WHY HACK? Ah, a beautiful Saturday morning in April. The birds are chirping,the sun is shining, and we’re inside absorbing the glow of our computer screens because we love creating beautiful software. A no brainer, really. CONTACT 65HUNNIDEGREES@GMAIL.COM

Welcome

This page is about the DefCon 20 Badge Contest. This page close to being complete but still being updated. Please add information you may have. Thanks.


Badge Puzzle

  1. Construction Information
  2. Badge Matrix
  3. Lanyard Puzzle
  4. Making Friends / Dump EEPROM puzzle
  5. Rotunda Puzzle
    1. Project NOVA
    2. White Hare
  6. Neck Puzzle
  7. Putting Clues Together
    1. Spring Heeled Jack
    2. Lacie
    3. Great Tom
  8. Sign Ciphers
    1. Penn & Teller
    2. Hardware Hacking Village and Lockpick Village
    3. Wireless Village
    4. Entryway Sign
  9. Program Cipher
  10. Nyctographic Notes
  11. Black Sodalitas
  12. End Game
  13. Uber Badge Puzzle
  14. Music Puzzle (New from Saucier)



Construction Information

The DC 20 Badges were produced by Parallax in the USA. Information on their production can be read about at the Parallax Forums. The badge includes an IR transceiver which allowed the badges to "mate" with one another. This was to foster communication between attendees while they were scanning their badges. Using Parallax software one could view what types of badges theirs had mated with, unlocking clues to continue the contest.



Badge Matrix

05front.jpg
Human 5 Front
05back.jpg
Human 5 Back

06front.JPG
Human 6 Front
06back.JPG
Human 6 Back

07front.JPG
Human 7 Front
07back.JPG
Human 7 Back

08front.JPG
Human 8 Front
08back.JPG
Human 8 Back

09front.JPG
Human 9 Front
09back.JPG
Human 9 Back

10front.jpg
Human 10 Front
10back.jpg
Human 10 Back

11front.jpg
Human 11 Front
11back.jpg
Human 11 Back

20front.JPG
Human 20 Front
20back.JPG
Human 20 Back

28front.JPG
Human 28 Front
28back.JPG
Human 28 Back

32front.JPG
Human 32 Front
32back.JPG
Human 32 Back

36front.JPG
Human 36 Front
36back.JPG
Human 36 Back

40front.jpg
Human 40 Front
40back.jpg
Human 40 Back

44front.jpg
Human 44 Front
missing 44 back











Lanyard Puzzle

The lanyard is a trinary (base 3) code, in which the lanyards must be overlaid and read vertically in order to be decoded. The order is decided by the Chinese number printed on the lanyard when they spell out 10-5-7, or Green, Orange, then Yellow.

Here's the green lanyard, for now...
green.jpg

For reasons to be filled in later, the dots correspond to these numbers:
lanyard0.jpg
lanyard1.jpg
lanyard2.jpg
0
1
2
The lanyards spelled out:
Green
2001201110112010002022000100120200002010100001000100220021001012
Orange
0211111120010120200100212211112002121112101221121221001101011022
Yellow
1112202222220122100101110211112121220102111121011211201012110020
Vertical Trinary yields (2 tables for length reasons):
Trinary
201
021
011
112
212
010
112
112
122
002
102
112
200
011
122
002
021
000
200
011
200
201
021
011
020
122
011
011
111
211
022
201
Decimal
19
7
4
14
23
3
14
14
17
2
11
14
18
4
17
2
7
0
18
4
18
19
7
4
6
17
4
4
13
22
8
19
A=0..Z=25
T
H
E
O
X
D
O
O
R
C
L
O
S
E
R
C
H
A
S
E
S
T
H
E
G
R
E
E
N
W
I
T

Trinary
002
021
012
022
210
011
110
022
111
001
011
021
022
111
010
021
011
122
021
011
202
200
011
010
201
112
001
011
110
000
122
220
Decimal
2
7
5
8
21
4
12
8
13
1
4
7
8
13
3
7
4
17
7
4
20
18
4
3
19
14
1
4
12
0
17
24
A=0..Z=25
C
H
F
I
V
E
M
I
N
B
E
H
I
N
D
H
E
R
H
E
U
S
E
D
T
O
B
E
M
A
R
Y
Theoretically, with spaces: THE OX DOOR CLOSER CHASES THE GREEN WITCH FIVE MIN BEHIND HER HE USED TO BE MARY

This information is supposed to lead you to Great Tom, a bell that used to be called Mary, who rings five minute behind GMT (which is Oxford time).



