I have been working with The Council of Nine to solve puzzles since 2012. Our team is made mainly of people who met entirely through attempting (and failing) to solve the Defcon 20 Badge Challenge. Through the years we’ve continued to work together, eventually earning two black badges for being the first to solve DC23 and DC24.
We have learned a lot about puzzle solving through this experience, but we’ve also learned a lot about working as a team. My intention with this post is to share a bit of this wisdom. I will start by dispelling some common misconceptions and then present what I think might actually make a good puzzle solving team.
Misconceptions
1. Tools: Great teams have some kind of magic tool that solves everything.
Tools help, but a good puzzle will be resistant to advanced tools and/or require only the most basic of tools to solve. Every Defcon badge puzzle that I’ve worked on could have been solved with nothing more than pencil, paper, and google. Occam’s Razor is always your friend. Forgetting that can lead you down some interesting rabbit holes (See the CryptoK Cipher: https://twitter.com/0xCryptoK/status/1292316580957700096).
2. Genius: There’s one uber solver on the team that does all the work.
You may in fact have some real smart people on the team, but beware that solving puzzles isn’t something you can master like programming or music. Even if you have someone who is a master cryptographer on your team that person isn’t going to just know that, for example, the drum beat in the background of the audio is morse code. That takes more than technical skill to solve. That master cryptographer on your team is very useful for running cipher text though obvious solutions (like Caesar or basic transposition) but don’t assume that they are going to be able to throw intellect at every problem while everyone else sits back and enjoys the show.
3. Team Size: Having 30 people on your team means you are 30X more likely to solve.
It’s more about how you organize your team than how many people are on it. The last thing you want is lots of people generating lots of noise. If you can pull off a 30 person team, more power to you, but you’ll find that most large teams only have a small number of people actively working on a puzzle at a time. You’ll also find that smaller teams tend to be way more organized, which is critical if you want to succeed. With good organization you could have a bad ass team with only 3 people. For more on how to organize your team see the suggested team roles later in this post.
4. Deception and Social Engineering: The best teams social engineer their way to the solution and play dirty.
We use every tool available to us and social engineering and deception are part of the game, however it is rare that teams succeed on this alone. Information gained through social engineering, in my experience, can certainly give you an edge, but only a small one. Your team has to combine this with your own unique solves. The reality is that if your team is good you’ll be so far ahead at points that social engineering is useless.
Let me also give you a word of warning: beware of social engineers who want to join your team. They might at some point use their skills against you. I’m sure every good team has a story about this to tell over some beers.
What Actually Makes a Good Team?
1. Variety of skills: Hardware, coding, music, languages, pop culture, and classic/modern cryptography are all valuable skills to have represented on your team. Don’t worry too much about finding geniuses. A lot of our solves came from people who were simply willing to try something no one else thought of yet. That comes out of having people with a variety of perspectives and knowledge bases.
2. Team Players: People on the team should want to be on a team. They need to be willing to be a part of something greater than themselves. If you want individual glory, then maybe you shouldn’t be on a team. It sounds harsh, but if you join a team you are part of that team. Even if you didn’t have any solves yourself or you ended up solving a ton of the puzzles, it’s the team that succeeds or fails, not you personally. There will be arguments, there will be frustrations. Deal with this as a team. Strong egos and chasing individual glory can be toxic to a team at its core. Don’t let it fester too long.
3. Clearly Defined Roles: Especially for larger teams you’ll want to decide on some roles. We would suggest having at least these three:
Front line: People who take all the puzzles and start trying everything to solve them right away. They are gathering all the clues, running them through tools, trying different analysis methods, etc..
Middle line: There people are taking everything the front line folks are doing and verifying it. If the front line says for example, “the cipher text is 40 characters and here is the hex and binary of it, I tried all ROTs, nothing” then the middle line does all of that again to make sure there weren’t any mistakes or anything missed. They are also looking for missed correlations. For example, they might say “oh the text on the badge is also 40 characters, I’ll try OTP with all of them”.
Documentation: These people are taking anything that seems like a solution or a clue and documenting it. This can be done in a google doc, a flow chart, markdown in github, etc.. For larger teams, it can be a good idea to split this role so one person is documenting and the other is communicating when the docs are updated with new information. This helps a lot in moments where everyone is stuck. Did we miss a clue? Is there something we still haven’t solved? Is there a keyword we haven’t used? The documentation should be able to answer all these questions.
4. Year Around Communication: Don’t be a “see you next year” team. Keep up communication year around. Try solving puzzles outside of your main focus. Not everyone on the team will be able or willing to do this, but some will. The more you work together the better you are going to get at it. Also, Don’t take for granted the fact that your team is full of smart people who share a common interest. I’ve gotten to know people through Co9 that helped me to improve my skills in a lot of areas beyond puzzle solving. In the end, isn’t the real solve all the friends you made along the way?
