What does thisisthecountdown.com count down to?

The new cool page created by Ubuntu-adverts team http://www.thisisthecountdown.com/ displays a nice counter, and an Ubuntu logo followed by a short motto. It seems, however, that it's not counting down to the Ubuntu 11.10 Oneiric Ocelot release. So what's the time zero, and what is expected to happen when the counter reaches zero?

Solution 1:

It was created by the Ubuntu Adverts team to build up some hype in advance of the 11.10 release. The counter expires at midnight 11th October in the UTC-5 timezone (US Central time). This is 6am on the 12th October in the UK. However, the release of 11.10 is expected on the 13th in the afternoon UK time.

This page seems to have been an entrance for an Alternative-Reality Game, that was played by seeking for information on a bunch of fake websites, deciphering messages, etc. The game was synced with the real time, and it progressed through many days. As of Oct 11, the game is still in progress, but considering the amount of information that has been already presented, it is unlikely that one might easily join the players and continue from that point. The game is played cooperatively with many other players, by discussing puzzles at an IRC channel - #awholenewworld (you can find logs at this answer's end)

There was a number of clues released and puzzles to solve between now and then. I think at time zero a new website, possibly with more information about Oneiric will be released, there might be a more intensive phase of the game at that point, or it might be the end of the game.

The first clue is the class of the tag which may be decoded by base64 decoding then hex to ascii to reveal "world space agency org" http://worldspaceagency.org which is a website that was labeled as under construction.

The background image at worldspaceagency.org was also an MP3 file (stereo, 22.5 Khz)

Many clues have been released through a twitter account. http://twitter.com/#!/thisisthe

• One may pass the class, yet not see what is in plain sight ahead.
• If the world could sing, then man can tell his deepest secret.
• A world by any other name will still play.
• 0x575341 UNIDENTIFIED TRANSMISSION INTERFERENCE
• Meine freunde, sometimes one has all the pieces but doesn't know it.
• Sometimes you have to do things twice.

As of 10/5, the GIF at worldspaceagency.org has changed. There is now text near the bottom that says

CynOnoceiomemdRhlnnpctiDisssunr1tooaLdoatsRgurrdsedeemaiiifiseornp&Ournlo:cotsOta:tetentr:amengYncuv

There is also a pastebin of the appended data. There is pure HEX data here There is also a permutation before the codetext: 241563 Here is the wikipedia for transposition ciphers. There is some stuff about a German cipher called übchi. pinwake has used some German before. A clue, perhaps?

After deciphering using this tool with the key 2 4 1 5 6 3: codenameCORDOROY:instructions:donotattemptanythinguntilserversarecompromised&signalsourcefound

On 10/6 the worldspaceagency.org page changed completely and now features a simple menu, WSA logo and some news. One can access a fake console at http://worldspaceagency.org/console/ which displays some chirped messages, and play morse code message (which after deciphering is ariss/ibm/a22p).

The Morse code used to decoded to contact/ibm/a22p. The earlier version was just a red herring. The page http://worldspaceagency.org/contact/ibm/a22p is blank, with "Nice try" as the title.

ARISS is the amateur radio link to the ISS, it was running on an IBM A22P thinkpad left behind by Mark Shuttleworth in the ISS (yes, really) there is some kind of problem with it's power supply unit. http://www.rac.ca/ariss/faqariss2.htm (That might be the why the audio file was all scrambled.)

The hacker console displays what appears to be an IRC log with some random office chit chat and the message:

"Pine Lake seems to have received some more transmissions of some sort."

Possible clue: Pine Lake, GA on Wikipedia.

Full decryption of the console text is available here.

As of late 10/6 or early 10/7, http://thisisthecountdown.com has changed. The background is now different, and the bar above the countdown appears to move.

If you click the twitter link in the site, it auto-fills your tweet with the following: 0x575341 UNIDENTIFIED TRANSMISSION INTERFERENCE http://www.thisisthecountdown.com

Update 10/9: Turns out the 404 page at http://worldspaceagency.org/ariss/ibm/a22p/ was a fake. Some text at the bottom was changed. The first characters of the text in question ended up being a phone number: '404-9 CONTAC', or '404-926-6822'. Another transmission was found upon phoning the number. Here is a digital recording.

The recording was used to decode the transmission in the console at the WSA website. The decoded transmission is here: http://paste.ubuntu.com/704729/ The transmission references Chi Sagittarii, a group of star systems, along with the Wow! Signal, which was emitted from said star systems and is considered evidence of potential extraterrestrial life.

The security link on the home page requests a username and password. The credentials are below:

• username: The User
• password: 43tgmbefortytwo

From that point, the game gained speed, and both the plot and the puzzles thickened, but the number of them makes it difficult to discuss them all in that answer.

Note: here's a big plot gap - please add some information on the following points

• Case files
• Counter changed (signal lost)
• Background colors (HEX hint) → Traveller MP3.
• Counter changed (reconnecting)
• WSA background → QR code → video footage
• EXTRACTED-CASEFILES-r1.7z (in source code rgb values were 097 108 105 101 110 114 105 102 116 102 114 111 110 = alienriftfron in ASCII an anagram for (finalfrontier) the file's password)

The counter changed once more and we found a barcode like thing below the numbers (transmission.gif). It turned out to be a sliced QR code where each red dot marks the cut point. After inverting and encoding the result, it brought us to another archive file (EXTRACTED-CASEFILES-r2.7z) via this link The file again contains updates to the three case files. The password for the protected ZIP file (eventhorizon) was found by analyzing the HTTP headers of thisisthecountdown.com. This followed after a hint given by the @ThisIsThe Twitter account, which obviously is back under pinwake's control:

taking this thing back! Nobody knows rfc 2616 like me --it's me, djohnson!

