(Warning) Mission for phase 2 can be done individually First one: Spoiler isp guilty of attacks: http://archive.blackwatchmen.com/search/G9D8V7 Second one: Spoiler find a exploit in the firewall Third: Spoiler Seek the passwords
This mission can be done on your own, so Anashel has asked us not to post answers in the thread. That being said, if you need help, reach out.
Due character limit on OP, I post the new on there and SPOILER tag the old ones so it wont be a scroll fest Spoiler: Stage 01 Action Required You must build an extensive database of all the Internet cafes in key African cities in preparation against a major cyberthreat. Background On December 3, a major riot broke out in Abuja, NG causing significant civilian casualties. Local authorities claim the violence erupted suddenly, without warning, across the city. An investigation into the incident revealed the riots began at various Internet cafes in key locations in Abuja, near High Value Targets (HVT) and that the outbursts all began at roughly the same time. Since then, similar riots have broken out in Nairobi, KE, Lusaka, ZM and Monrovia, LR. Our analysis suggests some aspect of these Internet cafes cause the riots, but we do not yet understand how. NITE Team 4 is mounting an investigation so we can learn more about the exact nature of the link. Until then, we need you to gather as much data as possible on Internet cafes near HVT in select cities in Africa so we can set up a monitoring network. You will be updated on Monday, Dec 19, 2016 once NITE Team 4 has finished their investigation. The pattern of riots suggests a cyclical nature. The next event in the cycle is likely to occur at 18:00 UTC December 22, 2016. NITE Team 4 is currently gathering more intel on possible causes of each outburst cycle. Instructions All agents must work to gather recon information on Internet cafes near HVT throughout Africa. This is no small task and requires extreme precision, so we’ve created a template ( goo.gl/q43Bzc ) for all agents to use and submit when gathering intel for this mission. All recon is to be submitted to Dispatch no later than 14:00 UTC on Monday, December 19, 2016. Submit intel gained through recon on a rolling basis: we need to start analyzing the results immediately. Work quickly, this is an enormous task. You have been assigned to recon the city below. While you can perform your recon mission solo, you are not the only agent to be assigned this city, so coordinate your actions with fellow agents via the secure internal message boards and chat network to ensure you cover the most ground effectively. Access Recon Report Template here: goo.gl/q43Bzc , sign into Google and make a copy, then submit your completed report to [email protected] Seek out only Internet cafes near HVT - Government Offices, Embassies, Military Facilities, Major Banks and Central Transportation Hubs. Special attention should be paid to locations with multiple Internet cafes near one or multiple nearby HVT, as in the Recon Sample Report Use all recon means at your disposal [Mapping tools, streetview and online directories], but do not communicate or engage with the Internet cafes being mapped - we do not want to cause a panic within local populations. Monitor the Div 66 Twitter for further details and updates. YOUR RECON CITY IS: *check your email* NITE Team 4 has already begun an extensive monitoring campaign in the region, so we can better understand the situation. Spoiler: Stage 01B ------------------------------Phase 01B----------------------------------------- Action Required Based on the intel gathered by agents, NT4 has prioritized 5 hot zones that required in-depth analysis. A lot of work needs to be done quickly, we need your help. As more intel comes in from the new locations in the field, NITE Team 4 will analyse it as another possible hot zone. Background On December 3, a major riot broke out in Abuja, NG causing significant civilian casualties. Local authorities claim the violence erupted suddenly, without warning, across the city. An investigation into the incident revealed the riots began at various Internet cafes in key locations in Abuja, near High Value Targets (HVT) and that the outbursts all began at roughly the same time. Since then, similar riots have broken out in Nairobi, KE, Lusaka, ZM and Monrovia, LR. Our analysis suggests some aspect of these Internet cafes cause the riots, but we do not yet understand how. NITE Team 4 is mounting an investigation so we can learn more about the exact nature of the link. Until then, we need you to gather as much data as possible on Internet cafes near HVT in select cities in Africa so we can set up a monitoring network. You will be updated on Monday, Dec 19, 2016 once NITE Team 4 has finished their investigation. The pattern of riots suggests a cyclical nature. The next event in the cycle is likely to occur at 18:00 UTC December 22, 2016. NITE Team 4 is currently gathering more intel on possible causes of each outburst cycle. Instructions All agents must work together in an effort to gather a greater understanding of a selected hot zone from NITE Team 4. Recon intel most include: Satellite view of the city hot zone, with a 10 x 10 grid superimposed. Mapping of Internet cafes in proximity to High Value Targets (HVT) Investigation of vulnerable HVT including: GPS Coordinate and elevation. Key suspect currently active in the region (Warlords or Dictators, Criminal Organizations) Major ISP provider for the region Main Internet Backbone for the region (EASSy, Main One, SAT-3, SAT-2, SEACOM, etc...) Inventory of inbound and outbound airflight activity [air routes] Aggregate the data using Google Map and full Google Doc report. Post your intel in the appropriate mission thread. Agent, you are assignment are: YOUR RECON GROUP IS: *check your email* COM CHANNEL URL: *check your email*
I may be missing the obvious here, but is the COM-Division portal working at the moment? I'm not sure where I input the answer, as the message box seems to just be for the Twitch stream. Is the portal still able to accept answers?