Making Friends / Dumping EEPROM

By mating your badge with all seven other types of badges, and/or dumping the EEPROM and looking for strings, you will be presented with code "10571089" which translates into this URL:
http://www.defcon.org/1057/10571089

You may also find this URL in the EEPROM or by getting flashed by LoST himself"
https://www.defcon.org/1057/LosTisFound/

(What do you mean by "flashed"? I synched with LosT and did not get this second string. Only the first one -- fx)



Rotunda Puzzle

The main rotunda had this image on the floor.
rotunda1.jpg

Around the outer edge was the following number sequence:
26 2 22 13 26 14 22 2 22 9 11 26 7 19 12 13 24 22 2 12 6 9 22 14 12 5 22 14 6 9 23 22 9 12 6 8 24 18 11 19 22 9 2 12 6 19 26 5 22 21 12 6 13 23 7 19 22 11 9 12 17 22 24 7

This turns out to be a reverse, or "Atbash" cipher. A=26, B=25, C=24 ... Z=1. When decoded the message says:
AYE NAME YER PATH ONCE YOU REMOVE MURDEROUS CIPHER YOU HAVE FOUND THE PROJECT

This "AYE" is suggesting you look at the "eye's" on the rotunda floor. Here is a picture of those 4 eyes:
rotunda2.jpg

The four eyes have name. They are:
Eye of Ra
Mu (Chinese character meaning eye)
Eye of Horus
Eye of Providence

By using the clue "remove murderous cipher" and from hearing Lost tweet that the eyes are an anagram the puzzle presents itself with a way to solve this. Simply write all the names of the eyes out and remove "murderous cipher".

RAMUHORUSPROVIDENCE
RAMUHORUSPROVIDENCE

After removing "MURDEROUSCIPHER" what's left is simply the letters AOVN, or an anagram for: NOVA.


Project Nova (from Rotunda)


http://defcon.org/1057/NOVA

This is a yellow page with an image of the Cheshire Cat. The page is titled 404, has morse code which translates to "404," and text saying "This is not the page you're looking for."

By viewing the source on the page, one finds at the bottom:

"<!-- Screw the stupid rabbit. Follow me!-->"

Either by dragging the picture of the cat, or by viewing the .gif file directly, hidden text is revealed around the image to spell out the words "WHITEHARE."


White Hare


http://defcon.org/1057/WhiteHare

This has the same yellow as the previous page, but with this text:

Isn't this fun?
Still stuck?
Have you found the answers to the loop, the floor and the signs?
I can help you, but only a bit:
O Lector! Cave ne illum capias, nam latro Jovi est odius. Ecce!
Why us, eerie whore?

Tho "O Lector" portion is latin. Translate from Latin to English you get:
O Reader! Be careful not to take him for a thief to Jupiter is hatred. Behold!

The sentence "Why us, eerie whore?" could be an anagram that gets turned into: Where iw Horus eye?




Neck Puzzle

On the second floor circle, there is a rendering of a face (picture forthcoming). On the left side of the circle is the numbers "16-1-14-7-18-1-13" which when replacing those numbers with the alphabetic value the word becomes: "PANGRAM". PANGRAM means a sentence that uses every letter of the alphabet. Lost tweeted something about "fox" "jumping" and the neck puzzle which gives the clue that the sentence "the quick brown fox jumps over the lazy dog" is the key to use on the floor puzzle. The floor puzzle on the face was very hard to read if not impossible. 1o57 put it up on a slide at the Badge talk Friday:
floor-neck-detail.jpg

This puzzle is solved by overlaying a grid on the dots. "The quick brown fox jumps over a lazy dog" is at the top.

image.jpeg

By following the lines (starting with the black dots) you will begin to see words come out.

