For those of you following the mystery of two phone numbers stations found from postings on Craigslist, I have interesting news: A third posting, and a third message, have appeared.
The phone numbers stations, when called, play a short message reminiscent of ordinary numbers stations normally heard on shortwave radio. On May 8, someone posted a message to Craigslist with a telephone number which, when called, played such a message, and on May 29, a second message was posted to Craigslist with a different telephone number and a different message.
Early this morning the typical message “For Mein Fraulein” appeared on Atlanta Craigslist, shooting down the theory Wil Wheaton put forth about the next posting appearing in Boston.
For Mein Fraulein
Mein Fraulein,
I hear the weather in the South is good this time of year. Won’t you call me?
///678///248///2352///
The number, when called, does what you expect by now. You would hear this recorded message (MP3) playing groups of numbers, each group repeated twice, apparently for clarity. The numbers are:
Group 134
00300 30020 79087 02202 50150
75031 06501 00110 67027 06607
90640 21079 02107 90000 72018
06501 60000 12008 06801 90180
15088 03108 40730 29024 02500
60760 79013 01107 70950 07071
01806 9070
As you can see, it’s a shorter message than the previous two, and seems to follow the same basic patterns.
The telephone number is owned by Global Crossing, a wholesaler of VoIP and other telecommunications services. The VoIP retailer is still unknown.
People have suggested that the messages are pranks, or are some sort of commercial gimmick. But at least one person, who is in the U.S. military, says he sent a copy of one of the messages up the chain of command and was promptly notified that it was classified and he wasn’t cleared to know anything further about it. I don’t know whether this is standard operating procedure for any encrypted message or whether it indicates that there’s something to be found.
In either case, I provide the message for hobbyists and professionals alike, as it’s likely the phone number itself will die soon; both previous numbers were disconnected shortly after they were publicized.
Thanks to Meatstack for the lead.
[Missed the last two messages? Here they are: 212-796-0735 415-704-0402]
(No Ratings Yet)
Loading ...
Tropical WeatherLast week, in the wake of another uptick in the official unemployment rate, the administration continued to claim that their economic policies were working, just not fast enough. Not only does the administration have a funny way of ending a war, but now they claim their economic policies are successful. For whom, I wonder?
Gardner Goldsmith teams up with Brett Veinotte, of the excellent School Sucks Project and the School Sucks podcast. Gard and Brett discuss the impetus of the series and project, and why public education must be stopped.
Except where otherwise noted, content on this site is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works license.
Video published by this site is licensed under a Creative Commons Sampling+ license.
Facebook
Digg
del.icio.us
reddit.com
Newsvine
hyperreal
Jun 10, 2006
Here’s number three (assuming it’s not a copycat):
http://atlanta.craigslist.org/mis/170018379.html
Aaron Brazell
Jun 10, 2006
I venture it’s a fake too. The English is quite a bit better than the previous ones.
meatstack
Jun 10, 2006
The Atlanta listing’s numbers. I too think this one is a copycat, but in case it’s not I wanted to grab the numbers before it disappeared:
(repeats removed)
Group 134
00300
30020
79087
02202
50150
75031
06501
00110
67027
06607
90640
21079
02107
90000
72018
06501
60000
12008
06801
90180
15088
03108
40730
29024
02500
60760
79013
01107
70950
07071
01806
9070
Yes, that last one is only 4 digits. Called a couple times to make sure.
meatstack
Jun 10, 2006
Reply to: pers-170018379@craigslist.org
Date: 2006-06-10, 4:52AM EDT
Mein Fraulein,
I hear the weather in the South is good this time of year. Won’t you call me?
///678///248///2352///
* no — it’s NOT ok to contact this poster with services or other commercial interests
170018379
SteveJabs
Jun 10, 2006
After listening to the newest one posted today, it MAY be legit, everything sounds right. I however have not checked out the numbering at the end to see if there are any possible matches. However, on the other board (post 2 for the second number) someone posted that it may be Stream Cipher coding…
http://en.wikipedia.org/wiki/Stream_cipher
http://en.wikipedia.org/wiki/Stream_cipher_attack
tom
Jun 10, 2006
same pattern when groupped in three again… lets do a frequency analysis and compare all 3 messages
Group 134
003 003 002 079 087 022 025 015
075 031 065 010 011 067 027 066
079 064 021 079 021 079 000 072
018 065 016 000 012 008 068 019
018 015 088 031 084 073 029 024
025 006 076 079 013 011 077 095
007 071 018 069 070
matt
Jun 10, 2006
Here’s my first hand count (check my work)
53 groups of 3 digits
Frequencies:
000 – 2
002 – 1
003 – 2
006 – 1
007 – 1
008 – 1
010 – 1
011 – 2
012 – 1
013 – 1
015 – 2
016 – 1
018 – 3
019 – 1
021 – 2
022 – 1
024 – 1
025 – 2
027 – 1
029 – 1
031 – 2
064 – 1
065 – 2
066 – 1
067 – 1
068 – 1
069 – 1
070 – 1
071 – 1
072 – 1
073 – 1
075 – 1
076 – 1
077 – 1
079 – 5
084 – 1
087 – 1
088 – 1
095 – 1
SteveJabs
Jun 10, 2006
The messages appear to be getting smaller…take a look:
New York City – (212) 796-0735
message number: 212 //// 796 //// 0735
Group 415
01305 60510 12079 04606 50100
93000 08203 90130 94069 01207
81080 17028 01706 90220 73038
01401 70150 15073 00402 00680
12013 12510 00540 04091 01401
30150 86022 09608 10660 02082
05507 00020 00000 02208 30290
08022 01200 40710 13065 02709
40190 29014 02200 80020 11083
07300 30260 19000 00700 00000
86
San Francisco – (415) 704-0402
message number: ///415///704///0402///
Group 617
06107 80020 21085 00601 30690
06079 01201 50240 07006 01601
70690 95000 01702 40050 14024
00908 70220 67089 07401 00820
10086 07801 30240 04016 02707
30130 15006 09306 91120 20084
00000 00210 03070 03107 60490
65023 02706 70000 07016 01201
7
Atlanta – (678) 248-2353
message number: ///678///248///2352///
Group 134
00300 30020 79087 02202 50150
75031 06501 00110 67027 06607
90640 21079 02107 90000 72018
06501 60000 12008 06801 90180
15088 03108 40730 29024 02500
60760 79013 01107 70950 07071
01806 9070
Jun 10, 2006
The 212-796-0735 mystery - Homeland Stupidity
Jun 10, 2006
Another phone numbers station: 415-704-0402 - Homeland Stupidity
SteveJabs
Jun 10, 2006
So breaking that down even farther…
# of characters:
message 1) 252
message 2) 201
message 3) 159
differences:
1 & 2) 51
2 & 3) 49
The message is obviously diminishing which makes me feel that these are only parts to messages, not the whole thing itself. Or maybe its like the countdown in independence day and aliens are about to take over the world.
Michael Hampton
Jun 10, 2006
I’m not sure if this message is “fake” or not. I suppose it depends on your definition of fake.
As far as I can tell, it fits the same observable patterns as the previous two. It’s set up on a VoIP line. It has an accompanying posting to Craigslist. It uses the same music and the same recorded spliced numbers.
This doesn’t rule out the possibility, of course, that it’s one huge elaborate prank.
meatstack
Jun 10, 2006
I still think this is viral marketing.
1) it’s summer, early enough for the first salvos of hype for a new series of either Lost or 24?
2) is it possible there was a comment for Boston, but no one saw it? if this theory holds, the next one will be Texas.
3)that’s one of the reasons I don’t think it’s dangrous. If this was terrorism, why would the actors put the next target in the header of the message, unencoded? Wouldn’t that prompt the authorities to monitor that region/Area code to see who buys up some service?
Although, if it is marketing, I wonder if they are getting frustrated that no one has cracked any of it yet. In that case, you would want messages to be longer, as a larger sample would be easier to decode.
Aaron Brazell
Jun 10, 2006
While I don’t claim to be a military insider, my job is one that works closely with military intelligence and I would say that the answer given to the military guy about this being below is classification level IS consistent with a “we can neither confirm nor deny” message. However, my feeling is that if it was not a legitimate “chatter” here, that it would simply be denied.
I think what we can say is that this is of enough interest to the government that they are keeping the lid on it – which of course doesn’t tell us anything more than what we knew before. :)
Ever watch that segment on Letterman “Is this Anything?” That’s what this reminds me of. :)
Jun 10, 2006
The Not So Free State » Blog Archive » Numbers Stations
matt
Jun 10, 2006
it seems like dividing them into groups of 3 may be on the right track.. When you take the length of the number string for all three messages:
1) 252 – 84 groups of 3
2) 201 – 67 groups of 3
3) 159 – 53 groups of 3
their greatest common divisor is 3. so they can only be set in groups of 3 it seems
Aaron Brazell
Jun 10, 2006
This also blows out the theory of the groups being area codes. There is no area code 134.
matt
Jun 10, 2006
goood call.. unless somehow permutations could be involved.. which I doubt.. but just in case,
413 boston
314 Missouri Kansas City, St. Louis
bjuhn
Jun 10, 2006
this posting differs from the previous by _not_ following the pattern:
[groups of numbers] 000 [groups of numbers] 000 000 [groups of numbers] 000 007 [groups of numbers]
questions..
Jun 10, 2006
playing with the numbers some more, there are some things that bother me..
1) if the group isn’t a hint for the next city, then what is it
2) why were those specific cities chosen.. was it because of their area codes, which might give a clue? Where they chosen at random?
*3) How do we write the 3-digit groups out? Now, most of us are looking for patterns, but the originators must have some system to figure out for example, how many columns of 3 digit groups to make. The last two messages have indivisible numbers of groups, so there’s nothing inherent in the message which says how it should be written (as opposed to the inherent GCD of 3 which suggests that they should be written in groups of 3) Therefore, are the arrangements of the slashes in the phone number clues as to how to write the digit groups? If so, how do we interpret that?
4) There are 22 characters put in the slash/phone number string.. why.. what significance could the number 22, or 22 spaces have in the decyphering
5) Based on the patterns and “grammar” of the messages, it almost seems like 1 and 2 were written by the same person, and maybe 3 was the original recipient responding..?
thoughts..?
Dan
Jun 10, 2006
Have the strings of numbers read over a certain phone number ever changed before the number goes dead?
teamchristian
Jun 10, 2006
I just made a post on the 212 blog, but it seems like the action has moved over here.
I’ve been thinking about this, and it just dawned on me. The phrase:
‘Group 415′ , ‘Group 617′ , and now ‘Group 134′.
Group 415: 4 + 1 = 5
Group 617: 6 + 1 = 7
Group 134: 1 + 3 = 4
No clue what that could mean. Also, the seeing the word “group” I can’t help wondering if we’re supposed to literally “group” the numbers somehow. That seems almost too easy though. I’m not sure how one goes about setting up a voip account like one of these, but if you can choose the area code, it would be a clever way to embed the key into the actual number.
