers etc. and so isn’t very exciting, but if this is a prank or marketing ploy, no doubt it might be this simple?

Of course ‘group 617′ might refer to the OTP sequence on page 617 of some code book, and so this is a waste of time.

Of interest, above any of this, I think is the structure of the messages, with separation by the ’000′ and ’000 000′ and ’000 007′ blocks. Perhaps this indicate key+message+identifier of sender? perhaps they are a structure to an unknown file format?

Give me your thoughts all.
SethChernak

Jun 04, 2006

Has anyone thought that maybe the use of German is a reference to German encoding techniques? Perhaps we just need an Enigma machine to crack the code.
Manuel

Jun 04, 2006

Perhaps the whole thing is just a “love note” and the music is just the lover’s song. It could be that simple, and never meant to be decoded, as its just a bunch of uselesss numbers.
Coulombe

Jun 04, 2006

SethChernak, I like the idea of using enigma ciphers.
Unfortunately, these devices are very expensive (more than 10000$ on ebay…)

Thankfully, there’s emulators and info on the net!

http://www.simonsingh.net/Crypto_Links.html

because I believe it’s just a (cool) hoax, I let you all try to decipher it this way.

have fun!
Good luck!
roAm

Jun 04, 2006

the slashes are placeholders
the messages do NOT use a one-time pad
the numbers dont contain the message…
…the ORDER and FREQUENCY of the numbers do
j

Jun 04, 2006

and what makes you say that roAm?
Ben

Jun 04, 2006

There are more frequent numbers at the beginning of the second message – the frequencies, in order of the numbers themselves as you count them up, is something like: 1,2,1,2,1,3,3,3,1,1,2,4,2,3,3,2,1,3,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1….
so eg. numbers near the start of the message occur more frequently through it, the last half or so of the message the numbers only appear once each.

ps: roAm and the cleartext is?
s137

Jun 04, 2006

Turner in Post 36 is right. Maybe the lyrics to the song “Little Black Heart” are the “dictionary”, and the numbers and slashes tell how to read it.
Ben

Jun 05, 2006

made this nifty php script:

cracksmokingducks.com/craigslist.php

I’ve divided the messages into 3 blocks and a footer as per the structure I talked about in comment 93.

You can use the footer (three groups after 000 0007 which is at the end of every message), or ‘mein freulein’ as ascii values, or one of the three message blocks, to decode any of the message blocks. the script will cycle through the key you’ve chosen, and add/subtract it’s values to corresponding values in the message block you’ve chosen to decipher, then show the results in order as their numeric value, and corresponding ascii character.

I’ve been playing with it myself, nothing interesting so far though.
Jun 05, 2006

The Not So Free State » Blog Archive » Numbers Stations
Andy

Jun 05, 2006

I think people are being misled by the German. If you were going to put an ad on craigslist in a random place to send a message, then you need a unique keyword to search for it to be found so something like Mein fraulein is perfect and wouldn’t cause much suspician.
The Group number maybe some sort of verifiaction if the next ad appears in the Boston area, but isn’t really necessary so probably something competely different.
Andy

Jun 05, 2006

This may be the last message to easily find. The first sounded pretty casual “I havn’t heard from you in a while”, but the second sounds like they have possibly realised they have been found out “You must call me again soon” and so this message may detail their new ways to communicate.
Crambo

Jun 06, 2006

One thing I noticed, that doesn’t seem quite useful yet is the Group numbers seem to be counting and the 1 is a seperator.

For example, since there are 415 and 617, I think it would not be unreasonable to start trying to find messages that contain Group 112, 314, and possibly 819 in the future.

And yes, I do realize that we have such a small set of data that everything is just specualtion, but it is the start of a pattern nonetheless.
Crambo

Jun 06, 2006

Doh!, I meant to use 011 and 213 as example groups not 112 and 314.
Visitoir

Jun 06, 2006

Reading through these comments, I’m mostly reminded of William Gibson’s book, “Pattern Recogntion.” A quick check online shows the book is in production as a film, so my thought is this could be the early stage of a marketing campaign which doesn’t mature for another six to twelve months.
Visitoir

Jun 06, 2006

It could be a variant of the pad in that something in the text is the key for the numbers. Also, what about other languages and, more difficult, their character sets?
TiredTed

Jun 06, 2006

I believe this is simple word-number substituiton.