I hope this post helped to dispel some myths about puzzle solving teams. I also hope this inspires others to start new teams or improve their own. A lot of the members of Co9 genuinely enjoy helping others with this stuff. Don’t hesitate to reach out. We know this is a competition, but we love solving puzzles and meeting others who share this pretty niche passion.
Defcon tends to give out only one black badge to the winners of the badge challenge (if at all). We don’t do it for the badge (although when we do get a black badge we make more [links to badge copy posts]). We do it for the challenge. I think this embodies the hacker ethos in a pure way. Let others take the spotlight, the sponsorships, the glamorous parties, and the fancy job offers. Who has time for that? We’re here in this hotel room solving.
Before getting into the badge challenge write-up, we would first like to take a moment to thank all those who helped make this possible. First and foremost, a big shout out to 1o57 for putting together these amazing puzzles every year, and the sacrifices required to make it happen. Also a big thanks to the DEFCON organizers as a whole, who allow people like us to engage in these puzzle-solving shenanigans, and giving 1o57 a place to create and foster the hacker mindset.
Finally, a big thank you and congratulations goes out to Co9’s newest members, and four complete DEFCON newbies (congrats on your first con!):
Cr0wn_Gh0ul (@Cr0wn_Gh0ul)
JTobCat (@jtobcat)
LeFevre (@Lefevre)
motive (@leemsparks)
With that, let’s get into it.
The DEFCON 28 Badge
The Council of 9, undaunted by the irregular startup routine of DEFCON Safe Mode, prepared to scuffle and rumpus against the bewildering puzzles of 1o57 once again. After purchasing our DC28 badges, the fun began.
As 1o57 puzzles go, you never have an official starting place. You have to find it. So as we found answers or interesting information, we would record it for possible future use, and move on to the next thing we could find. Eventually, the breadcrumbs resolve into a path to follow.
This years badge consisted of three physical items:
A traditional printed cassette tape insert booklet
An old school audio cassette tape
The Lanyard
Booklet
The cassette tape insert booklet had several codes printed across it.
First, looking at the track listing:
Taking the first letter of each song on the side A tracklist spells out “LOSTINTIME”. For the uninitiated, 1o57 is the longtime Defcon badge designer and puzzlemaster. These track names also contain hints for later - Keywords like Lissajous.
Color Block Sub Cipher
Written, the color boxes read
Orange White Pink
Purple White/Green Orange/Green
Blue/Green Green Pink White
Purple/Green White/Green Orange White
and
Orange Blue Yellow/Yellow Green/White Purple
Green/White Green/White Yellow
By substituting the letters directly below for colors the first image, decodes to DEF CON SAFE MODE. It’s basically a key.
So the second is
Skull Text
This string of text wasn’t nearly as simple to decipher. This skull artwork was a throwback to DC21, which had us scurrying to find notes and write-ups on the Badge puzzles from that year. Ultimately, however, we found the solution by taking the text string and pasting it into a 6x6 route transposition cipher, yielding:
tIstFCOnRFoofFioumYrgureoohrDOuntlon
Which is read Come on four dot four is right in front of you
We didn’t yet know what to do with this, so we put it aside for later.
Cipher Text Page
Xbaw maek wzme pgty zvxy izwk iwhk lnhy
agrl rrlp fsis xadh uflx dsqh rzrg qegu
itwb wveq aslo moii xmzx mvea rtil yekd
lvks jrbo arvy nmjz wodi gcxe tkrr cyir
xbsu rwyf slwr ixyk lrwz sbzr zbpg rrrw
hjsi alXX 1o57
The solution to this text really came from the fact that we were paying attention to 1o57 dropping random hints in various locations - not from anything in the booklet itself. 1o57 had played a video on his Twitch channel from The Adventures of Buckaroo Banzai Across the Eighth Dimension. Most notably, Buckaroo is famous for using the phrase: “No matter where you go there you are”
…you get another Buckaroo quote (actually written by Greek philosopher Odysseas Elytis) :
Know that as in life there is much that many have looked up on but few have seen because as my father told me and his father told him you will come to learn a great deal if you study the insignificant in depth
Cassette Tape
With the booklet sorted, we turned our attention to the DC28 cassette tape. Upon listening to the tape, there are some immediate … features… that stick out.