I still don’t think it has anything to do with Lost or 24, because a show with corporate sponsors wouldn’t lead avid fans to a site without trying to sell them something.
Michael Hampton
Jun 10, 2006
Dan, there’s been no change in the recorded numbers before the lines go dead in any of the cases.
tm
Jun 10, 2006
This is in response to comment #17 about the signifcance of 22. I think it’s Roger Clemens playing a joke on us…
This was in an AP article the other day: “The number 22 or some variation of it seemed to be everywhere Tuesday night. Not only did Clemens and Drennen both wear it, but also it was written on the base path behind second base, there was an announced attendance of 9,222 and Clemens threw 22 pitches in the first inning.”
Here’s the article, if it matters (I’m sure it doesn’t) http://www.msnbc.msn.com/id/13172388/
gasp
Jun 10, 2006
Everyone predicted the next message was supposed to come from Boston, but this did not. BUT if you do a google search for “Mein Fraulein” the third result is a cached link to
Mein FrauleinMein Fraulein last modified: Tue, 6 Jun 13:12 EDT …
Mein Fraulein, You must call me again soon. ///301///518///8895/// …
boston.craigslist.org/mis/168612997.html
although this would mean there was another message coming from boston again.
Anonymous
Jun 10, 2006
http://boston.craigslist.org/mis/168630660.html
and this one is kind of amusing.
Aaron Brazell
Jun 10, 2006
gasp: That one was picked up and quickly eliminated as a fraud. I personally called that one and got some guys cell phone.
SteveJabs
Jun 10, 2006
@ GASP
That number leads to someone’s cell phone who is more than likely very unhappy at the moment.
Michael Hampton
Jun 10, 2006
gasp, that one was a very annoyed Verizon Wireless user who is going to have a rather large cell phone bill next month thanks to that stupid little prank.
If it had been a real message, I would have posted it already. :)
Dan
Jun 10, 2006
What if the encoded message is in Chinese or Arabic and the digits are being given in English just to throw us off?
meatstack
Jun 10, 2006
teamchristian on 19:
Interesting theory on the group issue.
As for Commercial marketing, I would direct your attention to:
http://www.thehansofoundation.org/ for Lost
The now offline http://www.ourcolony.net for xbox360
and http://www.ilovebees.com for Halo.
This could very well just be the first “salvo” of puzzles. other communications could come soon.
tm
Jun 10, 2006
Yeah I also did a Google search for “Mein Fraulein” earlier today and came up with a couple myspace pages, a song by Thin Lizy, lot’s of blogs, and some stories or something like that… not really sure what they were… way too long to read. Nothing really jumped out at me as being important though.
Do we actually know if the May 12 message was the first one and that we haven’t missed any since then?
Joe West
Jun 10, 2006
east… west… south…. north.
devils advocate
Jun 10, 2006
Never Eat Shredded Wheat
some dude
Jun 10, 2006
area code 1000- = 134
so this one might be in reverse? just a thought about the area code deal
some dude
Jun 10, 2006
oops brackets dont work 1000- area code 678 (reverse the 678 then u get 876) = 143
some dude
Jun 10, 2006
i really need an edit button
some dude
Jun 10, 2006
and i cant add lol its 134+ 876 = 1010 so yea im just smoking too much ;)
devils advocate
Jun 10, 2006
All the talk of Lost reminds me of the only episode I saw there they heard a radio transmission that was looped and figured out the timeframe based on the increasing number between the loop and the length of the loop. (somethine like loop = 7 seconds, number between loop 1489 so in theory 1489×7seconds is how long ago it was transmitted, but looking back that doesn’t account for the time spent saying the number, which is a second or two at most, said almost 15000 times, it adds up.
that is all.
Sam Fisher
Jun 10, 2006
I’ve had a few guess about this whole thing. And be the way Joe West thanks for clearing things about up my name. I haven’t had any word yet from my CO. I’d like to share some of my guess with you guys though. Experince in my field leads me to these thoughts. Now I’m now crytologist or anything but at some point I’m going to bound to run into something like this. Some of my theorys are, these are from metropolitan areas. Many of which have FBI bases. Can we say moles? How about spies within our FBI bases communcating with each other? Another is like what Joe had said I said. Terrorist cells. I also think there may be just one more legit post. Maybe more but I think the next one might peice all of there together and finally anwser our quetions. There are multiple things here many of which I wish I could anwser. My intrest with this is very high. Not many things get my intrest either. Keep up the good work guys. If I here anything that I’m allowed to release (or not for that matter even if I hear anything period) I’ll let you know.
ipdb
Jun 10, 2006
In case it is char/word substitution… I’ve added the new message to my JS decoder page…
-
http://ipdb.ath.cx/_pubtest/jsdec.asp
-
Who knows… it might come in handy.
(and yes.. this message doesn’t use what I’d consider to be double CRLF’s, but still makes use of single ones.)
I think whoever is writing these.. is putting in more patterns for us to learn from.. intentionally..
“003 003″ … “021 079 021 079″
Dan
Jun 10, 2006
Oops. I guess that was pretty stupid, what I said a few posts up – sorry y’all – I guess I should have said something like, what if the actual message is in some other language (Chinese, Hindi, Turkish, whatever) but encoded using arabic numerals to throw us off?
There’s probably no answer to that but my last post was so stupid I wanted to correct it. I’ll shut up now. :)
Q
Jun 11, 2006
it started may 8th. thats a clue in itself,
what was going on in the world on that day that
promted this “spy” to try to contact his or her “handler”?
or is it vice versa.
i am checking the drudgereport for snapshots of world news that day.
im gonna have to read a lot of articles.
jim
Jun 11, 2006
Post #19, I was just thinking.. this seems like it might be a point… if its true, then why would they specify all 3 numbers, 4 + 1 = 5? Everyone knows that 4+1 = 5, but that might only need to be specified if one were starting with 5, and needed to find hte numbers that added up to it -> (4+1)
I was thinking, maybe we should substitute or “group” 41 for whereever we see a 5, but that doens’t seem to give anything useful…
other ideas?
jim
Jun 11, 2006
on the other hand, they would only need to specify 2 numbers (1+4) in order to say do something to the 5, sense one could guess 1+4=5… unless there was no shared secret to add the first two numbers…
blah..
jim
Jun 11, 2006
I just noticed, that in the third set, there is a large gap between the bottom half of hte numbers, and the upper half.. maybe they should be treated as and seperated into two different alphabet groups, not as one
jim
Jun 11, 2006
///678///248///2352///
Group 134
003 003 002 022 025 015
031 010 011 027
021 021 000
018 016 000 012 008 019
018 015 031 029 024
025 006 013 011
007 018
079 087
075 065 067 066
079 064 079 079 072
065 068
088 084 073
076 079 077 095
071 069 070
Matt
Jun 11, 2006
I don’t speak German, but couldn’t “mein fraulein” be correct if you were referring to a man whose codename was simply “fraulein?”
That, or it could be an informant in the CIA or NSA or something, writing code messages to a journalist, who speaks no German at all.
flx
Jun 11, 2006
in german language “mein Fraulein” is absolutely correct (except of the umlaut ä instead of a).
“meine Fraulein” is wrong, because “Fraulein” is gender neutral and not feminine. “Das Fräulein”, “Mein Fräulein”
“Die Frau”, “Meine Frau”.
http://dict.leo.org/ende?search=Fr%E4ulein
bjuhn
Jun 11, 2006
someone posted frequencies for the first two messages, heres all three:
group 415 group 617 group 134000-009 **************** ****************** ********
010-019 ********************** ****************** ************
020-029 *********** ************ ********
030-039 *** * **
040-049 * *
050-059 **** *
060-069 ****** ***** *****
070-079 ****** ******** ***********
080-089 ******* ****** **
090-099 ***** **
100-109 **
110-119 *
120-128 *
bjuhn
Jun 11, 2006
it stole my spaces :(
group 415000-009 ****************
010-019 **********************
020-029 ***********
030-039 ***
040-049 *
050-059 ****
060-069 ******
070-079 ******
080-089 *******
090-099 *****
100-109 **
110-119
120-128 *
group 617
000-009 ******************
010-019 ******************
020-029 ************
030-039 *
040-049 *
050-059 *
060-069 *****
070-079 ********
080-089 ******
090-099 **
100-109
110-119 *
120-128
group 134
000-009 ********
010-019 ************
020-029 ********
030-039 **
040-049
050-059
060-069 *****
070-079 ***********
080-089 **
090-099
100-109
110-119
120-128
ScubaSteve
Jun 11, 2006
Very similar frequencies (when broken into deciles), especially considering the relative brevity of the last “message.” What types of ciphers would NOT produce this type of pattern? What types of ciphers would?
It doesn’t seem that the “Group numbers” would be for inputs into an Enigma machine (or related encryption method) due to the similar frequencies.
From what I can gather from my wikipedia research, frequency analysis is the biggest obstacle to most encryption methods. If this one is subject to such analysis maybe there’s a shot at solving it.
This all assumes, however, that breaking the numbers into groups of 10 (arbitrarily) isn’t forcing patterns that don’t actually exist in the given numbers.
tom
Jun 11, 2006
I agree.. what reason do we have for the groups of 10? however given that there are now three messages and over 150 3-digit groups, maybe there’s enough data for an individual analyses
euhnegro
Jun 11, 2006
Hey!
What if really that zero in front, ex.:
0 03
0 03
0 02
0 79
0 87
0 22
0 25
0 15
0 75
0 31
… go on!
So, it might be like a cartesian plain. You know coordinates in an xy axis of 10×10. I tried, I didn’t get much success, but probably someone will.
tm
Jun 11, 2006
Ok. I want Ipdb, Sam Fisher, and Dan to work on EuhNegro’s cartesian plain theory.
I’m gonna have another beer. Thanks guys.
euhnegro
Jun 11, 2006
Ok, didn’t worked at all… it is a big mess…
Anyway, I got another idea. What about trying something German. I remember about this group called which operates from Germany. They had (or have) something in place called blinken lights. If you go to its webpage you can download some tools to make your owns movies and stuff. Blinken lights
You will see that the patern for this screen is 18×8. So when you put together all the numbers you get something like this:
Group 415:
013056051012079046
065010093000082039
013094069012078108
017028017069022073
038014017015015073
004020068012013125
100054004091014013
015086022096081066
002082055070002000
000022083029008022
012004071013065027
094019029014022008
002011083073003026
019000007000000086
Group 617:
061078002021085006
013069006079012015
024007006016017069
095000017024005014
024009087022067089
074010082010086078
013024004016027073
013015006093069112
020084000000021003
070031076049065023
027067000007016012
017
Group 134:
003003002079087022
025015075031065010
011067027066079064
021079021079000072
018065016000012008
068019018015088031
084073029024025006
076079013011077095
007071018069070
Convenientely the first group 415 matches all of them into a range of 18 characters per line. Then the following two groups if you put them together they match to an 18 characters per line aswell. I’m trying with the tools there to get some sort of message. So far I got not much, but I think the clue is at the Group 415, 617 and 134. Unfortunately I own a PC which runs windows, there are more tools for Mac and Unix systems. Please give it a try
So far there’s only 34 rows. So I believe to have the whole message we might need an 8 multiple. I believe the next number(if there is) might have 5 complete lines and a last broken one. We’ll see.