With “013″ being “the” and “000″ being a CRLF.

If you take this assumption and apply it to the code, you’ll see what I mean. Valid sentence structures can be formed, and the use of the word “the” follows the rules it would do in English language… perfectly (appearing at the beginning and middle of what appear to be sentences, whilst never appearing at the end).

I get the feeling that the dictionary being used, was built up incrementally. (So as new words were needed a new number was added).

I’d guess that “007″ is probably “thanks” and that “014″ and “015″ are common words that fit around “013″ (“the”) easily.

I also believe that punctuation isn’t accounted for, which will make the messages hard to read. (like when “015″ is repeated twice in one message, i’m sure there’s a full stop between them!!)

Also… I’ve been sent an email with the following:

Subject: 557
Body: 969

It came from a mail-relay on a Verizon connection in Baltimore that was attempting to spoof a domain name (danilaptop.com) – According to whois.sc there are no domains registered to that server. – It’s either..

- Michael Hampton
- Staff at Shoutwire
- Staff at Slashdot

(As they are the only ones who know I’m trying to figure this out AND have my email address)…

This is a game, or blog PR, or a recruitment drive for cryptanalysts. – It has to be .. because serious spies wouldn’t use a code like this… would they?
Michael R

Jun 06, 2006

I’ve been playing around with the lyrics of Corporal Schnapps as a book cipher (ie each number indicates a word). It’s pretty easy to find things that sound good (except the accent) and I’ve fooled myself a few times. For example 13 57 58 = for mein fraulein; this would require a key starting with 0 1 7 (13+0, 56+1, 51+7).
Joe West

Jun 06, 2006

having read every message on both of these pages, and then on other websites usually still going over the first call….

there appears to be 2 posters that drop ‘hints’ and nothing more.

i might be having an art bell moment and theyre just very interested in this stuff as well.

but these posters are hitting quite a few websites with this stuff.
sam

Jun 06, 2006

Like which sites for ex Joe? I’d like to see some of their comments
pod

Jun 06, 2006

Someone at Slashdot indicated the piece of music used is a snippet of
the band A-ha from their 1993 CD “Memorial Beach”, the segment is
edited out of “Dark is the Night for All” if that helps.
soimless

Jun 06, 2006

If I make a histograms for both the sets of numbers (in groups of three) and I found that the distribution of numbers are different (though the distribution of zeros are almost the same). I’m thinking that this is a word-number chipper of some sort and as someone pointed out before that the Group ### is the area code of the next city the next Craig’s list posting will be. The Dictionary may as well be the A-ha song Little Black Heart the unedited lyrics has 179 words in it, but if that is true they only have 55 words they will be able to use.
histograms
unique a-ha words
Michael R

Jun 06, 2006

Hmm, “Dark is the Night for All” only has 94 words… someone else said it was “Little Black Heart”, or was that the first message? Can someone with recordings of both messages post whether they use the same music?
ken

Jun 06, 2006

They both come from little Black heart, not dark is the night for all
m3

Jun 06, 2006

Can you post the lyrics from the first verse?

It’s unlikely to help as the music/etc for spy number transmissions were usually used just to identify it was the correct source.

