Backdoor

Summary

After discovering that V called someone at the Academy's Crypto Department, Caine heads over to Crypto to investigate. He runs into his friend Neville Clark, who is talkative, if obfuscating. The Cube Hunters entice Nev into sharing more information by giving him a puzzle, designed by jbd, to solve. Nev takes the bait, and gives us a backdoor that leads to a gridded file system.

Dragging the commands onto the grid to create various configurations yields a series of log snippets. Some of the logs resemble the Perplex City Errorlogs that were found before the puzzle cards were released.

The interface can be accessed at the following URL:

http://events.perplexcity.com/gateway/commandinterface/index.html

As of 17:08, 3 July 2006 (PDT), the puzzle is still being worked on. Join us in #syzygy, or see the discussion on the Talk page or at Unforums.

Commands

Through the combined work of jalapenodude, pelrun, and jbd, #syzygy has determined that the commands appear to work as follows.

The program pointer starts in upper left corner. It moves through the grid one space at a time, as determined by the command in that space.

Generally, the pointer moves in the following directions when it encounters each command. Some exceptions may occur.

popen - east
pread - west
mount - se
pwrite - e
switch - se (Are you sure, goes NE on config 5 below?)
copy - s
flush - s

All of these can go funny in certain circumstances, especially when next to an edge where the next command would normally jump off the grid.

rotate does something different depending on where it is executed, but also (sometimes?) where it comes from. Here are some directions that occur:

 e  e  e  e  s
 s ne  n  n  s
 e  n ne  n  s
ne  n ne  n  s
ne  n ne  n  n

However, it is possible for r3c5 to go north if entered from the west, for example.

The same goes for zone:

e e e w s
s w w n n
e e e n w
n w w n n
n w w n n

End ends execution whenever it gets hit on a specific error message. It is very good for testing where the code is going. Cache seems to only work as an end point. Run can go anywhere that the program pointer isn't reaching.

A configuration is a set of commands placed on the grid so that the grid is valid and a log file is retrieved. The command path is the actual path that the pointer takes through the grid configuration. Different configurations may break down into the same command path.

Configurations and command paths start with ZO-MO, and usually end with either CACHE or FLUSH.

Full Command Path List

The first two numbers are the resulting configuration, the letter after is the variation, and the string is the command path, with each instruction cut to two letters in length. The list is alphabetized based on operation name, as a reference service. Please be sure to also place them above with their respective results, and to sort them in properly when added.

08B ZO-MO-CO-PR-RO-RO-SW-SW-RO-CA
06A ZO-MO-CO-PW-RO-SW-RO-FL
01B ZO-MO-CO-RO-RO-RO-RO-RO-ZO-CA
03C ZO-MO-MO-SW-RO-CA
02B ZO-MO-PO-RO-PW-CA
02A ZO-MO-PO-RO-RO-RO-CA
03A ZO-MO-PO-RO-SW-CA
01A ZO-MO-PO-ZO-RO-RO-CA
13A ZO-MO-PR-PR-CO-CO-PW-RO-SW-SW-RO-CA
11A ZO-MO-PR-PR-SW-SW-SW-RO-SW-RO-CA
08A ZO-MO-PR-SW-SW-RO-CA
09A ZO-MO-PR-SW-SW-SW-RO-CA
10A ZO-MO-PR-SW-SW-SW-RO-RO-CA
07A ZO-MO-PW-RO-SW-FL-ZO-CA
06B ZO-MO-PW-RO-SW-RO-FL
02C ZO-MO-RO-CA
03B ZO-MO-SW-RO-CA
18A ZO-MO-SW-SW-ZO-ZO-ZO-PR-CA
12A ZO-MO-ZO-CO-PW-SW-RO-RO-SW-CA
19A ZO-MO-ZO-SW-SW-SW-SW-RO-RO-CA
20A ZO-MO-ZO-SW-SW-SW-SW-RO-RO-RO-CA
04A ZO-MO-ZO-ZO-CO-CO-CO-RO-RO-PW-RO-CA
05A ZO-MO-ZO-ZO-CO-CO-CO-SW-RO-PW-RO-CA
16A ZO-MO-ZO-ZO-PW-RO-SW-PR-CA
15A ZO-MO-ZO-ZO-SW-SW-SW-RO-CA
14A ZO-MO-ZO-ZO-SW-SW-SW-RO-SW-RO-CA
17A ZO-MO-ZO-ZO-ZO-PW-RO-SW-CA

Command/File Mapping

Other than the linked commands, we also get these two errors...

unable: "Unable to access file" unread: "Unable to get read handle"

The number of times the zone, switch, and rotate commands appears in a command path determines which file is displayed.

