Cicada 3301 - A Mystery in the Cyber World

How I came across this?

So the year was 2017 I suppose, I was newly introduced to the dark web, and started watching creepy-pastas spread over the internet. It was interesting. Fascinating yet controversial.

That's what makes it go viral, doesn't it? We all love conspiracies.

Considering my history of watching those videos, the YouTube suggestion algorithm one day decided to show me a video by LEMMiNO titled "Cicada 3301: An Internet Mystery" [link below]. And that short video introduced almost all concepts I'd studied in Cyber Security.

Let me appreciate that guys editing skills first of all.What a lovely piece of craft, indeed!

When I watched the video, the curiosity made me search for more details related to it. I visited the Reddit threads related to it myself and the related onion links too. (Taken down, of course.)

Here's a small introduction of what this mystery was, thanks to Wiki, Reddit and several other resources.

What’s Cicada 3301?

The most elaborate and mysterious puzzle of the internet age. — The Washington Post

Cicada 3301 is a nickname given to an organization that on three occasions has posted a group of puzzles to recruit code-breakers from the internet.

Different Rounds

The puzzle had few rounds. Nobody from the public knew that the next round exists, let alone guess it's date or format. It was because there was no official (signed message) from Cicada.

The first internet puzzle started on January 4, 2012 on 4chan and ran for about one month.
A second round began one year afterward January 4, 2013.
And then a third round following the confirmation of a fresh clue posted on Twitter on January 4, 2014.

The stated intent was to recruit “intelligent individuals” by presenting a series of puzzles which were to be solved.

No new puzzles were published on January 4, 2015. However, a new clue was posted on Twitter on January 5, 2016. In April 2017 a verified PGP-signed message was found:

Beware false paths. Always verify PGP signature from 7A35090F.

That message explicitly denies the validity of any unsigned puzzle, as recently as April 2017.
The puzzles focused heavily on:

data security
cryptography
steganography
internet anonymity
surveillance

Speculations

It has been called “the most elaborate and mysterious puzzle of the web age” and is listed as one of the “top 5 eeriest, unsolved mysteries of the internet”, and much speculation exists on its function.
Many have speculated that the puzzles are a recruitment tool for the NSA, CIA, MI6, a “Masonic conspiracy” or a cyber mercenary group. Others have claimed Cicada 3301 is an alternate reality game.

No company or individual has taken credit for it or attempted to monetize it, however.

The Cicada 3301 Puzzle

Before diving into the main points, let me clear what it’s on the very surface level. It’s a puzzle which is posted on the web with the intentions of recruiting “highly intelligent individuals”.

Solving which supposedly gets you recruited to the NSA, MI6, Hacker groups and therefore the speculations go on and on; although no official prize has ever been announced.

It all started on January 4th, 2012. An elaborate puzzle appeared on message boards and forums which read:

This image when opened using a text editor gives out a Caesar cipher string of semi-readable text, which when deciphered results in an Image URI.

The chase then continued, one clue leading to another. The puzzles used all sorts of techniques in cyber-security including cryptography, steganography etc. They even dropped some clues on physical addresses.

Finally the website closed with a line saying

“We want the best, not the followers”.

Soon there was a month of silence and then this Image was posted on the sub-reddit on Cicada.

According the Cicada they have found the people they were looking for. But the community out there was not satisfied because of the lack of ending to what was this all about. And many termed it as a wild goose chase and waste of time

But little did we know, this was just the beginning. After an year another quiz dropped on the forum.

The second and third round went similarly. A detailed analysis can be watched in this video.

. . .

by
Shakeeb Ahmad
Abuzar Gaffari
Ashwini Ghonse
Mustafa Al-Hammadi

[This is a truncated version of a 10-page long blog submitted to the institution.]