Tones
One of the first things anyone listening to the tape will notice is the odd tones that sound at different times, and seem to repeat. These were halves of a DTMF (Dual-tone Multi-Frequency) tone, known better by many as “touchtones”, and appeared in two (2) groups of fourteen (14) tones that repeated three (3) times. By combining these single frequency pairs back together, we restored the dual frequencies and, by examining the peak frequency of the tones, we were able to identify the keypresses that generated the given tones. The flow of tones came out as:
DTMF Numbers: 2 6 3 3 9 6 7 3 7 9 9 9 4 9
We’re not done yet, though! Not yielding any immediate plaintext, we continued checking for a second-stage decipherment. As we’ve learned from other puzzles, any phone-related cipher should be checked for T9 coding, which turned out to be exactly what we have here.
By looking at a phone keypad,
Reading those indices onto the available letters, we get: CODEWORDSYZYGY
Oscilloscope
It’s not just the obvious side of the audio that we need to examine - the audio on the cassettes had much more than meets the … ears. Based on some hints that 1o57 dropped, and our experience with past puzzles, we decided to examine the audio for any hidden waveforms or other hidden data. Using a software oscilloscope, we examined the tape audio and discovered plenty of hidden text, as well as Lissajous patterns (remember that word from the Tracklist? Ya, that was the hint to get us here). The patterns we saw included a spaceship, a heptagon, a butterfly, and some very interesting text. The text we needed was:
The full text that shows up in the oscilloscope reads:
When we found this, though, the site was not yet active (since DEFCON hadn’t officially started). Oh well, better solve the Lanyard while we wait.
The Lanyard
This year’s lanyard proved to be quite tricky. We went through several iterations of attempts to make sense out of it. Pictured below is the lanyard with our attempts at dividing up and delineating each shape.
1o57 offered quite a few hints about the symbols on the lanyard - and with good reason. Finding the appropriate reading for the text was pretty difficult. Here are some of the most important hints that came out:
…now excuse me while I go read more about French aristocrats fleeing a post 1789 revolution.
More hints will start flowing from the font of knowledge tomorrow after DEFCON officially starts….
These sorts of hints eventually point towards the Crackly font, hosted on emigre.com (https://www.emigre.com/PDF/Crackly.pdf). Using this font, we were able to extract the following values from the lanyard segments:
Note first those mad MSPaint skills. Note second that all of those numbers are below 26, we immediately changed them into letters, giving us:
Q X U N
E K K E
V I O Q
Q G C O
Throwing this through a ROT, because you should always ROT everything, discovered that it was ROT-24’d. (Side note: Why ROT-24? Because ROT-24 is a negative ROT-28. Tricksy)
O V S L
C I I C
T G M O
O E A M
While not immediately obvious, one observant council member noted the presence of the C-O-M series of letters when reading in the vertical 4x4 pattern. Reading it in this way gave us what we were after:
This new page contained quite a bit of new content that we needed to sort through, and any answers were certainly not obvious.
Image filename: besidenequals2.jpg
The summation equation written at the bottom of the Goonies skull key implied that we need something that follows the pattern 1.1 + 2.2 + 3.3 + 4.4. The banner of the website implies that we need to look at the album “The Great 28” by Chuck Berry. This is further hinted at by the text “Record your answer~”, as in a record. We even think the tilde, from the latin for ‘title’ was probably part of the hint.
Upon looking at the Track list of “The Great 28” we saw that there is a track called Come On, which is right before a track called “Nadine (Is it You)”. This seems to link back to the text that we extract from the cipher text on the cassette tape insert “Come On Four Dot Four is right in front of you” Come On happens to be Section 4 track 4 of the album (4.4) and is “right in front of” (before) “Is it You”.
Going with that train of thought, and concatenating the titles of tracks 1.1, 2.2, 3.3, and 4.4:
Chuck Berry - The Great 28:
we get:
MaybelleneRockandRollMusicMemphisComeOn
However, we don’t know what to do with this yet. Note it and move on.
Last on this site, but certainly not least, is another URL. Hidden right in plain sight underneath the logo is a pointer to the URL “Base-28.com”.
Alright, time to move on.
base-28.com
The first thing to look at here is the ciphertext in the top center of the page. We have a few strings to play with from previous solves. With the earth, moon and sun being in a line on the page, we figured it was a good opportunity to try the key that we found previously (from the audio DTMF codes): SYZYGY. This ciphertext is Vigenere encoded with SYZYGY as the key, and decodes to Who are you going to call? Definitely sounds like Ghostbusters to us.
Also of note here, is that the image on the arcade cabinet was identified as being the Temple of Gozer - a Ghostbusters scene. This scene is actually Chapter 28 on the GhostBusters DVD, and is titled “Crossing Streams”. This reinforces the Ghostbusters clue that the vigenere text gives us, and will prove critical to the next step.