Configurations with one zone command

		switch
		0	1	2	3	4
rotate
	1	master	TNI	Suspic.	Header	Ioniser
	2	unread	TNI	Yorke	NanoImg	Ioniser
	3	master	TNI	Suspic.	Header	Ioniser
	4	unread	TNI	Yorke	NanoImg	Ioniser

Configurations with two zone commands

		switch
		0	1	2	3	4
rotate
	1	Camera	Coffee	Noise Control	NanoImg	unread
	2	Camera	Coffee	Noise Control	NanoImg	Tajison
	3	Camera	Coffee	Noise Control	NanoImg	Battery
	4	Camera	Coffee	Noise Control	NanoImg	unread

Configurations with three zone commands

		switch
		0	1	2	3	4
rotate
	1	Laser	Sphere	unable	Clock	MagReg
	2	unread	Sphere	unable	Clock	MagReg
	3	Laser	Sphere	unable	Clock	MagReg
	4	unread	Sphere	unable	Clock	MagReg

Configurations with four zone commands

		switch
		0	1	2	3	4
rotate
	1	unread	RNG	WHISK	unread	unread
	2	unread	RNG	WHISK	unread	unread
	3	unread	RNG	WHISK	unread	unread
	4	unread	unread	WHISK	unread	unread

Configurations

Here are the various configurations and logs that have been discovered.

Config 1: Smart Dust Cameras

Configuration: zone, mount, run, rotate, rotate/ - - popen, zone, cache

Command path: zone, mount, popen, zone, rotate, rotate, cache

Alternate Configuration: zone mount - rotate rotate / run - copy rotate rotate / - - rotate cache zone

Command Path: zone, mount, copy, rotate, rotate, rotate, rotate, rotate, zone, cache

Text:

CRYPTO PARTS REF: 72690B-0F

EXTERNAL REF: 43914D

DESCRIPTION: Engineering/Smart Dust Cameras; corrected auto-power off firmware bugs, increased bandwidth.

Image:

Config 2: Approaching the Master

Configuration: zone mount run rotate rotate/ - - popen rotate cache/ - - - - -

Command Path: zone, mount, popen, rotate, rotate, rotate, cache

Alternate Configuration: zone mount run pwrite cache/ - - popen rotate -

Command Path: zone, mount, popen, rotate, pwrite, cache

Alternate Configuration: zone mount run cache -/ - - rotate - -

Command Path: zone, mount, rotate, cache

Text:

Approached the Master today about begining on an updated and revised edition. V. pleased to discover he considers the idea warmly. He actually said, 'My ideas are in good hands with you, and you will of course receive full credit for the work.' Somehow I expected more of a struggle. V. gracious indeed. He's not quite the glory-hog SOME people have made him out to be, I guess.

Image:

Config 3: Neuro Scanner

Configuration: zone mount run switch -/ - - popen rotate cache / - - - - -

Command Path: zone, mount, popen, rotate, switch, cache

Alternate Configuration: zone mount run - -/ - - switch cache -/ - - - rotate -

Command Path: zone, mount, switch, rotate, cache

Alternate Configuration: zone mount run - -/ - - mount - -/ - - - switch cache / - - - - rotate

Command Path: zone, mount, mount, switch, rotate, cache

Text:

CRYPTO PARTS REF: 6032VQ-0J

EXTERNAL REF: 10086W

DESCRIPTION: Neuro/Experimental remote TNI scanner; security and identification firmware updated for new Cognivia prototype.

Image:

Config 4: Laser

Configuration: zone mount run -- –/copy zone zone cache --/copy pwrite rotate -- --/copy rotate -- -- --/rotate -- -- -- --

Command Path: zone, mount, zone, zone, copy, copy, copy, rotate, rotate, pwrite, rotate, cache

Text:

CRYPTO PARTS REF: 384621-5A

EXTERNAL REF: 9CE42T

DESCRIPTION: Optics/High Power phase-conjugate laser; calibration and adjustment for high spaciotemporal accuracy.

Image:

Config 5: Sphere

Configuration: zone mount run -- / copy zone zone cache - / copy pwrite rotate -- / copy rotate --- / switch ----

Command Path: zone mount, zone, zone, copy, copy, copy, switch, rotate, pwrite, rotate, cache

Text:

CRYPTO PARTS REF: 3141PU-1M

EXTERNAL REF: OUF12M

DESCRIPTION: Physics/Baker Spherical Magnetic Containment field; interfaced with dedicated fibre network. Tested at 120% maximum tesla strength to ensure no field leakage.