But… I think this is a game… so it may be helpful.
m3

Jun 06, 2006

I never saw sunlight
Burn as bright
I never felt darkness
The way I feel it tonight

—

“013″ ignoring duplicates would be “Way” (unlikely)
“013″ excluding duplicates would be “It” (possible)
m3

Jun 06, 2006

The above (using the lyrics as the values) doesn’t seem to work:

“? ? ? feel ? ? ? The ?
? ? ? ? ? feel ? ? ? ? ? ? ? ? ? ? ? you you ? sunlight ? ? feel ? ? ? ? sunlight ? ? ? you ? ? ? ? ? never ? ? ? never

? ? ? felt ? feel sunlight ? ? ? ? ? ? ? ? ? felt never way ? ? saw ? ?
bright”
m3

Jun 06, 2006

like post 108, who else is getting emails? I also got two.. one with the body 969
soimless

Jun 06, 2006

yeah, it probably doesn’t work that way. I started to number them 0 – 179 and got “I black things way tonight them never darkness the I heart raindrops…” it’s interesting but I don’t think it works.
Michael R

Jun 06, 2006

m3: I got an email with subject 455 and body 969. What were yours?
pbx

Jun 06, 2006

Weird. I got an e-mail too with some number in the subject and 969 in the body. I checked the Pacbell IP address from which it was sent from and it was still live. HTTP requested a username and password. Unknown server type. Also tried port 86 and 969.
pbx

Jun 06, 2006

You know what’s strange? I’ve never called the numbers, and had never posted in any forum at all about this stuff, and yet I still received the e-mail. In fact, I thought the e-mail was spam since it spoofed my e-mail address. How odd.
pbx

Jun 06, 2006

I just want to mention that the e-mails are (most likely) unrelated. See here: http://isc.sans.edu/diary.html?storyid=1384&isc=96637d6e7f1a28cb1a0cb6a5e832c82a
MQuick

Jun 06, 2006

Has anyone actually broken the music itself down beyond its obvious audible characteristics? Everyone seems to be focusing solely on the message itself…
pbx

Jun 06, 2006

And… probably just a coincidence, but taking the numbers in my subject line, appending 969 at the end, and then deobfuscating it as an IP address, I get an IP address that resolved to a block owned by Halliburton.
(not) m3

Jun 06, 2006

I got two emails..

Subject: 455
Body: 5556

then

Subject: 455
Body: 969
(not) m3

Jun 06, 2006

and yes, all my stuff was spoofed as well..

maybe it IS just spam.. but is it normal that alot of us are getting it?
MQuick

Jun 06, 2006

Ok, now that I’ve taken the time to read through all the messages I apologize. So right now there’s some consensus on the fact that the music is significant, but our ability to analyze it beyond the obvious is limited…?
pbx

Jun 06, 2006

Seems a new one has appeared…
m3

Jun 06, 2006

Post #119 was not made by me… even though they used one of my aliases!!

It appears the subject numbers are different but 969 is consitent in most.

MQuick.. there is no consensus.. but a few people believe it might be relevant.

Due to the fact that the mail-relay I mentioned is already planned (or active) for blacklisting with several anti-spam groups, I think these emails.. MIGHT be unrelated… but what’s with the 3-digits for subject and body… how is that supposed to help spammers?
MQuick

Jun 06, 2006

Yeah the emails are unrelated, I passed the info around a big distribution list of friends in the IT sector and a good majority of them said they had either A) seen the emails themselves or B) seen an email from their network or exchange admins today about the recent influx of SPAM with those subjects and bodies used as examples. So from that I’d think it’s safe to conclude it’s unrelated. Below are some of the examples that got passed around:

Subject: 557
Body: 969

Subject: 455
Body: 969

Subject: 1545453
Body: 969

Subject: 1545453
Body: 5556
Meanderthal

Jun 06, 2006

wooo… someone answered that number. anybody else call it?
lone gunman

Jun 06, 2006

The Boston one seems to be a hoax
MQuick

Jun 06, 2006

Now that’s funny. Well not really b/c someone’s probably going to need to get their phone disconnected now given the flood of phone calls they are likely to get. The idiot who originally made the Craiglist post with this person’s number should be drug out in the street and shot.
Newsflash

Jun 06, 2006

new message detected

Mein Fraulein,

You must call me again soon.

