write up by @detective_6
On 7/11 the first substantive clues started appearing on the official DEF CON forums in two locations: 1o57’s blog, and the official mystery challenge contest board.
The first post on 7/11 was titled “Round and Round.”, which contained a YouTube video of the opening scene of the 1987 film The Lost Boys. The clip shows Kiefer Sutherland and his crew riding on a carousel, and generally causing mischief. The post text reads: “Life seems to keep going ‘round and ‘round these days… Some days are easier than others. Some are just difficult.”.
The second blog post appeared two days later titled “Just listening to some music, thinking about the world…” It included a YouTube link titled “Carousel Experiment - Devils Touch”. The text read: “It seems like too much of the world is tilting at windmills these days. I’m not a fan of that. I really do wish that more people could be happy- I’m too much of a realist to think that everyone can be happy- some people just aren’t built that way. But I long for the world where at least it’s everyone’s own choice…”.
Note that both of these posts contain references to spinning, turning, etc. and specifically a carousel.
The first contest board post was titled “what a tangled web we weave when the devils in the details…”. It contained a link to a live performance of September’s Rhyme by SJ Tucker. Before the song, the artist explains why she created the song and also mentions that her friend calls it “the devil’s carousel music”.
A day later 1o57 posted another post in the same thread that linked to the film adaptation of Something Wicked This Way Comes. And surprise, this also has a carousel!
Finally, on 7/15 1o57 posted a third post in the same thread that linked to an SNL skit called “Devil Can’t Write No Love Song”.
So at this point we have multiple references to devils and carousels, and an explicit reference to “the devil’s carousel music”. A few easy guesses will quickly lead the reader to devilscarousel.com. An additional tweet from 1o57 on July 15 pointed more heavily to “devil’s carousel” being a domain name. Note that multiple domains have been registered to redirect to this one. For example, “thedevilscarouselmusic.com” is also a valid solution.
When we land on the site we see some text that says “Looking for #MC?” and are greeted by a closeup of Sho’nuff from The Last Dragon. Looking for mC? Sho’nuff!
Below, the website contained directions for Part A and Part B.
Part A directed solvers to watch the live streams the week of Tax day. Normally, this occurs mid-April in the US, but due to the COVID-19 pandemic the date had been pushed to July 15. 1o57 had two scheduled streams for this week: “Transistor Tuesday” and “Down In the Park” on Friday. Neither of these streams occurred, but on July 18 he tweeted “#SecretStream is likely tonight”. The streamstream kicked off at approximately 8pm PST.
The stream began with a series of scenes from the 1986 film The Money Pit starring Tom Hanks. After this, 1o57 talked a bit about the badge and then read a short excerpt from “The Shakespearean Ciphers Examined” by William F. and Elizabeth S. Friedman. The excerpt essentially summarized that some people have argued that cryptographic evidence in Shakespeare’s work proves that it was written by someone else.
1o57 then introduced a new segment called “!this one ?” (pronounced ‘not this one’).
The first item in the segment was a video of South Korean dance cover group Waveya dancing to a remix of “One Night in Bangkok” from the experimental album/musical Chess. After showing part of the original song, 1o57 mentioned that some thought that this song was a little bit prophetic because Yul Brynner (who is mentioned in the song) died 6 months after the song’s release. This specific piece of information will be important in solving Part B.
The second item in this segment was a montage of stills from Friday the 13th backed by its famous theme. 1o57 summarized the origin of the ki-ki-ki ma-ma-ma sound, how it was derived from “kill kill kill mom mom mom”, and the use of the theme only during the killer’s point of view. The segment’s final item was a series of clips that all contained Robby the Robot: The Twilight Zone episode “Uncle Simon”, Mork and Mindy episode “Dr. Morkenstein”, and the movie Forbidden Planet.
Before playing the final clip, 1o57 noted that the show was “brought to you by Venn of Venn diagrams and of locating and contacting particular people”. Then he played a car chase from the movie Raw Deal, saying that it was his choice of what 2020 feels like so far.
1o57’s comments toward the end of the stream indicate that teams need to find the commonality between the items referenced in the stream, and that will be the person to contact. So to sum up the references:
There are multiple paths to the solution, but the easiest is to start with “One Night in Bangkok”. The Wikipedia page contains a section for a “Robey Version”. This shows that the “!this one ?” segment refers not to the version displayed on stream, but something else. Robey also played Micki Foster in Friday the 13th: The Series. So not the original movie, but the series. And it’s not Robby, it’s Robey!
Her Wikipedia page also shows that she is credited as “Female Vocalist” in The Money Pit and “Lamanski’s Girl” in Raw Deal. Finally, it describes that she met the Earl of Burford after he gave a lecture about one of his relatives who is one of the authors named in the Shakespeare authorship question. Therefore, Louise Robey is the definitive commonality between all topics presented in the stream.
Part B says “Find the prophetic scenario (the truth is out there) and send its name. <- Here’s something to get you started in the right direction…”. Beside this text is a YouTube link to The Lone Gunmen episode “Madam, I’m Adam”.
Remember the prophetic Yul Brynner scenario from before? There’s a similar prophetic scenario related to The Lone Gunmen. In the first episode “Pilot” rogue members of the U.S. government remotely hijack an airliner departing Boston, planning to crash it into the World Trade Center, and let anti-American terrorist groups take credit, to gain support for a new profitable war following the Cold War. This episode aired approximately 6 months prior to 9/11.
1o57 also posted a tweet on 7/19 which read “Part A and B: sent an email yet?”. Sending an email to an arbitrary address at the challenge domain would result in an automated response from “The Lone Gunmen” with the subject “[Auto-Reply] #mC Registration path”. The response contained three numbers (443, 512, 1024) and a short message: “Ask for Simon. Not sure he can talk right now (ever?)”.
Note that the name of the episode “Madam, I’m Adam” is a palindrome. In addition, 443 is a palindrome in binary (the numbers 512 and 1024 clue into this). So we need to find a palindrome associated with our prophetic scenario. Unfortunately 911 isn’t a palindrome, but recall the second part of the Part B text: an arrow pointing left and a mention of getting started in the right direction. Reversing 911 gives 119, which is a palindrome in binary (1110111)!
Final solution: send an email to firstname.lastname@example.org containing the string “1110111”.
During the course of solving we found a happy accidental coincidence. In episode 07 of The Lone Gunmen, “Planet of the Frohikes”, the opening scene shows a bunch of monkeys at computers. One of them, Simon, is writing Shakespeare, clearly a nod to the infinite monkey theorem. This connects both the Shakespeare reference and Simon from the email hint.
When the supervisor notices and leaves to alert others, Simon deletes his work and types out “A Short History of My Demeaning Captivity”. We thought it was kind of prophetic, considering our current state of quasi-captivity.
Keep Watching the Skies