Government intelligence agency launches online code-cracking puzzle

aZooZa · Dec 2, 2011

I'm with Graeme on this too. I have had personal dealings with MI5 (signed OSA) and SB also - they are not at all daft, and this little 'contest' is full of smoke and mirrors.

If they are interested in you, they will contact you. Take it from me

Edwin · Dec 2, 2011

GreyWing said:
It appears they tried to hide "the robots.txt file that just didn't take". These so-called succesful people who you say linked to it, don't appear to have exposed the password though which is highly odd, nor do they explain how it was broken. Which is even more odd because they appear to have given away part of the solution (i.e the success page, but not all of it i.e the password or method)

That's not what I said.

I said they tried to hide it WITH a robots.txt file. The robots.txt file itself isn't hidden (it has to be visible otherwise the spiders can't see it either).

The robots.txt file did not work as "expected" because Google has recently (in the last few weeks) begun selectively ignoring robots.txt files in general when there are a lot of external links to a URL that would have been blocked from being spidered by robots.txt.

Instead, Google now goes for an awkward "compromise" in that it will record the URL of the page (hence why it showed in the search results) but not its content (no details in the SERPS, no cached page etc.)

Everything I just wrote above is web-and-worldwide and has zero to do with GCHQ. It's entirely related to changes in Google's algorithm. It's inevitable: if you put a page on a public webserver and don't password protect the directory it's in, then if enough people link to it that URL will show in Google.

That's why I think it's likely to be the real page, because A) it showed up late in the day (the intermediate page leading to part 2 showed up a few hours before - none were showing at the start of the contest) and B) it can ONLY have shown up through external links, which almost certainly started appearing in large quantities once somebody solved it and couldn't wait to talk about it.

BTW, "officially" the story's as I laid it out...
http://www.telegraph.co.uk/news/ukn...-rewarded-with-news-of-25000-job-vacancy.html

aZooZa · Dec 2, 2011

Sorry, but it's not a simple as that Edwin. How do you think we cracked the 'enigma' code? It's no good quoting the British press - one of the most censored establishments in the world.

Prima facie, it's either a hex dump of ASCII text (given that there's a code to establish an offset; e.g. deduct/add 10 to reveal the true code, based on ASCII frequency, or it's an assembler dump.

Much more than that - I'm all ears.

GreyWing · Dec 2, 2011

Edwin said:
I said they tried to hide it WITH a robots.txt file. The robots.txt file itself isn't hidden (it has to be visible otherwise the spiders can't see it either).

What I'm saying mate is that we don't know what they tried, how could we?

Edwin · Dec 2, 2011

GreyWing said:
What I'm saying mate is that we don't know what they tried, how could we?

By reading the contents of their robots.txt file (reproduced below)
http://www.canyoucrackit.co.uk/robots.txt

User-agent: *
Disallow: /

That's the standard "don't index ANYTHING from this website" robots.txt configuration that has been used for over a decade by countless sites. It's only very recently that Google's started ignoring it.

The way around it would have been to put the second stage in a subdirectory e.g. /second/ with a username and a complex password (revealed by solving the first puzzle). That would then give access to the second clue which would allow for the discovery of the /second/third/ subdirectory (with a different complex username/password combo) and ultimately to the solution buried still deeper (/second/third/fourth/) and with yet another username/password combo. Google would have got stuck at "/" and would not/could not index further than that.

GreyWing · Dec 2, 2011

Edwin said:
By reading the contents of their robots.txt file (reproduced below)
http://www.canyoucrackit.co.uk/robots.txt

That's the standard "don't index ANYTHING from this website" robots.txt configuration that has been used for over a decade by countless sites. It's only very recently that Google's started ignoring it.

I don't think you are getting what I'm saying mate, we don't know what they wanted to do. We can see what it looked like they wanted to do.

How old is the robot file? was it placed there after they knew the google bot would find it? do they know how to bypass the google bot, have they called google and told them to bypass the bot? Have they got a htaccess file that redirects the bot away from the robots.txt file.

We don't know and we can't possibly know any of this.