Image:

Config 6: Gatehouse 24

Configuration:' Zone Mount Run -- -- / -- -- Copy Switch Flush / -- -- Pwrite Rotate Rotate

Command Path: zone, mount, copy, pwrite, rotate, switch, rotate, flush

Alternate: zone mount run switch flush / ---- ---- pwrite rotate rotate

Command Path: zone, mount, pwrite, rotate, switch, rotate, flush

When this configuration is run, a message Operation in progress appears. The screen then distorts and wavers. Finally, a log appears. Discussion on Unforums suggests that the logs may rotate, or appear randomly.

Log 1

Helen Carrick and Idola Friedberg

[ GATEHOUSE 24 ]

:: start 143805 +000000
:: start 143805 +000000
:: archive location { dev 7 }
:: index { yes }
:: retention { 9 }
:: processing time { 0.53 }
::

A

// labeled A;
// triangulated location mapped;
// passive badge { present }
// badge query { friedberg, i {119yr} }

You really said that [?]

// preliminary review complete

B

// labeled B;
// triangulated location mapped;
// passive badge { present }
// badge query { carrick, h {624yr} }

I was hungry [!] I'm not diplomatic when I'm starving [.]

// preliminary review complete
// 45% positive emotional state
// cross reference surveillance footage

{ extrapolated: badge {line 16} extracted }

{ gatekeeper system 24;
active badge interrogated, passed }

FRIEDBERG, I

I bet you fifty lecks your stuff is wiped when you get back [.]

// preliminary review complete

CARRICK, H

Hah [,] I'd like to see him even try [.]

// preliminary review complete


[ LOG EXCERPT ENDS ]

Log 2

Camden Porta and Lucas Bazeries

[ GATEHOUSE 24 ]

:: start 055814 +000000
:: start 061055 +000000
:: archive location { dev 7 }
:: index { yes }
:: retention { 9 }
:: processing time { 0.53 }
::

A

// labeled A;
// triangulated location mapped;
// passive badge { present }
// badge query { porta, c {112yr} }

Where have you been [?]

// preliminary review complete

B

// labeled B;
// triangulated location mapped;
// passive badge { present }
// badge query { bazeries, l {520yr} }

So I'm a little late [.] Relax [.]

// preliminary review complete
// 45% positive emotional state
// cross reference surveillance footage

{ extrapolated: badge {line 16} extracted }

{ gatekeeper system 24;
active badge interrogated, passed }

PORTA, C

We have to hurry and get this thing done [.]

// preliminary review complete

BAZERIES, L

Is he here yet [?]

// preliminary review complete

PORTA, C

I think so [.] Let's hurry [.]

// preliminary review complete


BAZERIES, L

I hope there's coffee [.]

// preliminary review complete

PORTA, C

Focus on the project [,] dunderhead [.]

// preliminary review complete


[ LOG EXCERPT ENDS ]

Log 3

Rowan Ashford and Mark Wooster

[ GATEHOUSE 24 ]

:: start 192355 +000000
:: start 192401 +000000
:: archive location { dev 7 }
:: index { yes }
:: retention { 9 }
:: processing time { 0.53 }
::

A

// labeled A;
// triangulated location mapped;
// passive badge { present }
// badge query { ashford, r {737yr} }

Hey [,] wait up [.]

// preliminary review complete

B

// labeled B;
// triangulated location mapped;
// passive badge { present }
// badge query { wooster, m {019yr} }

Oh [,] sorry [.] Hard meeting today [.]

// preliminary review complete
// 23% positive emotional state
// cross reference surveillance footage

{ extrapolated: badge {line 16} extracted }

{ gatekeeper system 24;
active badge interrogated, passed }

ASHFORD, R

Do you ever wonder [...]

// preliminary review complete

WOOSTER, M

Don't say it [.]

// preliminary review complete

ASHFORD, R

I know [,] I know [.] No place is safe [.]

// preliminary review complete

[ LOG EXCERPT ENDS ]

Config 7: Coffee

Configuration: zone mount run switch - / - - pwrite rotate flush / - - - cache zone

Command Path: zone, mount, pwrite, rotate, switch, flush, zone, cache

Config 8: Kiteway disrupting the department

Configuration: zone mount - - - / - switch pread - - / - - switch cache - / - - - rotate -

Command Path: zone, mount, pread, switch, swtich, rotate, cache

Alternate Configuration: zone mount switch - - / run rotate copy switch cache / - rotate pread - rotate

Command Path: zone, mount, copy, pread, rotate, rotate, switch, switch, rotate, cache

To: 55321801 

FROM: MANSOOR H. 