THE BROTHERHOOD IS EVERYWHERE.
The white dots spell:
CODEWORD: SPRINGHEELEDJACK
The red dots (including the other colors their lines connect with) spell:
USE CAUTION FOLLOW WHITE RABBIT



Putting Clues Together



Spring Heeled Jack (from Neck puzzle)

http://defcon.org/1057/SpringHeeledJack

This takes you to a page with the eye of horus a picture of Spring Heeled Jack and the following ciphertext:
ekcaheesuoydoohrehtorbehtpotsrevenlluoyeicalelttildnamottaergdnuofuoyees

Simply reversing this text and adding spaces reveals:
see you found great Tom and little Lacie Youll never stop the brotherhood you see hacke


Lacie (from signs)

http://defcon.org/1057/Lacie

This takes you to a page with a picture of Alice Liddle, the inspiration for Alice in Wonderland, accompanied with this ciphertext:
ehtssapnacuoyfimehtniojdluohsuoyebyamlliwsyawlayehtdnayrotsihtuoguorhtdetsixeevahsr

Reversing and adding spaces like before:
rs have existed througout history and they always will maybe you should join them if you can pass the


Great Tom (from Lanyards)

http://defcon.org/1057/GreatTom

This takes you to a page with a picture of "Great Tom," the hour bell at Tom Tower in Christ Church, Oxford, with this ciphertext:
ydoboneesotelbaebotseyehcusdahihsiwylnoirafsuhtllewytterpgniodebotmeesuoytsetelttilri

Reversing and adding spaces as above reveals:
ir little test you seem to be doing pretty well thus far i only wish i had such eyes to be able to see nobody

Forge of Empires Hack

Concatenating the text from these three pages reveals:
see you found great Tom and little Lacie Youll never stop the brotherhood you see hackers have existed througout history and they always will maybe you should join them if you can pass their little test you seem to be doing pretty well thus far i only wish i had such eyes to be able to see nobody

This text is the OTP key for the text on the DefCon entryway sign.



Sign Ciphers



Penn and Teller

THHCR ICASK ORAVG
WEDOT CMEHI ELSNR
NSEJE NEAOS WMHHY
NENYE EGEDI YULDA
RNOEE EIFDY KRVNS
TPNSS AHCIT BLTMN
RSTTE EDESA GSTXA
ITBAC OAEIX 1057x

Remove spaces and format into 23 columns:

THHCRICASKORAVGWEDOTCME
HIELSNRNSEJENEAOSWMHHYN
ENYEEGEDIYULDARNOEEEIFD
YKRVNSTPNSSAHCITBLTMNRS
TTEEDESAGSTXAITBACOAEIX

Read down and you get this message:

THEY THINK THEYRE CLEVER SENDING SECRETS AND PASSING KEYS SO JUST RELAX AND HAVE A CIGAR IT WONT BE SO BAD WELCOME TO THE MACHINE MY FRIENDS X

Notice the Pink Floyd reference, Welcome to the Machine is on their 1975 album Wish You Were Here.


Hardware Hacking Village and Lockpick Village

LCORR UITPR URHET LOHUE
CGOYT HNEEN EOOUW IHHUO
HOTSL OIFKC EFLBS UEOHA
PONTI KLYOU LCBDO LWSSH
NDLON TYARH UIIES OGAIU
GIDNO AGTTE CUFRM SESOS
TVHTH IHGOE SENEU THEHL
TNOHR YUAOR BOEFE EHSOT

Remove spaces. Format it into columns that are 16 wide.

LCORRUITPRURHETL
OHUECGOYTHNEENEO
OUWIHHUOHOTSLOIF
KCEFLBSUEOHAPONT
IKLYOULCBDOLWSSH
NDLONTYARHUIIESO
GAIUGIDNOAGTTECU
FRMSESOSTVHTHIHG
OESENEUTHEHLTNOH
RYUAORBOEFEEHSOT

Now read the columns downward. Starting on the leftmost side and you get this:

LOOKING FOR CHUCK DARE YOU WELL IM SURE IF YOU SEARCH LONG ENOUGH BUT I SERIOUSLY DOUBT YOU CAN STOP THE BROTHERHOOD HAVE FUN THOUGH HERES A LITTLE HELP WITH THE NOOSE EINSTEINS SCHOOL OF THOUGHT

(Does he mean "Not everything that can be counted counts, and not everything that counts can be counted" ? -- fx)


Wireless Village (we think)