///301///518///8895///
(301) 518-8895

If someone can record and make the numbers online again it would be awesome. I expected the same as skywalker for the next message to be on the 19th.
Skywalker107

Jun 06, 2006

The first appeared on Monday May 8th, the next appeared 2 weeks later on Monday May 29th, i am willing to bet that the boston – missed connections will have something on Monday June 19th.
Rocketeer

Jun 06, 2006

I wouldn’t be so quick to dismiss this as not an authentic coded message, as opposed to a love letter, a hoax, a viral promotion, etc. I’m no expert, but it occurs to me that if you, as a sender, wanted to be sure that the reciever of this message was not so easily traced, you would do your best to be sure a large number of people recieved it…
Teh Noob

Jun 06, 2006

I feel sorry for the poor sucker at the other end of that number. Having someone do this has gotta be worse than someone posting it to a telemarketer database… Also, those odd little waves at the end of each number are still… weird. I’ve seen a lot of waveforms for a *lot* of stuff, and I’ve never seen anything like it. I’m gonna try something and see what happens.
joe

Jun 06, 2006

what software are you guys using to look at the waveforms?
Michael Hampton

Jun 06, 2006

That Craigslist posting is fake. I flagged it as prohibited on craigslist, as the net effect of the message is going to be running up somebody’s Verizon Wireless cell phone bill with thousands of calls.
manus

Jun 06, 2006

People who are getting emails — it’s just spam. I got the same thing, and I’ll bet you have also participated in MIT’s mystery hunt at some point. Am I right?
Teh Noob

Jun 06, 2006

Joe,

I’ve tried opening the file in a number of audio editing tools, and the only one I’m having much success with is Nero Wave Editor. When opened in Sony Vegas, Acid Pro, or Audacity, I’m not seeing those peaks. But when opened with NWE, they’re clear as day.
Ben

Jun 06, 2006

a reasonable wave editor is audacity in linux, it’s good for spectrogram analysis too but a bit slow to render (and, on my athlon64 x2 4200, so we can assume that’s sloooooooooow). ‘wavesurfer’ is the choice for tcl/tk old skool hardcore audio analysts =)

Might i remind everyone who seems to be concentrating on only one message at a time:

-both messages feature a structure if you break them into groups of three, which is:

000

000 000

000 007

coincidence? doubtful, unless of course the second message is a fake, or the entire thing is a hoax but with structure put in as a red herring.

also, 007 appears in the same place in both messages, except in one of the messages it also appears in the first block of numbers before the first 000 (though not with a preceeding 000).

the ’000′s don’t appear in the messages anywhere except in the structure described above.

also, the size of blocks of groups is roughly consistent over both messages – eg. first block is small, second block after 000 is larger, third block after 000 000 is larger than first but smaller than second, and only three groups after the 000 007 ‘delimiter’.

-both messages feature a surprisingly consistent frequency histogram. small numbers appear more frequenctly; more frequenct numbers appear at the beginning of the message; the numbers in the last half of the message or so have a frequency of usually just ’1′.

-both messages feature a changing number of slashes in the phone number. using slashes is not a convention of any telecom notation system. put a / into a phone system (if you could) and it would freak out. so what the hell are they? i’d like to imagine some sort of mask.

-both messages feature a ‘group’ number that means nothing, but has a 1 in the middle. could this mean: group numbers in lots of four, then one, then five (for example)? Or perhaps groups numbers in groups of four, then a space, then five, then a space, then four… etc.?

-both messages are unlike number station broadcasts, in that the group number is used wrongly, and the numbers themselves are not classic five digit numbers. on a number station, the numbers are actually in the 10′s of thousands; in this, ’0′ appears so many times, that even as groups of five, the number vary wildly. also, the number of digits in both messages is not divisible by 5, it makes more sense to group them in threes.

the differences in the messages:
-both are different sizes, numbers of digits, etc.
-both have different distributions for different numbers and number ranges (though a consistent pattern across both)
-both have different sized ‘groups’ of numbers between the 000 / 000 007 ‘delimiters’ (though a consistent pattern across both)
-both have different formatting in the personal ad message. this might not sound like much, but to a linguist this is gold. for example: if the /’s are significant, why include spaces?
in the 212 message, we have: ’212 //// 796 //// 0735′
in the 415 message, we have: ‘///415///704///0402///’
in the 212 message, there are no CR’s: ‘Mein Fraulein, I havenâ€™t heard from you in a while. Wonâ€™t you
call me?’
in the 415 message, there are: ‘Mein Fraulein,

You must call me again soon.