Anyway it’s a thought, I’ll keep digging and let you know.
MooglyGuy
Jun 12, 2006
euhnegro, I am highly doubtful that your theories hold water.
Jun 12, 2006
TitaniumHalo » Third Numbers VoIP Message
ipdb
Jun 12, 2006
ditto!!
As I’ve said before… use the patterns to decide where to go next.. – Don’t just try random cyphers… because it will not work and you’ll be stepping away from the pattern.
In almost all cases where people have tried to do something else with these numbers… I’ve just thought..
“what are you doing?? there’s nothing to suggest that course of action.. in fact, there are reasons why it’s stupid to even follow that route!!”
There is NO, I repeat NO evidence of complex cyphers being used in this code.
It’s not stream cipher, it’s not bacon cypher, it’s not OTP, it’s nothing to do with binary/hex/octal/etc representations (it’s just base-10/decimal), there’s no Cartesian Plane (or if there was, it’d be damn near a straight line going by the theory presented.. which would kinda defeat the point of the Cartesian Plane), the frequencies are proof that the data is NOT random/scrambled/encrypted.
Doing anything to this data that destroys it’s already-present patterns… is taking a step away from the solution. The only thing really needed… is to work out what each of these values (1-125) equate to…
I’m convinced it’s no more complex than that.
Michael R
Jun 12, 2006
Ipdb, for what it’s worth I think you’re on the right track. This list might be useful: http://www.comp.lancs.ac.uk/ucrel/bncfreq/samples/120.pdf
There seem to be two peaks in the frequency distribution of the numbers (thanks bjuhn) – one at about 15 and one at about 75. The first peak seems to be broader in the later (and shorter) messages, while the second peak seems to be narrower…
Johan Louwers
Jun 12, 2006
I am not so sure that euhnegro is on the wrong track here. During the ‘Off the hook’ show there was a letter mentioned send to the show where someone was claiming that they where behind this and that it was all a prank to promote the hope 6 conference.
Blinkenlights is done by a couple of people from the German CCC and 2600 and CCC have close ties. Also blinkenlights is coming to the hope 6 conference.
Here an example of a very simple Blinkenlights Movie how it looks in the text editor:
@200
000000000000000000
000011100011100000
000111110111110000
000111111111110000
000011111111100000
000000111110000000
000000001000000000
000000000000000000
@800
000011100011100000
000111110111110000
001111111111111000
001111111111111000
000111111111110000
000011111111100000
000000111110000000
000000001000000000
Each frame starts with a @ followed by its delay time in milliseconds. @1000 equals 1 second. Following this comes the image. Every image consists of 8 lines with 18 digits each. A 1 represents a switched-on lamp while a 0 stands for complete darkness.
You may put any number of comment lines between the identification line and the first frame. They must be preceded by a # character. The end of line my be a CR (ASCII 13), a LF (ASCII 10) or CRLF (ASCII 13 + ASCII 10). We recommend saving your file with LF. Two frames may be seperated by one or more empty lines.
Maybe the groups are representing the milliseconds a frame should appear on the ‘screen’. Maybe it is up to us to think about a way to change this into a Blinkenlights movie. For those who do not own a Linux machine there is a windows tool you can download: http://www.blinkenlights.de/blinkentools.en.html bm_play.exe (Windows)
q
Jun 12, 2006
I can’t find any significant news event’s for may 8th anyone else?
some things taht did cause me to ponder…
some austrian politician used the phrase “heil” as a
greeting in the open, and defended it when he was questioned.
this nuclear crap with iran, those “canadian terrorists”
hadn’t been caught yet, maybe it was them.
go back a day earlier and
the goverment was denying raids on immigrants,
the vatican was announcing its protest of davici code,
china announced that it made artificial rain.
so far nothing…
Michael Hampton
Jun 12, 2006
I suspect you’re going to need more information before you could put these messages into a context of ongoing world affairs.
Richard John
Jun 12, 2006
Johan, although I have no clue what you are talking about, those are clearly hearts.
Q
Jun 12, 2006
the code group could very well be an indicator of location,
maybe not area code, even though that was an
interesting coincidence
other things that one may consider:
the date and time it was sent,
for better accuracy, it would be prudent to also factor in the
amount of time it would take to set up a message like that,
the events of the the week leading up to the time the message was sent
traffic analyzing it, locations of where it came from and
where it’s going,
things i know about Craigslist and how they might be relevant.
i frequent CL a lot, and i can say that the way
the phone number was posted is something that you have to do if you
want to be able to leave a phone number in those posts,
some people spell out the numbers so i don’t think that has anything to
do with the code.
if we are using SECOM for decoding, perhaps, the note in the post
is the pass phrase maybe in another language?
or perhaps the group number refers the
recipient to what page of a predetermined book the pass phrase is on?
Craig’s will not divulge the info of posters without a subpoena,
but their database is easily hackable, and they don’t really
mind too much as long as you cause absolutely no disruption
to the site itself or any of it’s servers.
the German is old school, the poster probably has used this system on
CL a lot and this is the first time it was actually noticed,
we don’t know that for sure, unless someone goes through
Internet archives and checks.
many people are saying this has to be a hoax
because its so obvious and screams for attention,
but in reality it doesn’t like i said earlier, this may be one of
hundreds of these messages, that no one noticed,
the posts expire after a few days. this time someone who knows
someone at 2600 noticed it, then everyone jumped on it after they
reported it, but if that didn’t happen I’m willing to bet the
amount of people looking into it would be a great deal less.
SKYWALKER107
Jun 12, 2006
We may want to look at things that happened after may 8th. Could this have been a message to do something or expect something to become public?
cybrpunk
Jun 12, 2006
I’ve been thinking about these things… If this was, other than the delivery method, a classic number station, then it leaves the receiver open to being traced. Sure, the number of people calling it is now kinda high, and there might be safety in numbers, but suppose it hadn’t gotten our attention? If the authorities knew about these voicemail numbers, they’d have a lock on who was calling. 30 seconds to trace and then 6.5 minutes to dispatch an officer might be enough to catch a suspect, or at least get a photo of him.
Which implies that the sender and receiver don’t care about traces. To me, that means that its a branch of the US sending the message, and its probably being received by agents in a country closely allied with the US.
Why would anyone do this? I keep thinking that it must be being used by someone in circumstances where a shortwave radio would seem out of place but a phone (cell? landline? payphone?) and an internet connection would not.
To me, this more likely adds up to messages to a US operative IN THE US than a spy in Russia or what have you. I’m wondering if its for someone cozying up to the next would be 9/11 bombers, or maybe the DEA or FBI is taking a page out of NSA’s playbook for communicating with Hell’s Angels informants or something.
tom
Jun 12, 2006
Here are the individual frequency counts for each number, for each message, and for the sum of all 3 messages. Maybe this will help with any matching applications
Message 1 Distribution:
84
000 6 7.14%
002 3 3.57%
003 1 1.19%
004 3 3.57%
007 1 1.19%
008 2 2.38%
010 1 1.19%
011 1 1.19%
012 4 4.76%
013 5 5.95%
014 3 3.57%
015 3 3.57%
017 3 3.57%
019 2 2.38%
020 1 1.19%
022 5 5.95%
026 1 1.19%
027 1 1.19%
028 1 1.19%
029 2 2.38%
038 1 1.19%
039 1 1.19%
046 1 1.19%
051 1 1.19%
054 1 1.19%
055 1 1.19%
056 1 1.19%
065 2 2.38%
066 1 1.19%
068 1 1.19%
069 2 2.38%
070 1 1.19%
071 1 1.19%
073 3 3.57%
078 1 1.19%
079 1 1.19%
081 1 1.19%
082 2 2.38%
083 2 2.38%
086 2 2.38%
091 1 1.19%
093 1 1.19%
094 2 2.38%
096 1 1.19%
100 1 1.19%
108 1 1.19%
125 1 1.19%
Message 2 Distribution:
67
000 4 5.97%
002 1 1.49%
003 1 1.49%
004 1 1.49%
005 1 1.49%
006 4 5.97%
007 2 2.99%
009 1 1.49%
010 2 2.99%
012 2 2.99%
013 3 4.48%
014 1 1.49%
015 2 2.99%
016 3 4.48%
017 3 4.48%
020 1 1.49%
021 2 2.99%
022 1 1.49%
023 1 1.49%
024 4 5.97%
027 2 2.99%
031 1 1.49%
049 1 1.49%
061 1 1.49%
065 1 1.49%
067 2 2.99%
069 3 4.48%
070 1 1.49%
073 1 1.49%
074 1 1.49%
076 1 1.49%
078 2 2.99%
079 1 1.49%
082 1 1.49%
084 1 1.49%
085 1 1.49%
086 1 1.49%
087 1 1.49%
089 1 1.49%
093 1 1.49%
095 1 1.49%
112 1 1.49%
Message 3 Distribution:
53
000 2 3.77%
002 1 1.89%
003 2 3.77%
006 1 1.89%
007 1 1.89%
008 1 1.89%
010 1 1.89%
011 2 3.77%
012 1 1.89%
013 1 1.89%
015 2 3.77%
016 1 1.89%
018 3 5.66%
019 1 1.89%
021 2 3.77%
022 1 1.89%
024 1 1.89%
025 2 3.77%
027 1 1.89%
029 1 1.89%
031 2 3.77%
064 1 1.89%
065 2 3.77%
066 1 1.89%
067 1 1.89%
068 1 1.89%
069 1 1.89%
070 1 1.89%
071 1 1.89%
072 1 1.89%
073 1 1.89%
075 1 1.89%
076 1 1.89%
077 1 1.89%
079 5 9.43%
084 1 1.89%
087 1 1.89%
088 1 1.89%
095 1 1.89%
Entire Distribution:
204
000 12 5.88%
002 5 2.45%
003 4 1.96%
004 4 1.96%
005 1 0.49%
006 5 2.45%
007 4 1.96%
008 3 1.47%
009 1 0.49%
010 4 1.96%
011 3 1.47%
012 7 3.43%
013 9 4.41%
014 4 1.96%
015 7 3.43%
016 4 1.96%
017 6 2.94%
018 3 1.47%
019 3 1.47%
020 2 0.98%
021 4 1.96%
022 7 3.43%
023 1 0.49%
024 5 2.45%
025 2 0.98%
026 1 0.49%
027 4 1.96%
028 1 0.49%
029 3 1.47%
031 3 1.47%
038 1 0.49%
039 1 0.49%
046 1 0.49%
049 1 0.49%
051 1 0.49%
054 1 0.49%
055 1 0.49%
056 1 0.49%
061 1 0.49%
064 1 0.49%
065 5 2.45%
066 2 0.98%
067 3 1.47%
068 2 0.98%
069 6 2.94%
070 3 1.47%
071 2 0.98%
072 1 0.49%
073 5 2.45%
074 1 0.49%
075 1 0.49%
076 2 0.98%
077 1 0.49%
078 3 1.47%
079 7 3.43%
081 1 0.49%
082 3 1.47%
083 2 0.98%
084 2 0.98%
085 1 0.49%
086 3 1.47%
087 2 0.98%
088 1 0.49%
089 1 0.49%
091 1 0.49%
093 2 0.98%
094 2 0.98%
095 2 0.98%
096 1 0.49%
100 1 0.49%
108 1 0.49%
112 1 0.49%
125 1 0.49%
Q
Jun 12, 2006
bear in mind, the sender s using VoIP which can not be traced to the user if the user does not provide accurate contact info, the accounts were prepaid, and the receiver could simply use prepaid cell phones, those require no names or identifying info either.