Kiteway's programs are disrupting the entire department. Breeding hostility 
and distrust among amicable colleagues. The man doesn't belong here anymore, 
why can't he keep his damned pet projects in his own office? Crypto is mine 
now, not his. 

Well, here are the metrics to show he's not minding his own business. 

Number of times Kiteway has visited dept. offices this year: 78 

And in 268: 129 

And in 267: 23 

Dept. suspicion level on the Howe-Panntonin Index: 8.8 

And in 268: 7.3 

And in 267: 4.5 

Suspect the man has his own agenda and isn't sharing with the proper channels, 
for example me and you. Suspect he is subverting the time and resources of my 
faculty without consulting me ahead of time. Behaving as though he can't trust 
his own senior fellows. Ridiculous. How long must we put up with this childish 
rigmarole?

Config 9: Project Data

Configuration: zone mount - - - / - switch pread - - / - - switch - - / - - - switch cache / - - - - rotate

Command Path: zone, mount, pread, switch, switch, switch, rotate, cache

Config 10: Nanoscale imager

Configuration: zone mount - - - / - switch pread - - / - - switch - cache / - - - switch rotate / - - - - rotate

Command Path: zone, mount, pread, switch, switch, switch, rotate, rotate, cache

Config 11: Reynolds ioniser

Configuration: zone mount - - - / switch pread pread - - / - switch - - - /- - switch switch cache / - - - rotate rotate

Command Path: zone, mount, pread, pread, switch, switch, switch, rotate, switch, rotate, cache

Config 12: Noise control system

Configuration: zone mount -- -- -- / -- copy zone switch -- / -- pwrite switch rotate cache / -- -- -- rotate --

Command Path: zone-mount-zone-copy-pwrite-switch-rotate-rotate-switch-cache

Config 13: Physics simulator

Configuration: zone mount -- -- -- / copy pread pread -- -- / copy switch -- -- -- / pwrite rotate switch cache -- / -- -- -- rotate --

Command Path: zone-mount-pread-pread-copy-copy-pwrite-rotate-switch-switch-rotate-cache

Config 14: Magnet current regulators

Configuration: zone mount -- -- -- / switch zone zone -- -- / -- switch -- -- -- / -- -- switch switch cache / -- -- -- rotate rotate

Command Path: zone-mount-zone-zone-switch-switch-switch-rotate-switch-rotate-cache

Config 15: Atomic Clock

Configuration: zone mount -- -- -- / switch zone zone -- -- / -- switch -- -- -- / -- -- switch cache -- / -- -- -- rotate --

Command Path: zone-mount-zone-zone-switch-switch-switch-rotate-cache

Config 16: Big Nothing

Configuration: zone mount - - - / switch zone zone switch - / - pwrite rotate cache pread

Command Path: zone, mount, zone, zone, switch, pwrite, rotate, switch, pread, cache

Config 17: Nuclear decay RNG

Configuration: zone mount -- -- -- / zone zone zone -- -- / pwrite rotate switch -- -- / -- -- -- cache --

Command Path: zone-mount-zone-zone-zone-pwrite-rotate-switch-cache

Config 18: WHISK array

Configuration: Z M - - -/ - - S - -/ Ca - - S -/Ro Pr Z Z Z/

Command Path: Zone-Mount-Switch-Switch-Zone-Zone-Zone-Pread-Cache

Config 19: Tajison PW Accelerator

Configuration: Z M - - -/ - S Z - -/ - - S - C/- - - S R/- - - R S/

Command Path: Zone-Mount-Zone-Switch-Switch-Switch-Switch-Rotate-Rotate-Cache

Config 20: Nelis Nuclear Battery

Configuration: Z M - - -/ - S Z - C/ - - S - R/- - - S R/- - - R S/

Command Path: Zone-Mount-Zone-Switch-Switch-Switch-Switch-Rotate-Rotate-Rotate-Cache

Config 21: Krsa algorithm

Configuration: end end mount -- -- / -- -- cache copy -- / -- -- rotate zone --

Command Path: end-end-mount-copy-zone-rotate-cache

Notes:

To make this more precise, let Krsa be an RSA generator with associated security
parameter k and let Keys be the set of all moduli N that have positive probability
to be outbut by Krsa. Let Hash be a family of functions whose key-space is Keys and
such that HashN : { 0, 1}