‘

Unless the formatting is part of the ‘code’ (doubtful), this would seem to indicate two separate parties communicating.
Ben

Jun 06, 2006

Well I’ll be damned.

put the following into courier new or other fixed-width font:
212 //// 796 //// 0735
///415///704///0402///

the two, with the / and space padding, are exactly the same length – 22 chars long.

“hmmmmmmmmmmmmmm….”
Ben

Jun 06, 2006

Group 617
///415///704///0402///
0610780020210850060130
6900607901201502400700
6016017069095000017024
0050140240090870220670
8907401008201008607801
3024004016027073013015
0060930691120200840000
0002100307003107604906
5023027067000007016012
017

Group 415
212 //// 796 //// 0735
0130560510120790460650
1009300008203901309406
9012078108017028017069
0220730380140170150150
7300402006801201312510
0054004091014013015086
0220960810660020820550
7000200000002208302900
8022012004071013065027
0940190290140220080020
1108307300302601900000
7000000086

????
Ben

Jun 06, 2006

note for comment 417. – put into fixed-width font to see the columns line up.
Ben

Jun 06, 2006

Put the following into a fixed-width font:

Group 617
///415///704///0402///
078 021 0060
060 120 2400
601 909 0017
014 009 0220
740 820 8607
400 602 3013
093 112 0840
210 700 7604
302 700 7016

numbers without leading zeroes:
78 21 60 60 120 2400 601 909 17 14 9 220 740 820 8607 400 602 3013 93 112 840 210 700 7604 302 700 7016

as one string:
78216060120240060190917149220740820860740060230139311284021070076043027007016

in groups of 6 and 7:
782160 6012024 006019 0917149 220740 8208607 400602 3013931 128402 1070076 043027 007016

in groups of 3:
782 160 601 202 400 601 909 171 492 207 408 208 607 400 602 301 393 112 840 210 700 760 430 270 070 16

Group 415
212 //// 796 //// 0735
0130 10120 60650
1009 08203 09406
9012 08017 17069
0220 80140 50150
7300 06801 12510
0054 91014 15086
0220 10660 20550
7000 00002 02900
8022 04071 65027
0940 90140 80020
1108 00302 00000
7000 86

numbers without leading zeroes:
130 10120 60650 1009 8203 9406 9012 8017 17069 220 80140 50150 7300 6801 12510 54 91014 15086 0220 10660 20550 7000 2 2900 8022 4071 65027 0940 90140 80020 1108 302 0 7000 86

as one string:
13010120606501009820394069012801717069220801405015073006801125105491014150860220106602055070002290080224071650270940901408002011083020700086

in groups of 4 and 5:
1301 01206 0650 10098 2039 40690 1280 17170 6922 08014 0501 50730 0680 11251 0549 10141 5086 02201 0660 20550 7000 22900 8022 40716 5027 09409 0140 80020 1108 30207 0008 6

in groups of 3:
130 101 206 065 010 098 203 940 690 128 017 170 692 208 014 050 150 730 068 011 251 054 910 141 508 602 201 066 020 550 700 022 900 802 240 716 502 709 409 014 080 020 110 830 207 000 86
Michael Hampton

Jun 06, 2006

Why don't you put them into a fixed-width font yourself?
Ben

Jun 06, 2006

note again: preceeding spaces in comment 149. have been conveniently taken out by conversion to html. add them in, you will see blank columns where slashes dictate deletion.