tom
Jun 12, 2006
and sorted by frequency:
0 12 5.88%
13 9 4.41%
12 7 3.43%
15 7 3.43%
22 7 3.43%
79 7 3.43%
17 6 2.94%
69 6 2.94%
2 5 2.45%
6 5 2.45%
24 5 2.45%
65 5 2.45%
73 5 2.45%
3 4 1.96%
4 4 1.96%
7 4 1.96%
10 4 1.96%
14 4 1.96%
16 4 1.96%
21 4 1.96%
27 4 1.96%
8 3 1.47%
11 3 1.47%
18 3 1.47%
19 3 1.47%
29 3 1.47%
31 3 1.47%
67 3 1.47%
70 3 1.47%
78 3 1.47%
82 3 1.47%
86 3 1.47%
20 2 0.98%
25 2 0.98%
66 2 0.98%
68 2 0.98%
71 2 0.98%
76 2 0.98%
83 2 0.98%
84 2 0.98%
87 2 0.98%
93 2 0.98%
94 2 0.98%
95 2 0.98%
5 1 0.49%
9 1 0.49%
23 1 0.49%
26 1 0.49%
28 1 0.49%
38 1 0.49%
39 1 0.49%
46 1 0.49%
49 1 0.49%
51 1 0.49%
54 1 0.49%
55 1 0.49%
56 1 0.49%
61 1 0.49%
64 1 0.49%
72 1 0.49%
74 1 0.49%
75 1 0.49%
77 1 0.49%
81 1 0.49%
85 1 0.49%
88 1 0.49%
89 1 0.49%
91 1 0.49%
96 1 0.49%
100 1 0.49%
108 1 0.49%
112 1 0.49%
125 1 0.49%
Q
Jun 12, 2006
also,the poster who set up the Voip account could have used a prepaid cell connected to the internet. again making this an excellent way to remain anonymous
tom
Jun 12, 2006
it would help to know which words in the english language can be repeated..
someone has already suggested ‘that’. what else?
Q
Jun 12, 2006
there are many ways to get online with high speed outside your “home”, tapping into other peoples wifi, g3 cell phones with prepaid acounts and a data cable, cell phone tumbling, internet cafes and fake CC numbers, easy to generate with simple programs.
librarys, any one of the millions of free aol cds all over the place, the list goes on…
so it is in fact quite secure and safe
skywalker107
Jun 12, 2006
I have a copy of the Army Crypto guide and it has a listing of unique words based on patterns and letter counts. The Most popular letters depending on the reference text from most common are E N T O R I A S The patterns in this guide show simple AA to A(2)A(1)A (numbers in para = number of characters seperating specific character in question. I have come up with a couple words that fit into the patterns but they don’t make sense throughout the codes. i am stuck wording if there is some type of offset that needs to be cracked in order to open the code up for a couple decypher.
I guess another code group would help a lot in figuring this out
Q
Jun 12, 2006
that seems like it may work is thart a hard copy or pdf? in other words can you share it? or lead me to my own copy?
Ben
Jun 12, 2006
tom comment 67: the most common words are function words and auxillary nouns. ‘the’ is the most common, because it occurs before almost every noun, and every sentence almost always has a noun, if not two or three.
So the most common words are basically determiners/articles (the, those, a, that) functional words like common prepositions (on, to, at, with), common auxillary verbs (was, were, be), and common pronouns (I, he, she, they) etc.
If you do a frequency distribution of words in virtually any English text – say a novel – you will have to go through all those words before you start getting to common words in the text. For example, the most common word in the novel Neuromancer (which I once did an assignment on based on this sort of stuff) will be the, at, of, in, to, etc. and stuff like the main character’s name Case, or Wintermute etc. will be like the 30th or 40th more common word.
Johan Louwers
Jun 13, 2006
Richard John, you are damn right it are hearts. ;-). Let me explain my thoughts, this entire spynumber thing came to life when it was aired during the radio show ‘off the hook’ a show done by the people of 2600. They have there conference coming up ‘hope six’ and the people of the German hacker club CCC will be there attending with there ‘blinking lights’ project. A project to display images/movies using the windows of a apartment building. Every window is a ‘pixel’.
If you see the code for the hearts animation there is some resemblance to the code of the numbers. I am not saying this is it but I am saying this could all turn out to be a promotion stunt pulled by the hackers from 2600 and the CCC.
It was already mentioned in there show that they received claims this was the case. It could be very well that we have to decode this message to a blinking lights movie.
Take a read on http://www.blinkenlights.de ;-)
ipdb
Jun 13, 2006
Johan… surely if these were 18-bit representations… we would NOT see the frequency and range that we have seen here!?
It’d almost certainly be a larger range (at least 0-255)… and less predictable than what we have found so far.
They could be 8-bit representations… but that’d mean the far-left column of the visual representation would always be blank.
Think “bit-wise”… look at the frequencies again, look at the range. – There’s nothing there to corroborate that theory in the data we have.
sam
Jun 13, 2006
heres a script I put together in Ruby to help interpret this. Calculates frequencies, and displays the messages in a given number of columns. For those who find it useful..
class Message
require 'enumerator'
attr_reader :names, :index, :raw
def initialize(list)
info = File.open(list, "r"){|f| f.read}.gsub(/\n/,' ')
@raw,@names = info.split, info.split.sort
freq
end
def freq
@index = {}
puts @names.length
@names.uniq.collect {|group|
count = @names.select{|x| x.eql?(group)}.length
@index[group] = [count, count*100/@names.length.to_f]
}
end
def show_freq
index.each {|k,v| printf("#{k} #{v[0].to_s} %.2f%\n",v[1]) }
end
def show_cols(n)
@raw.each_slice(n) {|g| puts g.join(' ')}
end
end
a = Message.new("message1.txt")
a.show_freq
a.show_cols(4)
SKYWALKER107
Jun 13, 2006
It is a group of PDF files all from an army document.
I downloaded it about a year ago from somewhere on the internet.
http://www.socug.com/crypto.zip
I believe it is appendix d that has the word lists. the whole document is a great read for those of you that don’t understand cryptoanalysis.
Thebleedingthruth
Jun 13, 2006
13 5 6 51 12 79 46 6 5 1 93 82 3 9 13 94 69 12 7 81 8 17 28 17 6 9 22 73 38 14 1 7 15 15 73 4 2 68 12 13 1251 54 4 91 14 1 3 15 86 22 96 8 1 66 2 82 55 7 2 22 8 3 29 8 22 12 4 71 13 65 27 9 4 19 29 14 22 8 2 11 83 73 3 26 19 7 86 61 7 8 2 21 85 6 1 3 69 6 79 12 1 5 24 7 6 16 1 7 69 95 17 2 4 5 14 24 9 8 7 22 67 89 74 1 82 1 86 78 1 3 24 4 16 27 7 3 13 15 6 93 6 9112 2 84 21 3 7 31 7 6 49 65 23 27 6 7 7 16 12 1 7 3 3 2 79 87 22 2 5 15 75 31 65 1 11 67 27 66 7 9 64 21 79 21 7 9 72 18 65 1 6 12 8 68 1 9 18 15 88 31 8 4 73 29 24 25 6 76 79 13 11 7 7 95 7 71 18 6 9 7
This is the grouping of all three messages (doubles removed) once all of the zeroes have been taken out.
Is there any significance to the two groups of four, when the rest are either two or one digit(s)?
cybrpunk
Jun 13, 2006
Johan: your suggestion is very interesting, but your beleif that the first call was brought to the geek-world’s attention by 2600 is wrong. It first appeared on the spooks mailing list (http://www.cvni.net/radio/nsnl/) who later took it to the guys at 2600 who then discussed it on their radio show. That doesn’t mean that its not a game put on by 2600, but it makes it less likely.
Johan Louwers
Jun 13, 2006
Cybrpunk,
One of the quite active members of the spooks mailing list is one of the co-hosts of the ‘Off the Hook’ radio show. This could mean that they hade a hand in it. I do not know who posted the first message to the spooks mailing list but it very well could be the people from 2600. I am not saying they did it I am only saying I will not be very surprised if it turns out to be true and a hoax to promote the convention.
If they are behind this I think it is a great prank ;-)
head8k
Jun 13, 2006
I contacted BlinkenLights to ask if they were behind the messages and they denied it and had no idea what I was talking about!
Anonymous
Jun 13, 2006
i’m writing some scripts to manipulate the data and run *tests
* on it to test out any theories people have. It currently takes the raw data, breaks it into groups of x, writes it in x columns, calculates the frequency of all groups, takes any potential dictionary (song lyrics) and matches the 3-digit groups ot the words inteh lyrics (and also jus tthe unique words), and other stuff
I’m looking for more ideas of things to add to the program. I”ll try to put everything on a website so that its easy to access and manipulate.
What i’d like though, is for people to give me ideas of what other functions to put in… suggest something, i’ll try to implement it, and you can play with it when its done
Thanks! (fun for me to get batter at scripting)
tom
Jun 13, 2006
i’m writing some scripts to manipulate the data and run *tests
* on it to test out any theories people have. It currently takes the raw data, breaks it into groups of x, writes it in x columns, calculates the frequency of all groups, takes any potential dictionary (song lyrics) and matches the 3-digit groups ot the words inteh lyrics (and also jus tthe unique words), and other stuff
I’m looking for more ideas of things to add to the program. I”ll try to put everything on a website so that its easy to access and manipulate.
What i’d like though, is for people to give me ideas of what other functions to put in… suggest something, i’ll try to implement it, and you can play with it when its done
Thanks! (fun for me to get batter at scripting)
SKYWALKER107
Jun 13, 2006
one thing i would suggest is some type of pattern finder. have the program compare all the data sets to look for unique patterns. like the same 2 groups in a row multiple times or something along those lines. right now i am manually going through the groups looking for patterns and such. My next step is to approach this as a stream cypher and start working it from that angle.
ScubaSteve
Jun 13, 2006
There are a rather large amount of numbers here and maybe different numbers stand for the same letter, number, or word. (For instance, 003 and and, say, 086 could both stand for the letter R.)