-> Z

n for every N e Keys. Let DS = (Krsa, Sign, VG) be the digital signature scheme whose
signing and verifying algorithms are as follows:
Algorithm Sign N,p,qp,d (M)
y <- Hashn (M)
x <- yd mod N
Return x
Algorithm VGn,e (M,x)
y <- Hashn (M)
y

<- xe mod N
If y=y

then return 1 else return 0

Config 22: Audio

Configuration: end end zone mount -- / -- -- -- -- copy / -- -- -- -- rotate / -- -- -- -- rotate / -- -- -- -- cache

Command Path: end-end-zone-mount-copy-rotate-rotate-cache

The audio is streaming, but here is a conversion into MP3 format.

Transcription If he dies, you realise that's it. You can do what you like to me - I don't care about me. Someone in my block got beaten up the other night. He isn't a violent guy; he's a calligrapher. But he just got attacked well f ... nothing basically. Well I think it was random, but I don't think I believe in random any more. Was it you? Are you trying to scare me? You don't need to so just ... stop it. I did what you wanted anyway. Last night ... I worked until I was the only one left in the office. Must have been about 11 when this delivery guy turned up with a trolley full of boxes. And he did look a bit surprised to see me there. These two big boxes were for us, so I signed for them and went next door to grab Angelica so she could open the stores. Anyway, the boxes were really heavy, so the delivery guy wheeled the trolley into the stores and dropped them off there. Then I saw him slide one of our cases under the trolley; when he moved the trolley, it wasn't there anymore. It was quick but I'm sure he swiped something. Then he left, and Angelica locked the door. I would have followed him ... well, probably ... but Angelica started talking to me about my research and I couldn't just rush off. I saw him go to the end of the corridor ... to the elevator, and he hit the down button. There's only the basement under us, but I think there might be passageways for internal mail and things. I honestly don't know. And I'm not going down there in the middle of the night, so don't ask. No matter what you threaten me with. Ummm the delivery guy was about 6 foot, white, short dark hair. I haven't seen him before. Keep an eye out, will you?

Config 23: Audio

Configuration: END END ZONE MOUNT CACHE / - - - - ROTATE

Command Path: end-end-zone-mount-rotate-cache

The audio is streaming, but here is a conversion into MP3 format.

Transcription So this is it. Can't say I'm not glad it's over but, well, one day maybe you can tell me what this was all about. I mean, I read the papers - police raids on subway stations - sounds like your kind of thing. We've had a few more deliveries come in since January, but still no sign of the mystery man. It's been a different courier each time, and they've - they've all looked pretty innocent. The Viendenbourg messages are still going backwards and forwards. I appreciate what you've done for my dad, but ... I've done my bit. That's it. That was the deal. You can go digging around in the tunnels if you like but don't expect me to do any more of your dirty work. You told me to stop, so I'm stopping. Don't ever tell my dad about this. Over and out.

Config 24: To-Do list

Configuration: - - - - / - - - - - / - - - CACHE - / - - MOUNT ROTATE - / END END ZONE ROTATE -

Command Path: end-end-zone-mount-rotate-rotate-cache

Config 25: Audio

Configuration: END END MOUNT - - / - - CACHE COPY - / - - ROTATE ZONE -

The audio is streaming, but here is a conversion into MP3 format.

Transcription Look this is getting seriously dodgy. Last week, Lucas completely cut me out of a meeting, and Mansoor has been ripping into my white paper and... I'm sure it's not professional, it's personal. They know what we're up to, I swear. No I don't, I don't know anything. I'm losing it. Please, I can't be that important. You could get someone else. The whole place is hutting down over Solstice. You...you could get someone to break in here and I don't know...isotope tag one of the packages and track it you probably do that all the time...what do you need me for? Well, happy holidays.

Historical Cryptographers

Some of the names mentioned in the logs share the names of historic cryptographers and mathematicians.

Bazeries

French military cryptographer, the 'pragmatic man of cryptology'. Famous for breaking the French 'Great Cipher' created in the 17th century.

Porta

Giovanni Battista Porta, Italian cryptographer and inventor of the Della Porta cipher - a polyalphabetic cipher with keyword.

Ashford

the name of the village in Kent where John Wallis, 17th century mathematician, was born. He wrote among other things, about the quadrature of curves, logic, theology and cryptography.

Carrick

the name of a Windows-based encryption application, designed by cryptographer Bruce Schneier.