On either side of the website we see pictures of members of the band The Commodores. 64 of them, in fact. These two clues combined tell us that we need to look at the Ghostbusters Commodore 64 game. What specifically about it? We don’t know yet.
Visually, it looks like this…
Pale Blue Dot
The Lissajous from the audio on the cassette tape pointed us to lostboy.net/PaleBlueDot. Upon accessing this page, we were greeted with… a wall of numbers. A giant freaking wall of numbers. Oh, and a joke.
How many Sagans does it take to change a lightbulb?
A quick google search will reveal the hilarious answer: “Billions and billions”
How it’s supposed to be solved
The numbers in the image are divided by the decimal, with a number of seemingly arbitrary length on the left, and eight (8) digits to the right of the decimal.
Left-Hand Numbers
Noticing that the numbers, with appending a few leading 0s, can be paired into values all less than 26.
Separating them out, and converting them via Letter-Numbers
Then, Vigenere decode using the key “billionsandbillions” (from the Sagan riddle) to get the plaintext:
ChineseTakeout
CrunchBar
Eggs
Twinkie
Marshmallows
Popcorn
Pizza
PotatoChips
Gum
Cheezits
Beer
These resulting words are the Game Franchise Username for the Ghostbusters c64 game, save bankroll amount. This consists of the Username (left side decoded) + 8 digit account number (right side number), with the decimal separating the two.
Right-Hand Numbers
The numbers on the right of the decimal, being 8 digits, are the account numbers for the Ghostbusters game. These can be plugged into the game (via an emulator) to discover the corresponding amount of money that is ‘saved’.
Emulator Franchise Username and account number screen:
Account Amount after validation of Username screen:
The Final Step
Realizing that these account balances all have trailing ‘00’s, remove the 0’s and convert the remaining numbers into letters to reveal the next destination.
One of our immediate observations was that the numbers always had eight digits on the right of the decimal. From the base-28.com site we knew about the c64 Ghostbusters game, and had the Crossing Streams chapter title as a potential hint that we needed to use clues across websites. In our reading about the c64 game, we learned that it was one of the first that allowed players to ‘save’ their game. Researching how this ‘save’ feature worked, we noted that it always used 8-digit account numbers, which curiously lined up with our 8-digit numbers to the right of the decimal. This felt like a crazy idea at the time, but we were frustrated enough to try it. Given the account numbers, we needed to find a way to reverse out the Names and Balances that would give those account numbers.
Rather than digging into the algorithm, like we should have done, we discovered a Chrome extension that generated Ghostbusters accounts.
We tempted fate and downloaded the extension, only to rip out the code in order to reverse the algorithm. With that, we wrote the below brute forcer which, after inputting a Name, would try all possible account balances and then check if any of the resulting account numbers matched any of the account numbers from the image.
We immediately set out trying names that came from 1o57’s Twitch streams or other areas of the puzzle so far - and we found a few that worked:
‘REAGAN,RONALD’,
'POLLY,SKATING’
'SOTER,STEVEN’,
'MORANIS, RICK’,
'BROLIN,JOSH’,
'HOUSE,BRICK’
But note that we said ‘a few’. We couldn’t find hits for every account balance. Fortunately, these were enough to assure us that we weren’t crazy, and we began attempting to interpret our output. While working through this, we realized that we didn’t even need the names. Using the information from the aforementioned YouTube video, we learned how to derive the information we needed. Take the account number for 1o57 which is 27710104. Reverse the number by pairs to get 04017127. Then convert from octal to hex, you get 101E57. The middle byte, 1E, is the hash of the name. The account balance is the first and third byte, so 1057. We filled in the remaining few accounts to come up with a full dataset. As it turns out, the whole page could have been solved like this on a calculator.
Examining the resulting balances, and knowing that the game’s algorithm divided the balance by 100, we dropped the trailing ‘00’ and then converted the remaining numbers into letters, revealing the string mysterysciencetheater. After trying this on a few of the known sites with no luck, we discovered that this was pointing us to mysteryscience.theater The PaleBlueDot in the middle of the numbers was also a hint to look for a domain.
While we had discovered some new information, it was not a complete solution. We still hadn’t used the left-hand side numbers from the PBD image, so we now shifted our focus to those numbers. After realizing that the numbers seemed to be relatively low when split into their component digits, we tried Letter-Number conversion again. We then Vigenere’d that output with the riddle answer ‘billionsandbillions’, and came up with a list of delicious food from the Ghostbusters movie. As it turns out, these were the names we were supposed to use to get the balances via a Ghostbusters c64 emulator. oops.