A script could make light work of various ways to force a span of some 125 numbers into just 26 letters. I’ve tried some modular arithmetic to fit the square pegs into a rounder hole, but it is taking much too long by hand.
cybrpunk
Jun 13, 2006
Correction: the spooks mailing list is at http://mailman.qth.net/mailman/listinfo/spooks.
Here is the first posting in the spooks archive:
J. Random Entity jrandomentity at gmail.com
Thu May 11 11:03:10 EDT 2006
* Previous message: [Spooks] Automated Spy Numbers Loggings
* Next message: [Spooks] Need help identifying something weird
* Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Hi folks,
Been following numbers stations for a few years now and have run into
something that I need help identifying. My apologies if this isn’t
the right place to be asking, and if someone could point me in the
right direction I’d definitely appreciate it.
Anyway, what I found sounds like a numbers station, only it’s by
phone. I ran across it on craigslist of all places (actually, a
friend of mine found it and passed it on to me). Can anyone verify
what this is? The post in question is at
http://newyork.craigslist.org/mnh/mis/158815074.html ; I’ll reproduce
the text below in case it gets pulled.
Subject: For mein fraulein
Message: Mein Fraulein, I haven’t heard from you in a while. Won’t you
call me? 212 //// 796 //// 0735
The message at that number runs for around seven minutes and I’m at
work so can’t grab audio of it; it starts and ends with music and
reads off a bunch of numbers in groups. The voices reading the
numbers sound like – well, imagine the stereotypical ransom note cut
out from letters in the newspaper glued together. Anyway, if someone
could check it out and let me know what they think (or point me to
somewhere to ask the question) I’d appreciate it. Maybe it’s some
weird telephone company test number or something?
Thanks,
John.
—- And here is the first mention of 2600:
KD7JYK, 49H7KR kd7jyk at earthlink.net
Thu May 11 17:46:31 EDT 2006
* Previous message: [Spooks] Need help identifying something weird
* Next message: [Spooks] Need help identifying something weird
* Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Someone should ask the guys at 2600.
Kurt
—–
None of which confirms or denies your point Johan, I just figured that I would do this legwork because I misdirected people.
Jun 13, 2006
The Lunatic Fringe » Blog Archive » Blinkenlights Conspiracy
Johan Louwers
Jun 14, 2006
Cybrpunk,
Thanks for putting in this work. I am not completely convinced the 2600 guys are behind this thing but I will not be very surprised if it turns out that this is there prank in the end.
But if this is a 2600 prank or not I think we still have a ‘puzzle’ to solve as we are still unaware of the meaning of those messages. If we can solve it we might be able to trace it back to 2600 or not ;-)
Or we can try to work the other way around, try to find the source first but if it turns out that the guys of 2600 are not behind this I am not sure if I wont to find the source of the messages.
SKYWALKER107
Jun 14, 2006
The first step would be to have the folks at craigslist at least give us some information about the poster. What IP’s did those 3 posts originate from? Where they all the same or all different. If someone is really being sneaky then they should be all different. If they are all the same then this is ment to be solved. I still wonder if there are more messages we may have missed due to no publicity.
Johan Louwers
Jun 14, 2006
Is there no ‘willing’ employee of ‘Global Crossing’ out there that can provide us with some details about who owned the number during the time the number was active. A bill-to address would be very nice ;-)
Johan Louwers
Jun 14, 2006
SKYWALKER107,
Have you tried to mail to the people of craigslist to request their help? Maybe it turns out that they are very co-operative to solve this mystery.
la
Jun 14, 2006
The ip thing is (almost) completely useless.. its trvially easy to set up an anonymous proxy, or ssh tunnel, so the person could make it seem like they were comming from taiwan, south africa, or Brazil..
Johan Louwers
Jun 14, 2006
SKYWALKER107,
We might want to send Craig and Jim a mail to request there help to solve this search and ask them for the IP addresses of who posted those messages but I have a feeling we will hit a brick wall when we request it due to the fact they have a reputation to hold up.
Anyway there mail addresses are here if you feel up to it you can send the request: craig@craigslist.org, jim@craigslist.org
If you send them a mail please post it here and also post the answer you receive from them. ;-)
SKYWALKER107
Jun 14, 2006
I e-mailed craigslist. I will let everyone know what I find out. Probably not a lot but we’ll see. My thought here is that if they did orginate from the same IP address or at least 2 of the same ip addresses then we might have a real game on our hands versus any type of real spy commincation.
Johan Louwers
Jun 14, 2006
La,
This is correct. But I think we have to give it a shot as we do not know if they used a proxy or not. And even if they did we might be able to gain some more knowledge about them when we have more information. I think it is worth the try.
Johan Louwers
Jun 14, 2006
At least we are trying to get some more information. We might fail, we might hit people who are not cooperating that all might be true but he,…. as long as we do not try we will never know. We also might try to social engineer the telco’s to find out some more about the owner of the numbers. Let me think some more about this before we start working on this option.
SKYWALKER107
Jun 14, 2006
Craig / Jim,
A bunch of Netizens over at www.homelandstupidity.us are trying to uncover more information in regards to the mystery “number station†phone numbers. We are not asking you to breach confidentiality. We are just asking for hints.
http://atlanta.craigslist.org/mis/170018379.html
http://www.craigslist.org/sfc/mis/165936352.html
http://newyork.craigslist.org/mnh/mis/158815074.html
Do the three posts in question have any commonality between them by the poster?
If you do an address lookup on the IP’s, does it come back with anything interesting? Like some type of marketing company or a company that would hint to us that, this is a puzzle to be solved and not a private communiqué.
Any help would be greatly appreciated. We are currently discussing these mysterious numbers at http://www.homelandstupidity.us/2006/06/10/third-phone-numbers-station-678-248-2352/
Thanks
Johan Louwers
Jun 14, 2006
Just been reading the ‘CRAIGSLIST TERMS OF USE’
http://www.craigslist.org/about/terms.of.use.html
6. PRIVACY AND INFORMATION DISCLOSURE
Your use of the craigslist website or the Service signifies acknowledgement of
and agreement to our Privacy Policy. You further acknowledge and agree that
craigslist may, in its sole discretion, preserve or disclose your Content,
as well as your information, such as email addresses, IP addresses, timestamps,
and other user information, if required to do so by law or in the good faith
belief that such preservation or disclosure is reasonably necessary to:
comply with legal process; enforce these Terms; respond to claims that any
Content violates the rights of third-parties; respond to claims that contact
information (e.g. phone number, street address) of a third-party has been
posted or transmitted without their consent or as a form of harrassment;
protect the rights, property, or personal safety of craigslist, its users or
the general public.
SKYWALKER107
Jun 14, 2006
Sweet we have a shot at a good response.
Johan Louwers
Jun 14, 2006
Well at least we have a good shot and we now know almost fore sure that they are storing this information. It could also have been that they where not logging this information to be sure nobody could ever ask for it, not even by a court order.
As they have it they can retrieve it. Now the question is are they willing to do so. We might have a change because of the general public part in “form of harrassment;
protect the rights, property, or personal safety of craigslist, its users or
the general public.â€.
We just might have a change ;-)
milambyr
Jun 14, 2006
The notes of the music…
ipdb
Jun 14, 2006
Heh… They’ll have probably used a proxy. But good luck with the query anyway!
ipdb
Jun 14, 2006
Tom…
Before you even bother trying to manipulate the data in weird and wonderful ways… look at the data itself… and think whether shifting bits or creating alterate values is supported by the “characteristics”/”behaviour” of the numbers we’ve already established.
Most complex cyphers, and most things involving changing the actual values presented… detract from the pattern.
If it’s any type bit-shifting, we would have a range of values that almost definitely (>99%) would include a number between 127-255… so you can rule that out.
A stream cypher (at least as ascii) is also contradicted by this range. (as “A”=65 and “a”=97 … it’s highly unlikely)
There’s not much to indicate that manipulating the numbers is needed. Just, recognizing their meaning is the hurdle.
Tom
Jun 14, 2006
ipdb,
I agree with you.. I personally think that the numbers are best interpreted as they are..
but the question is how?
i’m not seeing that many patterns in the data – there are
1) the string of 000
2) 007 and 086 which look like signatures
3) repeating numbers in the 3 msg, and rare repeats in the other messages
4) I some number groups come in close promity to each other betwene the 1st two messages, but nothing that really stands out..
i’m stumped… do you have any ideas?
ipdb
Jun 14, 2006
Well.. the basic pattern I’m referring to are the sets of 3.
1) The string of “000″ I believe is the equivalent to a CRLF.
2) I agree that “007″ and “086″ appear to be words that can be used on a line by themselves… like a signature… or some kind of ’sign-off’ (like ‘goodbye’ but “007″’s use elsewhere indicates that it isn’t that particular word – [I had though "later" was possible... but I'm unsure of that... because I wouldn't expect "later" to be as common as it appears.])
3) I think the repeating numbers in the last message were intentional… and I believe the purpose of those repetitions was to give us clues as to what some of the answer may be. But that’s merely speculation, of course.
4) I believe those numbers you’re referring to relate to “is”, “the” and something else (“it”??)… with “013″ being “the”. (but the latest message.. and the lack of “013″’s is making me question that)
I’m not suggesting anyone give up on any ideas or scripts, etc.. I’m just warning against spending time on scripting to manipulate the numbers… when the numbers we have… indicate it would be fruitless. (like stream cipher, bit-shifting, etc.)
Tremblor
Jun 14, 2006
I Hope this isn’t the case, but if it is part of a marketing scheme.. that is that new “da vinci code” tv show starting soon. A recent trend in viral marketing has popped up, this would be a clever way to intrigue people. Perhaps a bit to thick for most people, maybe its a stab at getting the computer contingent to watch the show. I assume someone has tried to google (being the most popular) these numbers to see if they pop up anywhere else, that would suggest a marketing gimmick
Mellisslynn
Jun 14, 2006
Hey guys,
Just a bored girl here, reading all of your interesting theories….. I guess i just wanted to comment on the attempt to get info from the craigslist folks.
The people at craigslist see fit to remove these posts almost immediately, why? One might assume that perhaps they are afraid of being a tool for some type of illegal activity? If in fact that is the case, then most likely they would already have found the similarities if any in the posters information, and it is doubtful that any info would released to the common people, more likely it would be reported to the authorities.
OR. the craigslist people feel , as several here have thought, that these posts are some type of marketing ploy/advertisement. There is a section of terms of use that state that marketing or advertising posts may be removed if they are in a catagory not designated for such.
If thats the case, it is still doubtful that they would release information about the poster/s. It is in their sole discretion, and Im guessing they would require strong reasons for doling out any info.
Hey, thats just my opinion…. but please keep up the theories….. its quite entertaining…. ;)
Mellissa
sb404
Jun 15, 2006
Don’t want to add to the burdens, but I have been closely monitoring this since it first appeared on shoutcast, about two weeks ago. I still haven’t found anyone that mentioned anything about a grid encryption. Where the group number would refert to something that might resemble a stencil to block out certain parts of the message and get only that’s needed out of it. The rest is just there to throw people off.