okay i’m done =P
Ben

Jun 06, 2006

150. – because i’m an idiot clearly. woops.
Ben

Jun 06, 2006

bitwise mask?:

group 617
///111///101///0101///
0110110010110110010110
1100101101101101100100
1011011011011000011011
0010110110010110110110
1101101001101001101101
1011001011011011011011
0010110111110100110000
0001100101001101101101
1011011011000001011011
011

Group 415
111 //// 111 //// 0111
0110110110110110110110
1001100001101101101101
1011011101011011011011
0110110110110110110110
1100101001101101111110
0011001011011011011011
0110110110110010110110
1000100000001101101100
1011011001011011011011
0110110110110110010010
1101101100101101100000
1000000011
joe

Jun 07, 2006

what ways can 22 bit binary strings be interpreted?

I’d imagine a power of 2 number, but 22? maybe it should be divided somehow?

any ideas?
Sidney

Jun 07, 2006

I’ve studied cryptography and have broken a few ‘codes’ in my time so I just thought I’d add my thoughts…

Why do so many people think these messages are to do with ASCII, Hex, binary or any other form of computer data representation? Just because an internet site pointed to the phone numbers does not mean that the text represents any kind of computer language. IMO there is no merit in exploring this thinking.

The person who created these is copying the style of a shortwave numbers station and there is no reason to beleive the messages are anything other than a ‘traditional’ numbers station message. I.e. a plain/natural language obfuscated by a cypher, and in this case quite a weak one. I say weak because the similarities between the 2 posts suggest no one-time pad. The music is most likely insignificant – do you think the Linconshire Poacher and Magnetic Fields messages use those songs as their cribs?

When broken into groups of 3 digits, which seems very likely how this is supposed to be read, I was reminded of the famous Beale Ciphers. Let’s hope it proves easier to break!
Alex

Jun 07, 2006

Has anyone else been amused by the fact they chose 007 as a significant delimiter? (as in, James Bond 007)
Ben

Jun 07, 2006

154. like this: 3x 7bit strings + 1 parity bit; large binary numbers; 5x 4bit strings + parity bit; etc.

155. i was wondering when someone was going to say that =P
tmi

Jun 07, 2006

incidentally, using blocks of slashes is a common way to give out phone numbers in craig’s list ‘erotic services’ ads.
from what i hear…
ipdb

Jun 07, 2006

@Sidney … I’ve studied cryptography too and have written software to encrypt/encode data.

I’ve already seen from this (and I’ve tried various cyphers, considered ascii values, etc.) is a pattern to do with language, which appears to corroborate itself by following some light and simple rules (though the tests weren’t strong or conclusive because the data to go off.. isn’t much).

I agree that.. people trying to convert these numbers into other representation (other values, hex values, binary, graphical, etc.)… are looking much deeper than they need to.

Because in almost every case that people have tried here, they’ve ended up making the data less comprehenisble and tend to destroy the patterns that already exist in the data.
Ben

Jun 07, 2006

so ipdb, what do you think we should be doing?
are we talking about a simple substitution cipher with a codebook, or is this a mathematical scheme (in your opinion)?
Barry Scott

Jun 08, 2006

Messages seem to use a stream cipher. If the same key is used for both messages it should be possible to decrypt:

http://en.wikipedia.org/wiki/Stream_cipher
http://en.wikipedia.org/wiki/Stream_cipher_attack
SKYWALKER107

Jun 08, 2006

Couple things here.

Why are we seeing more than a max of approx. 30 different chars? (Do we need to break them down so that we only are getting about 30 or so combinations?)

I am guessing both texts use a similiar cipher but not an identical one.

I am re-reading my Army Cryptanalysis field manual now looking at frequency charts for multiletter combinations and polygraphic encipherments.
Joe West

Jun 08, 2006

hmmm.

got a funny email today. not like the ones with the numbers [which btw, are said to be seeding for a new computer worm]. somehow, someone has divined my email address and has asked about this ‘mystery.’

anyone else got anything like this?

why its funny, is because ive never given my email up here. i have these pages bookmarked, so i dont need to leave an email to be updated.

so…. just in case this person wants to hear back from me [because im not replying to the email] AIM: schadenfreudesin Yahoo: joe_west80

i look foward to continuing this.
Ben

Jun 09, 2006

if it were a polyalphabetic substitution cipher, this would explain >26 numbers being used to convery possible letters (and, assuming the number groups do indeed represent letters, not words). Though if you include 0-9, then there needs to be a minimum of 36 characters, so maybe not.