Where RFC 2616 deals with HTTP standards. The headers contain the following:

7zip: Beyond a certain point there is no return.

→ point of no return → event horizon.

In the meantime the counter was updated (the estimated time for decryption has been recalculated) and now shows only a few hours left until the decryption of the transmission will be finished (which likely will be the end of the game).

Final Result - It turned out that the countdown was indeed for Ubuntu 11.10 .

IRC logs from #awholenewworld on freenode are avaliable below, most recent at top.

• somedude9's log from Oct 09
• Centigonal's log beginning 02 Oct
• AlanBell's log beginning 08 Oct
• jrgifford's log from Oct 03 - 07

Solution 2:

Here is a compact list of what information we have (please add new info as it becomes available):

"(NEEDS INVESTIGATION!)" signifies information that hasn't been discussed at length in the IRC yet

• A class on the thisisthecountdown.com points to "worldspaceagency"
• worldspaceagency.org/
  • The globe contains an MP3 file, available here.
  • Other GIF contains this data.
• The WSA website later changed
  • Console is here.
    • Plays morse code for contact/ibm/a22p
    • Morse code later changed to ariss/ibm/a22p
      • has a fake 404 page. 404-9 Contact the website administrator if you feel you have reached this page in error.
        • ended up being a phone number. '404-9CO-NTAC', or '404-926-6822'. Another transmission was found upon phoning the number. Here is a digital recording(mirror).
    • Using the '6EQUJ5' gathered from the phone call, a word code was figured out for the encrypted information.
    • ROT13/12 coded office chit-chat has references to Pine Lake.
    • 'Security access' now requests a login and password, with the prompt "ssh".
• On 10/09, the WSA Security Login page(previously "under construction") went live with a required login/pass.
  • The counter gif held another hidden message in hex. Every 5th character was offset by 5 characters.
  • The username and password are 'The User' and '43tgmbefortytwo' respectively.
  • Upon entering the credentials, a filesystem is presented with two unusual folders 'casefiles' and 'cctv'. Full oddities documented here.
• http://worldspaceagency.org/id was mentioned as an "ident server" in the hidden text inside the WSA counter GIF
  • The ident page has some strange and ugly Javascipt code. Here is the expanded version with added whitespace. (probably not important)
  • Typing fortytwo into the console causes much of the text to fade, singling out 43 tgmbe fortytwo
• Countdown page changed on 10/6
  • New background (hidden information?)
  • Bar above countdown now moves
• Twitter page (http://twitter.com/#!/thisisthe)
  • Lots of clues!
  • One may pass the class, yet not see what is in plain sight ahead.
  • If the world could sing, then man can tell his deepest secret.
  • A world by any other name will still play.
  • 0x575341 UNIDENTIFIED TRANSMISSION INTERFERENCE (this is also auto-inserted by the twitter link on the countdown page) - 0x575341 is HEX for WSA
  • Meine freunde, sometimes one has all the pieces but doesn't know it.
  • Sometimes you have to do things twice.
  • Damn it! WSAsec is going to find me soon. I have to go!
  • This account is now under the control of the WSAsec. We will find you.
  • We know you are codename CORDOROY. We will find you, Dr. Pinwale. We will be shutting down all your channels of communications.
  • As soon as we get the intel we will get you, Dr. Pinwale. Those transmission files you took were property of the World Space Agency.

The purpose of this list is to help make investigations more thorough by letting us check every new piece of information for connections with everything else in the list.

Solution 3:

It looks like it is just a game and the counter will never reach zero since the page is now a single message with color bars in the background.

ERROR 0x484558: SIGNAL DROPPED
TRANSMISSION IS ENCRYPTED, OUT OF RANGE OR OFFLINE

0x484558 resolves to 'HEX' with an Hex to ASCII convertor ... ( like previously 0x575341 --> WSA )

Remember everything is in the sources : rgb(74, 46, 109) rgb(112, 47, 97) rgb(101, 114, 111) rgb(115, 112, 97) rgb(99, 101, 114)

From ASCII to Text 074 046 109 112 047 097 101 114 111 115 112 097 099 101 114 gives something like J.mp/aerospacer

Just fill J.mp/aerospacer in firefox navigation bar ( not in the search bar) and it resolves to http://soundcloud.com/worldspaceagency/02-traveler/s-lrAhQ

J.mp/6EQUJ5 is also a jump code to http://en.wikipedia.org/wiki/Wow_signal

SIGNAL FOUND. RECONNECTING...

Wow ;-)

RECONNECTION COMPLETE. CAPTURING TRANSMISSION
ESTIMATED COMPLETION TIME 2011-10-12 04:00Z

Check the source code for the password protected data file :

In the source the IRC link was in fact linked to http://thisisthecountdown.com/wsa-server-rip/EXTRACTED-CASEFILES-r1.7z

The rgb codes were different too : ASCII (097 108 105 101 110 114 105 102 116 102 114 111 110 ) = alienriftfron.. ( last numbers were 0 0 one hour before the new countdown)... an anagram for finalfrontier (password)

The title of the page was [email protected]: Decrypting...

Then came the new countdown .... read first post for the whole story.

It looks like the files are similar to the others we can access via SSH

Ubuntu logo is now in the front of the page...

data-text="A whole new world. A whole new computer. #ubuntu"

Long life Oneiric... Thanks for the cool music ;-)