YEIMG OPITO ITPEE
OWNHY TIEUU SIIBR
UOGEO INISL CNDSO
MNWLU MGMIA ATEEU
ADHPI HLJNC UHRET
YEYIM EAUGI GESKX
BRINN LCSYE HSWHX

This cipher is read vertically from the top left:
"You may be wondering why I'm helping you. I'm not. I'm helping Lacie. I'm just using you. Lacie is caught in the spider's web. Seek her out. XX"


Entryway Sign

At registration, there was a sign with a really long cipher on it. This cipher (line breaks added) is:

LVICGWWSUGHGMIIETQDOFVJWNKAEEHCKSJRMEPRPMEZDRCJKVRMPUNPHVHGMR
SGNSRHWOPNIIAUGVGSLTTKIHSLSFCTUMTJPSGUVMFUHTYXRHPLAGFJWWZZGCS
WCSGKACGLWCSZGALLQTQMTNCKVCGSDXHHZFWMBGLGTKWRMIWJIEFXRGSUMWHX
HVPYGMHSYRXYNJTUSTSFRFKALZWMYRMLOPRBCGNVBZEJERHKLLINBTKHP

Using the text from the URL's...
seeyoufoundgreatTomandlittleLacieYoullneverstopthebrotherhoodyouseehacke
rshaveexistedthrougouthistoryandtheyalwayswillmaybeyoushouldjointhemifyoucanpassthe
irlittletestyouseemtobedoingprettywellthusfarionlywishihadsucheyestobeabletoseenobody

Decodes as a OTP to this message:
TREESCREATEAVEILACROSSYOURPATHACOLDSTEELRAILYOURONLYGUIDEASYOUSTANDPONDERINGACOOLBREEZEBRINGSACHANGEOFHEARTTHEPAINNOLONGERSEEMSTOMATTERTHEHELLOFTAKINGALEADROLEINACAGEYOUCREATEDFORYOURSELFNOLONGERTROUBLESGHOSTSOFYOURMINDYOUHAVEITNOWTHEANSWER

Formatted nicely:
Trees create a veil across your path
A cold steel rail your only guide
As you stand pondering a cool breeze
Brings a change of heart
The Pain no longer seems to matter
The hell of taking a lead role in a cage you created for yourself
No longer troubles ghosts of your mind
You have it now the answer




Program Cipher

On page 4 on the program, there is a picture of 1o57 holding cards and an Uber badge, accompanied by this cipher:

ProgramCryptext.jpg
OWWDWUMFUPQBHPSDAAEMNVZAWZCFYRCDGVWCV
JSELMXSHBWAZHNWPUM
MWXAGDOHWPEEDHIEY
MMQAMMCKGMEFIIGOG
NUKPVGSWTBCRHMLAO
IMAFCPFLXWCBEDZCD
HNZEEWRHIWT
FQAEPEPLZT
LEKDRTTJPA
BMYOSPEYSB
TNOLAIIXOIW
RUMILERPLWS
QYPVJWYMWL
TXGCCMOUSB
LJCFWPEXGB
UCAEJYEF
ROMWHLESR
BUCLKNTGBH
TFWIOMICAGPIJ
From the deciphered text on the entryway sign, we are to follow the instructions from "Wish you were here" by Pink Floyd.

From the sign:
Trees create a veil across your path
A cold steel rail your only guide
As you stand pondering a cool breeze
Brings a change of heart
The Pain no longer seems to matter
The hell of taking a lead role in a cage you created for yourself
no longer troubles ghosts of your mind
you have it now the answer

Lyrics:
So, so you think you can tell
Heaven from Hell
Blue skies from pain
Can you tell a green field
From a cold steel rail?
A smile from a veil?
Do you think you can tell?
Did they get you to trade
Your heroes for ghosts?
Hot ashes for trees?
Hot air for a cool breeze?
Cold comfort for change?
And did you exchange
A walk on part in a war
For a lead role in a cage?