Sorted - for some reason it wasn't working when I clicked the map icons before, but now it seems fine!
I had this problem earlier, some hidden twitch overlay was above the map, preventing me from clicking the map nodes. Removing it through the HTML Inspector worked
Spoiler: Stage 2 First email Action Required Access NT4 Intrusion Task Force on the COM Division to further investigate the collaboration between foreign operatives and local groups in African cities. Update Intel gathered from field agents’ recon is now being analyzed. Initial reports suggests that Abidjan, Durban, Kaduna, Kampala, and Maiduguri are most likely to be the targets of the upcoming trigger event. We have been monitoring these five spots extra closely. More details will be needed from the analysis before these locations can be confirmed. NITE Team 4 has completed their preliminary investigation. Analyzing the localized internet traffic prior to each incident suggests that a series of bizarre sites may be connected to the violent outbursts. Little usable data was found on each of the sites, since they appear to have been completely wiped shortly after the riots. However, NITE Team 4 was able to trace these sites to a hosting server owned by an unknown group of foreign operatives. Further probing the online activity of suspicious groups in Durban and Maiduguri uncovered communications linking these foreign operatives to a series of bait websites believed to be operated to deanonymize users accessing TOR from African IP addresses. The connection between these two findings remains unclear, but we have reason to believe that investigating this group will reveal more information on who is responsible for the events in Africa. Instructions Access the NT4 Intrusion Task Force on the COM Division to aide NITE Team 4 in an investigation into the bait websites to better understand the motivations behind the riots and to predict the unknown group’s next best move. NITE Team 4 Briefing Document - Archive #G9D8V7 COM Division - https://com-division.blackwatchmen.com/ Monitor the Div 66 Twitter for further details and updates. With a better understanding of this operative’s intentions, we can begin preventative measures at all Internet cafes within the comprehensive database gathered by the Global Agent Network. ACCESS NT4 INTRUSION MISSION COM-DIVISION < click to open Old email in spoilers, new in OP
So we got an e-mail about an encrypted message, which decoded to a pastebin with a set of coordinates and fractions. Using the fractions and the coordinates, we picked out the following message from the names of local NY businesses: North Pole Of The Blue Rose Sign Socrates. The Socrates Sculpture Park in New York has a blue rose sign suspended between two poles. Dispatch wants us to dispatch agents to intercept the drop there on the morning of the 21st. Do we have any New York agents availible?
The decryption key is Morocco, it's the only African country that doesn't have its country code top level domain in the second string. Yeah, coordinates are 40.767750, -73.936172 according to ManyPinkHats
Decrypting the message: Spoiler: Decryption Information First nineteen characters (up to the first period) is the ciphertext. Everything after the first period indicates the key. The (period)(letter)(letter) codes are all top-level domains for African countries, in mostly-alphabetical order. Conspicuously missing is Morocco, as (I think) every other country is identified. Use initial key MOROCCO for a Vigenere autokey to decode the message. The decrypted message: Spoiler: Decrypted Message pastebincomRf803yDr Reading the message: Spoiler: The New Message Going to http://pastebin.com/Rf803yDr, we find the new message. Up until "1/3...", the message is clear. They've noticed us, and there will be a pick-up on the morning of the 21st.Following that, there is a set of coordinates with additional numbers preceding them. The co-ordinates are all New York based. Each set is preceded by a number or set of numbers (to be called the indices) followed by a divider and another number (to be called the length). Each coordinate point falls near an establishment with as many words in its name as the length. Indexing into establishment names using the indices (e.g. 1/3 for "North Side Imports" = NORTH) gives "North Pole of the Blue Rose Sign Socrates". Thus, the pick-up location is the north support pole for Lisa Oppenheim's APPLAUSE, which depicts blue roses and is currently the Broadway Billboard (sign over the Broadway entrance) for Socrates Sculpture Park. Coordinates are approximately 40.767750, -73.936172. http://socratessculpturepark.org/exhibition/broadway-billboard-lisa-oppenheim/
New notice from dispatch: The park appears to be closed for the night, suggest recon tomorrow after 9am local time. Be advised that foreign operatives may be on scene at drop location. Suggest sending a single or pair of field agents. Photograph scene, attempt to obtain and exit scene quickly. Ensure you are not followed, we need this to be a covert mission. Do we have any New York area agents available for tomorrow?
Considering there's a likelyhood of enemy agents onsite at the rendezvous time, how do we A) keep it covert, and B) not end up with every agent in the local area just showing up? Perhaps just up Broadway with a long lens so you don't actually have to get right up on the pole itself? They wanted pictures, not interception of the drop-off, so... -- Seshemw