If this is a polygraphic substitution, then it’s a stream cipher, meaning a repeated key. Said key, if it’s short enough, should be able to be guessed from repeated patterns of characters.

For example, let’s say a common letter like ‘e’ is represented in the ciphertext by numbers 5, 7, and 19. Throughout the text we should then see this sequence repeated, without switches or changes, no matter the intervening ‘noise’ (other numbers representing other letters). ie. we might see something like this:

5 0 8 7 6 19 2 5 6 7 4 19 44 26 5 35 7 91 8 19

How you then get the key from this is a matter of how the text was encrypted – eg. using a regular vigenere cipher, an irregular one, straight linear replacement, etc.

But it doesn’t really matter, because once you:
-identify the most frequent numbers
-identify the least frequent numbers
-realise more common letters are represented by many replacements, and less common letters are represented by fewer than this, or just one replacement
-identify a few of the above repeating ‘threads’

you can pretty much solve the thing once you have the number groups representing ‘i’, ‘e’, ‘t’, ‘h’, etc. figured out.

Or, uh… at least that’s what all the crypto articles on wikipedia that I’ve been reading for the past 2 days say =P

Btw in my travels I cam across the fascinating case of the Zodiac Killer, which you can also find tonnes of info on – the messages the killer sent to newspapers and police were encoded using the method talked about above, and cracked with the same method + intuition. You might want to check it out.

And from what I understand of cryptography so far, if this is a stream cipher (eg. substitution or transposition with a key) we can crack it (unless it’s one time pad and we don’t have the pad), and if it’s a block cypher (eg. AES etc.) we’re screwed =P
ipdb

Jun 10, 2006

There are 155 characters/words/values.

There are 66 unique values in a range from 0-125.

There are only 62 (26+26+10) alphanumeric chars.

If punctuation was used, we’d see patterns from the periods at the end of sentences in relation to the “000″ values. But we don’t see that.

Most complex cyphers wouldn’t produce distribution/frequencies like those we’ve seen.

What we’ve seen is more indicitive of progressively built dictionary than it is of any complex cypher.

As for OTP… the similarities in the messages don’t really give this idea much credit. Unless you consider an OTP as valid for a sequence of communications, which wouldn’t be “one-time”. (The common values 000, 013, 007 and their respective positions are indicators of this.)

Sorry to be a downer on some of the ideas… but what we have here.. doesn’t give much credit to those theories.

Seems once people have converted the data into it’s groups of 3… they get lost as to what to do… rather than analyse the pattern and think about the pattern we already have to work off.

If you don’t stick to using indicators in the data as your guide… you’ll most likely end up clutching at straws… producing crazy random numbers with no pattern to follow.

You’ll learn more about this data if you just spend 2 hours staring at the numbers. (but use “000″ to break up the clusters of data!!) — moreso than you would spending a week with encryption programs and complex cyphers.

Just look at everyone’s attempts to do this so far… and the mess that ensues!!

Don’t step away from the pattern… use the pattern to learn about it… then you’ll know which direction to step in.
SteveJabs

Jun 10, 2006

A new number was posted…

This one has another actual message. It may be fake though, who knows.
Jun 10, 2006

Third phone numbers station: 678-248-2352 - Homeland Stupidity
bjuhn

Jun 10, 2006

yeah, this was posted (in case it gets deleted):
—
Mein Fraulein,

I hear the weather in the South is good this time of year. Won’t you call me?