Word Exchange:
veil => smile
cold steel rail => green field
ghosts => your heroes
trees => hot ashes
a cool breeze => hot air
change => cold comfort
lead role in a cage => walk on part in the war
pain => blue skies
hell => heaven

This creates:
hot ashes create a smile across your path
A green field your only guide
As you stand pondering hot air
Brings a cold comfort of heart
The blue skies no longer seems to matter
The heaven of taking a walk on part in the war you created for yourself
no longer troubles your heroes of your mind
you have it now the answer

OTP translation:
HIDDEN IN SYMBOLS LOST IN TIME HERE AND NOW WE FORGE THE DIGITAL ROSETTA OF A NEW ERA SURVIVING FOR GENERATIONS WE SEEK ONLY THE WORTHY YOUR TEST ALMOST AT AN END WE ARE ALWAYS SPEAKING FEW ARE LISTENING YOU HAVE HEARD OUR CALL DONT BELIEVE HISTORY BOOKS SOLVE A FINAL TASK AND JOIN US KEYWORD NYCTOGRAPHIC NOTES



Nycrographic Notes


http://defcon.org/1057/nyctographicnotes

Visiting this web page brings you to a message stating that you are close to being worthy of joining our ranks, informing you to send an email to brotherhoodofhorus@g, meaning at gmail.com.

Sending an email results in an autoresponse from TheEye@brotherhoodofhor.us with a message stating "Password: BlackSodalitas"



Black Sodalitas


http://defcon.org/1057/BlackSodalitas

This is the final URL code word, bringing the end game.



End Game


The final page has two parts, first clue:

Only one human legion speaks a true word
Although he blends in with the rest
True to the rules

"Legion" here is a reference to the "Roman Legion" and is pointing to the fact that the text on the back of the human badges corresponds to Roman Numerals, although every one is invalid except for "MIX." This is the first answer.

The second clue is:

Alice:
"Let me see: four times five is twelve,
and four times six is thirteen-
and four times seven is-- oh dear!
I shall never get to twenty at that rate!"
Based on Adams Answer (you know, hitchiker's radix)
Alice knew she couldnt get to defcon XX!
Four times thirteen gave what instead
Knowing of course Alice fills with numbers first
Lowers second then uppers
Hint hitchers ultimate answer is ten to Alice here

This text is straight from Alice in Wonderland. Alice is doing multiplication in increasing bases, or "radix."
4 x 5 = 12 in base 18
4 x 6 = 13 in base 21
4 x 7 = 14 in base 24
4 x 8 = 15 in base 27
4 x 9 = 16 in base 30
4 x 10 = 17 in base 33
4 x 11 = 18 in base 36
4 x 12 = 19 in base 39
4 x 13 = 1A in base 42

Hence, Alice will never get to Defcon 20.

From the Black Sodalitas page:

Take the answer to one in radix 10, tack on the end the answer to two in the Adam's Radix,
and use that as your final code word.

The answer to part one is "MIX" and the answer to part two is "1a" (lowers second then uppers indicating lowercase "a"). MIX = 1009 in base 10, hence the final codeword is "10091a" to be submitted with a badge hack to win the ultimate prize and complete the badge contest.

http://defcon.org/1057/10091a



Uber Badge Puzzle


On the back of the black badge is a new cipher:
uber-back.jpg
QMMDYPSQ
SAMSPMQJ
LTYVRXHB
KYRDSZJY
HBGSNQHQ
BWLVJVPM
FUISDCGW
XATLEOBU
LNIHPCSP
TFPWIISX
WTAMTXSV
HTFLHWVV
NWPPWYIP
LDQFIJWT
YCILZGTX
MUDAFPCU
KPNTOXJS
NVSTMLUX
At the time of this writing there is no solution for this puzzle. It is thought that the pattern that flashes on the human badge once becoming "infected" by an Uber contains the solution. This is being tested.


Music Puzzle.
On the audio CD there is a set of static at track 14, you can make out some kind of pattern.
The track is 18 seconds long but the audio only plays for 15 seconds.
Track is located here:
http://gravitasrecordings.bandcamp.com/track/grimjaw-the-hunt-for-the
external image 20j4rcl.jpg
Spectrogram analysis reveals the URL www.blessrecords.com/DefconTwnty but the website is displaying "Error 404: NOT FOUND! This domain name has just been registered." as of 8/10/2012

blessrecords.com appears to have been the website for Austin, TX musician Bil Bless and his band Son of the Electric Ghost so this may have simply been a music submission promoting the artist's website