As for publicity stunt, TV is oriented towards people of a ‘lesser’ caliber than the people I have seen working the numbers here. Right there and then, this leads me to believe that the marketing stunt would be limited to something very “elite”. I have listened to the latest Off the Hook, where someone wrote in about 2600’s envolvement in this. After listening to that show, I am convinced they are not in on it.
Alright… granted, they are social engineers, so I might just 80% sure they have nothing to do with this. =)
Another possibily is that this is part of a decryption key. Like with PGP, the real problem is getting the key out to the person that is supposed to decoding the message. That’s why there’s a public key that is sent. If this is serious cryptology, it could be just that, a “public” key that when applied to the real message (which could be sent over normal communication channels), decodes it.
Anyways, food for thought. I truely enjoy this thread. Keep up the posts.
sb
Johan Louwers
Jun 15, 2006
Mellissa ,
You wrote “The people at craigslist see fit to remove these posts almost immediately, why?†This is one of the questions that kept me thinking this night. As morning has come I still do not have a strait answer.
What is the rule of removing a posting on craigslist? Can somebody that is using craigslist please explain what the rules are. Is a message removed after some time automatically? Can you remove your own messages? Can someone using the system explain how this system is working?
joe
Jun 15, 2006
We’re not even sur ethe people who run CL DID remove these messages..
Every message that gets posted on CL has a feature where the public can “flag” it.. If enough people flag a message as offensive, miscategoried, spam, etc, then the message is automatically removed
The people who run CL probably don’t even have an idea, since so many messages get automatically flagged every day
mindless sattelite
Jun 15, 2006
notes-DEAGABDEAGABDBAG (repeated)
SKYWALKER107
Jun 15, 2006
what is that suppose to mean??
mindless sattelite
Jun 15, 2006
its the notes of the tones in the song
mindless sattelite
Jun 15, 2006
oh, and another thing, the way its broken up, including spaces, the notes in the song sequence go like this – DEAGAB DEAGAB DBAG
hmm…i think the significance here is obvious
Johan Louwers
Jun 15, 2006
Listening to the latest ‘off the hook’ show the VIC cipher was mentioned by one of the listeners. I checked it up and found the following two ciphers might be a possible candidate for solving this.
Please keep in mind it could be a spin-off of one of those ciphers or even have nothing to do with it.
http://www.hypermaths.org/quadibloc/crypto/pp1324.htm
http://users.telenet.be/d.rijmenants/en/secom.htm
Or an other possibility the PPC-XX cipher:
http://users.telenet.be/d.rijmenants/en/ppc-xx.htm
By the way skywalker107 did we receive any answer on the mail send to Craigslist?
lol
Jun 15, 2006
ummm.. no its not..
care to point it out?
SKYWALKER107
Jun 15, 2006
I think he is getting at the 5 digit repeating pattern in the first part of the notes… now how to use that is another mystery.
Johan Louwers
Jun 15, 2006
I have been playing with the secom cipher but have not been able to use it to decode the message using the song text from the intro song. Also I do have the feeling that if this cipher or a cipher like it should be used you should first do something with the group code to change the numbers in the message. In a message encrypted with a cypher like this there is not a patron like the 3 number patron we found.
As a example I encrypted the following text:
‘This is a normal text encrypted with the secom cipher to show the people on the website what can be done using this cipher’
Using the song text (first 20 letters = ‘IneversawsunlightBur’) as the key you will get the following code:
23374 77421 19349 22990 21988
65988 77237 92727 93837 23767
99620 75527 96266 59953 47939
29929 49379 66279 49445 99939
29019 63243 35997 12643 50762
67627 96469 27367 32971 99277
41730 39122 33222 20799 74944
76741 97196
This however has not a patron like the numbers ‘broadcasted’ on the phonenumbers, no option to easily put it in 3 number groups. Just wanted to post this so it could give someone a hint…. Or not… ;-)
SKYWALKER107
Jun 15, 2006
One thing i can’t understand is why this message was not were we thought it was going to be. are we still going to get a message on the 19th in boston? was this message out of order becuase it was a reply to the other 2? did we miss other messages before and in between the other 2. also noticed something new but probably unrelated: http://newyork.craigslist.org/mnh/mis/170744468.html. Babelfish says it translates to “and who is that woman flax?”.
http://newyork.craigslist.org/mnh/mis/171293689.html
Kaylene
Jun 15, 2006
Just a thought that came up as I wandered into this. I’ve read all of the comments and just wanted to say that, while I don’t think it’s necessarily significant, I noticed that the three messages were
1) East Coast, West Coast, East Coast.
2) The first initial of each city (N*ew York, S*an Francisco, A*tlanta) spell NSA. That’s probably coincidence or a joke by the originator. I’m not implying that the NSA is involved, as that would be too blatantly obvious.
Just some observations that I noticed had not been mentioned, but might be useful to…someone. Perhaps making something click in someone’s mind. ;)
Kaylene
Jun 15, 2006
Also, this was posted on June 13th at 10:28 pm EDT in the New York section of “missed connections”.
Mein Fraulein – m4w
Probably a fake, but I have no money and no way to call this number to see. Posting for those who didn’t see it since it wasn’t mentioned anywere.
SKYWALKER107
Jun 15, 2006
that number is registered in fremont, ca to pac bell and has been disconnected.
hax
Jun 15, 2006
wow…
good spot kaylene… def either a joke, o ran NSA recruiting thing =P
Kaylene
Jun 15, 2006
Thanks. These things kind of spook me a bit. My husband is into EVP (?) and that’s worse. I’ve heard this stuff on our shortwave before, but until the last week or two never realized what it was. Now I’m obsessed, it seems. Hope someone figures it out, as I know that I do it. Should be interesting.
Michael Hampton
Jun 15, 2006
That’s yet another fake, obviously because it has too many digits! If you remove one of the digits you get various bureaucrats at the City of Fremont, e.g. 6800 = Police Department.
Kaylene
Jun 15, 2006
I know when I type things I occasionally hit a number, and the one next to it, or hit one and hold it down too long so that two of the number are typed. So, that was a conceivable human error. I agree, though, which is why I thought it was a fake. That and the insistent tone in the message, which was not really in keeping with the formal, innocuous tone of the previous messages. I find it strange that the message mentioning “the South” was supposedly from Atlanta, which is in the South, for all practical purposes. And besides, weather in the South is definitely NOT good this time of year, as we are in a drought with unusually high temperatures. What is the significance of this disinformation?
Also, it appears that when purchasing a VoIP phone number, you can choose your area code. What is the significance of the locations used here, if any, since they may have been hand picked by someone living anywhere in the world.
Just more thoughts from an untrained mind.
SKYWALKER107
Jun 15, 2006
No direct answer from craigslist. Craig did respond to me with a thinking about it type of comment. but i don’t think he wants to give that info out.
Kaylene
Jun 15, 2006
In comment #122, I meant “Hope someone figures it out, as I know that I CAN’T do it.”
Johan Louwers
Jun 15, 2006
Thanks for the update skywalker107, I was wondering if we heard anything back from those guys. Can you please post there answer even if it is not a answer we where hoping fore?
Johan Louwers
Jun 15, 2006
I have tested and checked a couple of different ciphers to see how a key would look like.
I encrypted the same text with every cipher. The clear text read:
‘This is a normal text encrypted with the secom cipher to show the people on the website what can be done using this cipher’
I have to thank Dirk Rijmenant for the valubale information and tools on his website http://users.telenet.be/d.rijmenants/index.htm
Please see the findings below:
————————————————————–
ADFGVX cipher:
“The ADFGVX cipher was the most important German Field cipher, used during World War I. It combines the fractioning of a Polybius Square with a single Columnar Transposition. Although this combination provided a powerfull encryption, Georges Painvin, a brilliant Frensh codebreaker, succeeded in breaking the German cipher. The letters ADFGVX were chosen because they were well distinguist in morse code.â€
Square Key: IneversawsunlightBur
Columnar Key: ruBthgilnuswasrevenI
Encrypted message:
DFDXD XGDAF FDXFF FFDXA FGAXG ADFFG AFXFA GAADA AADGG GGGFD
AFXAA AFFAD DFFDD XADAG AFGAV AXGXD XXDAD GFGFA AAAFA DFDAD
GFADX FAFFV DFXFA AGFAA AVFFD AAADX GGXXA GDXFX VADDA FAGGF
VGGGX VAAXX AXDXF GVGAG GGXGV XXAXA FGXAA GFDDG VFAAG FDD
————————————————————–
————————————————————–
Caesar Shift cipher:
The Caesar Shift cipher, also called ROT cipher, is a simple substitution cipher. It was used by Julius Caesar the encrypt messages to his commanders in the field.
Shift key: I
Encrypted message:
BPQAQ AIVWZ UITBM FBMVK ZGXBM LEQBP BPMAM KWUKQ XPMZB WAPWE
BPMXM WXTMW VBPME MJAQB MEPIB KIVJM LWVMC AQVOB PQAKQ XPMZ
————————————————————–
————————————————————–
columnar transposition cipher:
To perform a single columnar transposition we write out the key as column header. The key is numbered in alphabetical order. If two letters of the key are the same, the first in the key gets the lowest number.
Columnar Key: IneversawsunlightBur
Encrypted message:
NIHSN EMLNE IPEHN IETWU EEETI XCOCP TRPND TSPAC LEEHS HYHTO
AHHWI SDOES CIOEA WSBIR HWTTT OPAHM TTEHN CEBRS TREEO TOIG
————————————————————–
————————————————————–
Double Columnar Transposition:
A variant of the Single Columnar Transposition is the Double Columnar Transposition, where two columnar transpositions with two different keys is performed on the plain text. The Double Columnar Transposition was one of the strongest field ciphers, commonly used in Worl War II. If the key was used only for a limited number of messages, it provided a very high security.
1stColumnar Key: IneversawsunlightBur
2nd Columnar Key: ruBthgilnuswasrevenI
Encrypted message:
EPHTE HEEOE ITSOT TPOAI EXHWC NISAN MCYSE UCSML OHBBN CTIRW
AEHGN ELCTN DITOI TAHTH NWTES THEHI EEITE PORSE SDPOP RHWR
————————————————————–
————————————————————–
Playfair:
Playfair is a digraph cipher, invented in 1854 by Sir Charles Wheatstone. We encrypt the text in groups of two letters.
Playfare key: IneversawsunlightBur
Encrypted message:
BTSGS GHAZL FUWCW EKWRH VZXGI KSEBT BTIWR TDOGR QGVIC KAGKL
BTIXR KZSRK EHTNT WGUEG WTFHB GHATV FDEVL ANEHB GNLGS ITNEZ
————————————————————–
————————————————————–
Straddling CheckerBoard:
The Straddling CheckerBoard is a fractionating cipher. It breaks the letters into seperate parts by an X and Y value. This priciple is also used on the Bifid and Trifid cipher. The advantage of the Straddling Checkerboard is the way of distributing the parts. The commonly used letters have only one value, the other letters two value. This improves the resistance to letter frequency analyse. This cipher is often combined with a transposition cipher to make it stronger.