///678///248///2352///
—
can someone call the number? google doesn’t return any results on it, so chances are this isn’t spam
bjuhn

Jun 10, 2006

oh, you did that already, sorry >_>
Michael Hampton

Jun 10, 2006

You must have missed the posting of the third numbers station.
Jun 10, 2006

Develop-Mental
Kevin Mesiab

Jun 10, 2006

The blocks of three are probably a step in the right direction, however, ASCII equivs are not. Classic cryptography doesn’t have the notion of the ASCII binary map. Its more likely that these numbers correspond to a position in a cipher alphabet.

If they are ASCII eqiuvs, to avoid running into the non printable ranges, you should wrap, which is more in line with classic caesar ciphering.
Anonymous

Jun 10, 2006

http://www.google.com/search?hl=en&q=Mein+Fraulein

third result down is one from Boston, well a cached link to one from boston.
Michael Hampton

Jun 10, 2006

Yes, anonymous, and it’s fake. Please don’t call the guy; it’s running up his cell phone bill.
Johan Louwers

Jun 12, 2006

I am not so sure that euhnegro is on the wrong track here. During the â€˜Off the hookâ€™ show there was a letter mentioned send to the show where someone was claiming that they where behind this and that it was all a prank to promote the hope 6 conference.

Blinkenlights is done by a couple of people from the German CCC and 2600 and CCC have close ties. Also blinkenlights is coming to the hope 6 conference.

Here an example of a very simple Blinkenlights Movie how it looks in the text editor:

@200
000000000000000000
000011100011100000
000111110111110000
000111111111110000
000011111111100000
000000111110000000
000000001000000000
000000000000000000

@800
000011100011100000
000111110111110000
001111111111111000
001111111111111000
000111111111110000
000011111111100000
000000111110000000
000000001000000000

Each frame starts with a @ followed by its delay time in milliseconds. @1000 equals 1 second. Following this comes the image. Every image consists of 8 lines with 18 digits each. A 1 represents a switched-on lamp while a 0 stands for complete darkness.
You may put any number of comment lines between the identification line and the first frame. They must be preceded by a # character. The end of line my be a CR (ASCII 13), a LF (ASCII 10) or CRLF (ASCII 13 + ASCII 10). We recommend saving your file with LF. Two frames may be seperated by one or more empty lines.

Maybe the groups are representing the milliseconds a frame should appear on the â€˜screenâ€™. Maybe it is up to us to think about a way to change this into a Blinkenlights movie. For those who do not own a Linux machine there is a windows tool you can download: http://blinkenlights.net/blinkenlights bm_play.exe (Windows)
Jun 13, 2006

Krunk4Ever! » Blog Archive » The Extreme Diet Coke & Mentos Experiments
milambyr

Jun 14, 2006

The notes of the music…
Jun 15, 2006

FORT90.com
Jun 16, 2006

Cryptanalysis of phone numbers stations - Homeland Stupidity
Michael Hampton

Jun 16, 2006

I’m closing comments here as I’ve opened a cryptanalysis thread with (I hope) a good summary of what’s known so far.
Jun 20, 2006

Fourth phone numbers station: 617-848-1172 - Homeland Stupidity
Jul 12, 2006

SecondAgenda : For Mein Fraulein

Latest News

Internet Pioneers Berners-Lee, Cerf, Strickling ask: “What Kind of Net Do You Want?”

May 20, 2011

The world-wide adoption of a decentralized network that connects everything creates continuous technical, social and policy challenges that no one could have foreseen in 1969. Even as we take the Net for granted, the way we do the air that we breathe, decisions are being made by policy-makers, technologists and end-users that shape its future.

The Nanny State Can’t Last

April 11, 2011

Instead of the left agreeing to cut social spending and the right agreeing to cut military spending, the right agrees to more welfare and the left agrees to more warfare. How long will it be before foreigners stop buying our debt, and hyperinflation arrives?

› Albany’s Historic Student Ghetto: Kegs N Eggs Mark the Spot

› Gaming the Game: Baba, Elvis, and the NBA Betting Scandal

› No-Fly Won’t Fly Constitutionally

› Buying Friends Creates More Enemies