CheckerBoard Key: IneversawsunlightBur
Encrypted message:
52601 78017 84783 98284 20785 67657 86325 87774 56227 87305
26785 26678 16259 28782 50742 66878 59781 26973 78526 67874
69742 06789 37852 66787 36241 05678 73264 57825 43782 46782
29367 87210 32378 52601 78250 74266 8
————————————————————–
————————————————————–
straddling checkerboard with double columnar:
The most powerfull pencil-and-paper ciphers are those who combine fractionation and transposition. In this example we encrypt with a straddling checkerboard, followed by a double columnar transposition. To decrypt the message we reverse the encryption sequence. A variant of this methode is the famouse VIC-cipher from the Russian Spy Reino Hayhanen. It resisted all cryptanalysis attemps and remained unbroken until the defection of Hayhanen in ‘57.
CheckerBoard Key: IneversawsunlightBur
1stColumnar Key: IneversawsunlightBur
2nd Columnar Key: ruBthgilnuswasrevenI
Encrypted message:
82856 89213 74328 67688 27851 78251 53677 87792 60682 92086
25486 38890 28572 62876 88712 49472 86562 65754 65589 86770
26337 77207 25307 28079 66242 38817 76487 57778 02670 62242
68612 76534 57423 57708 77615 64837 7
————————————————————–
————————————————————–
Vigenère cipher:
The Vigenère cipher, invented by Giovanni Batista Belaso, is a poly- alphabetic substitution cipher. It remained unbroken for twohundred years, until Charles Babbage in 1854 found a way to retrieving the key lenght and performed multilple letter-frequency analysis on the code text. Even today, many novice crypto programmers write, without knowing, variations on the Vigenére cipher, not realizing they can all be broken with cryptanalysis, based on Babbage’s methode.
Vigenère key: IneversawsunlightBur
Encrypted message:
BUMNM JSNKJ GNWBK EMFHT ZLTOI UOIPZ NUPAK JHNWZ XUIMX FKHKO
NUPXK VIMYF VGLZA VTSEL YJSIZ JTOVV LBRZY JANCL BVDKO WAFL
————————————————————–
Looking at the results let me believe that non of the ciphers will be able to decode the pure message. It could however be that when we alter the original message with some algorithm that one of the ciphers might be able to decode the message.
If it is not changed in characters we might have a shot with the secom cipher, straddling checkerboard with double columnar chipher or Straddling CheckerBoard cipher.
However we do not know if we possibly have to change the numbers into characters. I do however have the feeling that this might be the case and that they have to be translated using a book cipher of some sort as we can see a pattern which possibly indicates we can translate it to 3 number groups instead of 5 number groups.
Michael R
Jun 15, 2006
Johan, this looks promising! The straddling checkerboard takes a 10-digit key (a phone number? what about repeated digits?) and encodes each letter or number as one or two digits…
s
Jun 15, 2006
I agree with you Johan.. maybe we should brainstorm on possible keys as well
I was thinking, maybe the messages in the craiglist posts could be the keys?
SKYWALKER107
Jun 15, 2006
I think the group number and the telephone number are the key to breaking this. it is the only other pieces of information that the reciever is getting at the time of the message it is possible it is a 13 key phone number + group number?
Jun 15, 2006
FORT90.com
mindless sattelite
Jun 15, 2006
once again, i’m going to point to the NOTES of the song. DEAGAB…D.E.A. Gab? there’s lots of speculation that somshortwave numbers stations may have something to do with the illegal drug trade.
mindless sattelite
Jun 15, 2006
*some shortwave
tm
Jun 15, 2006
OK… Drug Enforcement Administration (DEA)
What’s GAB?
mindless sattelite
Jun 15, 2006
gab Audio pronunciation of “gab” ( P ) Pronunciation Key (gb) Slang
intr.v. gabbed, gab·bing, gabs
To talk idly or incessantly, as about trivial matters.
tm
Jun 15, 2006
Wow… WOW.
That’s it? You should have just said it in your 1st post.
tm
Jun 15, 2006
What about DBAG? What’s the “obvious significance” there?
mindless sattelite
Jun 15, 2006
who knows? listen, this is about as concrete as anyone else’s thoery. odds are, if the message IS ciphered, no one’s EVER figuring it out. so don’t criticize those who are at least *trying*.
mindless sattelite
Jun 15, 2006
i don’t know. i know that marijuana dealers sell in denominations called dime bags. (DBAG?) that’s about all i can think of.
Michael R
Jun 15, 2006
The phone number can’t be the 10-digit checkerboard key because of repeated digits, but the key could be generated from the phone number: “assign 1 to the smallest digit, and so on, treating 0 as the last number, and assigning digits in order to identical digits”.
The group number might tell us where to put the three gaps in ESTONIA, either by specifying the column numbers where the gaps should go (columns 1,3,4) or by specifying which digits of the key should have gaps under them (meaning the group number would also appear on the left side of the checkerboard).
Wikipedia has a slightly different version of the straddling checkerboard.
Or alternatively, maybe the first 20 letters of the message (MEINFRAULEINIHEARTHE) are the SECOM keyphrase? All three messages differ in the first 20 letters.
s
Jun 15, 2006
do secom keys only have 20 chars, or can that be a diff (higher or lower) number?
tm
Jun 15, 2006
or…
definition of dbag (slang term)
A general term that stems from a shortening of douschebag or douchebag; can be used in many ways:
A)Can sometimes be used as a playful insult among friends, especially if one of them has done something stupid or absentminded;
B)Can be used as a semi-serious insult, as when person A has actually been offended by a comment or action done by person B, but person A does not wish to get into fight; he merely wants to express his annoyance;
C)a common nickname for people in the 2006 class at Cincinnati Country Day School; synonyms in this situation are douschebag, douchebag, douchefuck, chickenshit, and dumbass.
A) Guy 1: Dude, I stayed up all night writing this King Lear paper for my english teacher
Guy 2: Haha, you dbag, you’re gonna fuck up on your Physics test now.
Guy 1: Shit! I completely forgot about it!
B) Guy 1: You dbag, why did you ditch me at the movies last friday?
Guy 2: I’m sorry man, I got the munchies.
C) TJ: I called Dbag last night; he said he’s up for the Halo tourney
Keesh: Which Dbag? Pierce, Lang, Odin, Johnny Gill, or Tim?
Looking at the notes was a great idea… don’t get me wrong. But I don’t want you to waste too much time on it. Because the abbreviations could mean anything. How do you know GAB is actually supposed to be the dictionary definition? That’s my point.
I don’t want to get into a pissing match. Peace. Good luck.
mindless sattelite
Jun 15, 2006
yeah, we’ve all got the same goal. i just found it weird that a) there were no sharps or flats used and b) the notes repeated the phrase DEA twice.
kind of perked my interest.
i’m sure it’s nothing.
Michael R
Jun 15, 2006
As far as I can tell the SECOM key has to be 20 letters because it’s broken up into two groups of 10, which are used to generate a permutation of the digits 0-9. A similar method is used by VIC, which seems to be what SECOM was derived from. The more I read about these pencil and paper ciphers, the less confident I am that we’ll ever crack this. :-)
Brad
Jun 15, 2006
Not sure if this helps or not, but the telephone numbers themselves “spell” the following using the letter associated with the digits on a telephone keypad. Or perhaps a telephone keypad itself is the keypad the listener uses, using coded numbers to spell out messages…
212-796-0735 spells:
a-1-cry-60-pelt
a-1-cry-60-rely
a-1-cry-60-self
a-1-cry-60-sell
a-1-as-960-pelt
a-1-as-960-rely
a-1-as-960-self
a-1-as-960-sell
The second number (415 area code spells nothing…at least not in English).
678-248-2352 spells:
opt-bit-ad-la
opt-bit-be-la
opt-bit-bel-a
opt-chub-el-a
opt-cit-ad-la
opt-cit-be-la
opt-cit-bel-a
or-tag-tad-la
6-stag-tad-la
6-such-tad-la
opt-a-I-tad-la
opt-a-hub-el-a
opt-a-it-ad-la
opt-a-it-be-la
opt-a-it-bel-a
opt-bit-a-el-a
opt-cit-a-el-a
or-ta-I-tad-la
or-ta-hub-el-a
or-ta-it-ad-la
or-ta-it-be-la
or-ta-it-bel-a
or-tag-ta-el-a
6-pub-I-tad-la
6-pub-hub-el-a
6-pub-it-ad-la
6-pub-it-be-la
6-pub-it-bel-a
6-qua-I-tad-la
6-qua-hub-el-a
6-qua-it-ad-la
6-qua-it-be-la
6-qua-it-bel-a
6-rub-I-tad-la
6-rub-hub-el-a
6-rub-it-ad-la
6-rub-it-be-la
6-rub-it-bel-a
6-stag-ta-el-a
6-sub-I-tad-la
6-sub-hub-el-a
6-sub-it-ad-la
6-sub-it-be-la
6-sub-it-bel-a
6-such-ta-el-a
opt-a-I-ta-el-a
opt-a-it-a-el-a
or-ta-I-ta-el-a
or-ta-it-a-el-a
6-pub-I-ta-el-a
6-pub-it-a-el-a
6-qua-I-ta-el-a
6-qua-it-a-el-a
6-rub-I-ta-el-a
6-rub-it-a-el-a
6-sub-I-ta-el-a
6-sub-it-a-el-a
Andrew
Jun 15, 2006
Did anyone try keying in the numbers on their phone while listening to the message; I mean, what I’m trying to say is that this isn’t a real number station, in that right at the time of receiving the message the recipient can leave a message and interact with the ’station’. For all we know the recipient just had to key in the right sequence on their phone to hear a message or leave a message… The whole ‘number station’ message could just be to throw people off of realising that this is obviously a computer system you tap into when you call the number…
Matt
Jun 15, 2006
I’m wondering if this is just an elaborate phishing system. Could it be that these are just credit card numbers with expiration dates? The only reason I pose this as a possibility is the “hidden in plain sight” rule. What if the numbers are exactly that, just numbers? I’m am by no means a mathemetician or a cryptologist but I must say that I love observing behaviors and trying to predict what those behaviors mean. Anyway, just a thought from an outsider.
DasKreestof
Jun 15, 2006
As I sit and stare at this I am forced to ponder something, and I’m sure it must have some significance: Why 7 bit numbers?
I am convinced that the 7 bit interpretation is correct, and that we are looking at 3 digit decimal representations of 7 bit numbers.
I don’t think a conversion to binary is used, otherwise, why not use 8 bit? or 16? It would be less wasteful to do so.
In fact, I think this rules out many cipher methods. Many methods using addition and subtraction would move some of the numbers we’re seeing out of the 7 bit range. So I believe that the first action is some kind of transformation of the 7 bit numbers to characters.
I doubt the word substitution theory for the reason that 128 words is very limiting, and new proper nouns would need a way to be communicated.
It’s possible that certain codes indicate something like CRLF, or a classification like DATE.
I know people have put a lot of work into spectral analysis and analyzing the music. I think these are red herrings. The point of the message is to be heard and written down. If it was meant to be recorded and examined, the numbers would be irrelevant to the message because you could hide more information other ways. It would be less obvious if you simply encoded the hidden information in the audio over the sound of what sounds like someones voicemail. Instead, this is a method that’s easily reproduced copied and shared with low technical requirements. The person decoding the message doesn’t even need to be the one copying the numbers down.
As for why I disagree with the musical notes: I think this method of communication is supposed to be simple and low tech. I think requiring an ear of perfect pitch is contrary to that ease of use. The cipher has to be something easily taught. It’s not practical for the code to be something that’s impossible to decipher if the listener mistakes an “A†for a “Gâ€. It’s possible that the song is relevant as to a hint towards which decipher key to use, or it could be used just to hint at authenticity. I have an easier time believing that the choice of the song or it’s lyrics would be significant to the decoding process, instead of the individual notes.
Still, why 7 bit numbers? It’s an inefficient use of space, and I think that’s an important tell. It might not be ASCII, but my suspicion is that it’s similar in form to 7 bit ascii that is further scrambled. Perhaps it’s somehow scrambled by the group number. The fact the number range isn’t fully utilized supports that it’s some sort of scrambled ascii range. I can see that the letter frequency analysis doesn’t point to a standard ascii breakdown. But if one was using a custom ascii range, perhaps indicated by a group number, there would be nothing from preventing more commonly used letters from being spread across multiple numbers, hence reducing their frequency. Eg, the letter e could be 056, 079 and 100. You could repeat the entire alphabet 4 times and still have room for numbers and punctuation. That said, because some number ranges are entirely under represented in frequency, I believe the alphabet is probably only repeated twice within the range.
I also doubt that this is mainstream viral marketing. If it’s a joke, somebody is putting money into this joke by purchasing these VOIP accounts. I believe it’s possible that is a true attempt at coded communication.
f
Jun 16, 2006
can someone explain what a 7-bit number is?
thanks
Michael Hampton
Jun 16, 2006
f, see:
http://en.wikipedia.org/wiki/Binary_numeral_system
http://en.wikipedia.org/wiki/ASCII
Vernon Dozier
Jun 16, 2006
There are a lot of smart folks here, so I hope I don’t dumb down the conversation too much. The first thing that struck me was that the voice that says “six” sounds just like radio host Phil Hendrie (and the number six is in the phone number he gives out on the air). The voice with the english type accent could easily be a character he does named Herb Sewell. The show is all about fooling listeners, and he’s been known for his pranks. Frankly, I don’t think this is the case here, but maybe worth considering. Or not. www.philhendrieshow.com
Johan Louwers
Jun 16, 2006
I do not know the show Phil Hendrie makes but I have taken a quick glimpse on the website you mentioned. Not to say anything against Phil Hendrie but I do have the feeling this not exactly the kind of joke’s he is playing.
If this is a joke in the end it was intended to be joke played on the geek community, if this is a joke it is a sophisticated joke and the person(s) who created this joke took the time to do research and ‘develop’ the joke. He also have put in some money likely to get the numbers and all. I think it is not a Phil Hendrie prank because it is not targeted to his normal public. Please correct me if I am wrong ;-)
Johan Louwers
Jun 16, 2006
The current problem I have with the SECOM cipher, CheckerBoard cipher and straddling checkerboard with double columnar cipher is that if we look at the original message there is a clear pattern indicating that we can divide the 5 number groups into 3 number groups. If we hade only a single message we could speculate this was coincidence, however now we received 3 message of which I think 2 are from the original creator for sure, this is no coincidence in my opinion.
It could be I am overlooking something in the messages I posted as a example but I can not see a clear pattern. If one of those ciphers is the correct cipher I think we have to manipulate the original message before deciphering it using one of the ciphers mentioned before.
Original message:
—————————————-
Group 617
06107 80020 21085 00601 30690
06079 01201 50240 07006 01601
70690 95000 01702 40050 14024
00908 70220 67089 07401 00820
10086 07801 30240 04016 02707
30130 15006 09306 91120 20084
00000 00210 03070 03107 60490
65023 02706 70000 07016 01201
7
—————————————-
SECOM cipher:
—————————————-
23374 77421 19349 22990 21988
65988 77237 92727 93837 23767
99620 75527 96266 59953 47939
29929 49379 66279 49445 99939
29019 63243 35997 12643 50762
67627 96469 27367 32971 99277
41730 39122 33222 20799 74944
76741 97196
—————————————-
CheckerBoard cipher:
—————————————-
52601 78017 84783 98284 20785
67657 86325 87774 56227 87305
26785 26678 16259 28782 50742
66878 59781 26973 78526 67874
69742 06789 37852 66787 36241
05678 73264 57825 43782 46782
29367 87210 32378 52601 78250
74266 8
—————————————-
straddling checkerboard with double columnar cipher:
—————————————-
82856 89213 74328 67688 27851
78251 53677 87792 60682 92086
25486 38890 28572 62876 88712
49472 86562 65754 65589 86770
26337 77207 25307 28079 66242
38817 76487 57778 02670 62242
68612 76534 57423 57708 77615
64837 7
—————————————-
f
Jun 16, 2006
Johan,
What if we strip the padding 0’s from the original message, and run the cyphers on the resulting text?
Johan Louwers
Jun 16, 2006
Hi f, sounds like we can try that, however what do you suggest we use a decipher key(s) for every cipher?
f
Jun 16, 2006
As someone said,
the key mus thave been sent along with the code.. what if we try the messages
You must call me again soon
I haven’t heard from you in a while
I hear the weather in the South is good this time of year
Sander
Jun 16, 2006
Did anyone notice that the first two messages on Craigslist both appeared on a Monday, with exactly 3 weeks between them? The third however, was posted on a Saturday, 12 days after the second message.
The shortwave numbers-stations usually have/had fixed times and frequencies for airing. I think it would be logical if the creator of these voip-messages also used a pattern. Since the messages disappear so quickly from Craigslist, a field agent would have to put quite some time in checking for messages if there was no pattern.
In this theory, the next message would appear next Monday (19th) and could well be in Boston (Wil Wheaton’s theory). That would make this third one a copycat…
On the encryption part, can the city the message was post in have anything to do with the cipher? This could be basic: the field agent has a codebook with different ciphers who are identified with city-names.
Johan Louwers
Jun 16, 2006
Changed the 5 digit groups to 3 digit groups:
—————————————–
013 056 051 012 079
046 065 010 093 000
082 039 013 094 069
012 078 108 017 028
017 069 022 073 038
014 017 015 015 073
004 020 068 012 013
125 100 054 004 091
014 013 015 086 022
096 081 066 002 082
055 070 002 000 000
022 083 029 008 022
012 004 071 013 065
027 094 019 029 014
022 008 002 011 083
073 003 026 019 000
007 000 000 086
—————————————–
Removing all the leading zero’s (also ‘translated 000 into 0 and for example 002 in 2)
—————————————–
13565 11279 46651 09308 23913
94691 27810 81728 17692 27338
14171 51573 42068 12131 25100
54491 14131 58622 96816 62825
57020 02283 29822 12471 13652
79419 29142 28211 83733 26190
70008 6
—————————————–
I ran this with all the 3 key’s using the straddling Checkerboard
Key: Youmustcallmeagainso
—————————————–
IRTETIISWOEETIANRAKRNIRNOENISUIALZLXNSS RLOI.TIT OSAELSIRISTIAATOONIIOIRITHSSNELEESKTTPSAASSMSNKSISO.IRETSWOINSNIOSSKIIM RSEINAPAAH
—————————————–
Key: Ihaventheardfromyoui
—————————————–
GTSTDRA.SSTFWOERNUN.SURAEFEBREBS RANNELBCCANIROSEMGMTFOTIIULGCESRRZEKSRERTTAOROORRENRXRRMIADNSTRA.JRUIRRERDENANNRSJOAOOOES
—————————————–
Key: Iheartheweatherinthe
—————————————–
OSTQOOBERYTOIESINKEOSERXOBNOINOAGOAXDASSNOROAOTOTASRLWOFSOCOIITRREOOROSOTNUHWOYGCTAILIDNSHNDOMAOOSQBEROEHORDNFONSASSJOEIAIIIN
—————————————–
Johan Louwers
Jun 16, 2006
Secom cipher is also giving only a lot of junk and no good results.. or we are unable to determine how we have to read the results. It could be it is a step to the solution but not the complete solution. It could be the combination of more than a single cipher however this will only make it harder to find the final solution.
CodeAc
Jun 16, 2006
I’ve heard a lot of speculation that the third Instance is a “copy-cat”
If its true that the third message is bogus then Sanders post above make s alot of sense.
This theroy could also be more proof that the 2600 guys are not behind this assuming that the 4th message gets posted the 19th and if theres a 5th message that would be scheduled for the 10th of July. if 2600 was doing this as a promo for Hope Number Six it would make perfect more sense to have the messages scheduled to have a 5th one appear either the Monday before the conferance or the Monday after.
f
Jun 16, 2006
Hey Johan,
I think you’re right… i’m going to try to program these ciphers myself, and that way it’ll be simple to run one, or a swquential combination of them automatically. Then by having hte program do string searches of the results for words like, (a, and, the) it can stop when its found the right algorithm
Problem though is, as you said.. having potential keys
and finding the key length
it would also be interesting to do a frequency analysis on some of your results, in char groups of 1 or 2, just to see if they follow the frequency distribution of standard english texts. If so, we’ll know we’re on the right track at least
(i think)
Johan Louwers
Jun 16, 2006
Hi f, which coding language are you intended to use? If you code this please use a language that can be easily ported to a Linux/UNIX platform. It would be great if you could code this in C or even Python or Java. What you have to keep in mind is that you will most likely need a lot of processor power and time. Maybe I can reserve some time on the cluster to run some private code during the hours the cluster is not heavily used. Think night time and weekends.
Jun 16, 2006
Cryptanalysis of phone numbers stations - Homeland Stupidity
f
Jun 16, 2006
I was actually thinking Ruby, since it will also help me to get more familiar with its coding style, as well as whip something out quickly. However, it can be run on linux too. I suppose it wouldn’t be too hard to convert to java once ther’s a working version
(writing my Masters paper this week though, so it may be a few days before I get started =) )
Michael Hampton
Jun 16, 2006
I’m closing comments here as I’ve opened a cryptanalysis thread with (I hope) a good summary of what’s known so far.
Jun 20, 2006
Fourth phone numbers station: 617-848-1172 - Homeland Stupidity
Jul 03, 2006
Fourth phone numbers station: 501-588-1015 - Homeland Stupidity
Jul 26, 2006
SecondAgenda : For Mein Fraulein
Jul 28, 2006
Seventh phone numbers station: 414-386-1377 - Homeland Stupidity