The complete output was:
Mysteryscience.theater
This page was kind of interesting in that there wasn’t really much to do with it… at least not immediately. From time to time, 1o57 will time-gate an area of his puzzles, and this is exactly what we ran into here. So, fast forwarding something like 24 hours, let’s begin examining the final puzzle-filled state of the page.
The top of the page now contained ciphertext. After a few attempts at deciphering it, we tried one of our old unused pieces of data (the concatenated list of Chuck Berry song titles) as a key and were greeted with a successful decipherment:
An y QewpFyyvRqd,
WehjhwpIclpVtme:
Ioqfig oloage.
Using OTP key: MaybelleneRockandRollMusicMemphisComeOn
Navigating to http://lostboy.net/HHH, we were greeted with two more youtube videos. The first one was titled “Close but no Cigar”. Immediately realizing that this meant we hadn’t interpreted the clue correctly, we Nope’d right the heck out of there. Luckily, we also knew what HHH was referencing from watching 1o57’s Twitch stream on 8/7. so we wasted no time in discovering the correct endpoint.
lostboy.net/HappyHarryHardOn
Here we go, a YouTube video and some encoded text. This feels right. The video was of RayParker Jr. performing the GhostBusters theme song, and below it was the text “What a singer! LostboY.net/PaleBlueDot/?” Also on the page was the text “F1LZuQ9E4JQ”.
The F1… text was another YouTube video; Chuck Berry and Tina Turner performing Rock n Roll Music. In an interesting twist, we discovered that by sorting the video comments by Newest first, there was a comment from NEW SOUND AGENCY with the text “b3MgdG8gQ2Fy”.
Also, if we look at the NEW SOUND AGENCY channel on YouTube, it has just one video of 1o57 playing around with a MiniMoog. Yep, this is a clue. This text of the comment base64 decodes to “os to Car”….hmmm.. That seems to fit with the other ciphertext we’ve found so far.
As for the URL, the team immediately recalled that Ray Parker Jr. may have, probably, almost certainly, likely, stolen the Ghost Busters theme music from Huey Lewis and the News’ “I Want A New Drug”. The next URL, then, was pretty simple to guess:
This page was pretty simple. A single ciphertext was present on the image and gave us the following:
c3Rib1kubmV0 =base64=> stboY.net
And finally, putting together all of the fragments that had been discovered:
U2VuZCBDb3Ntb3MgdG8gQ2FybFNhZ2FuQExvc3Rib1kubmV0
Base64 decodes to => Send Cosmos to CarlSagan@LostboY.net
We shot off an e-mail (several e-mails?) as directed, and got replies letting us know that
Defcon 28 Badge Challenge: Complete
… phew. The e-mail also linked to another video and requested that we watch it as a team.
We immediately shared a screen as a team and viewed the video together.
write-up by junkmail(co9). replica by wumpus(co9) and junkmail(co9)
Four years ago I met a group of randoms at DEFCON 21. I had heard that the Badge had a competition and started puzzling it out. My small group grew larger as people saw what we were doing. 72 intense hours later, we finished - Second place - not bad for n00bs. Defeated but resolute we formed the Council of Nine with intent to compete again - and win. After our second defeat we repeated the resolution and Lo! DC23 was our first victory.
There is always interesting math of how many badges are awarded for any particular Defcon contest - Most have a single Uber badge granted and others receive one per team member. At DC23 we received a single Uber for winning the Badge Challenge. The DC23 badge is an awesome tribute to Richard Feynman and includes captured lightning, several radioactive isotopes and a kickass crypto coin with brilliant artwork. Immediately discussions began - can we counterfeit this Work of Art?
Yes. Yes we can.
We had one official badge awarded for winning DC23. The DC staff forces that badge to be assigned to a self-dox’d individual (as in Give us your Name, alias, and signature in a little black book or you get nada! Boo!) After all that, our designated owner was (quite reasonably) reluctant to physically ship it about. Instead he took a bunch of measurements and photos, and I worked from them.
Our total project time spanned over about 6 months, most of which consisted of research and awaiting order fulfillment. But we feel the results were -up on his making of the Uber, complete with its rich history and tribute to physicist Richard Feynman. As descriptive material, he noted the many radioactive components, the sculptural Lichtenberg figures and the crypto coin.
Lightning the Load
One of our team (let’s call him wumpus) researched the Lichtenberg and found one single source! Easy right? Not so much. The creator alluded he was retiring and would no longer be producing these amazing figures. As we didn’t have a 5 million volt, 150 kW particle accelerator readily at our disposal, we figured we were out of luck… or were we?
wumpus contacted the creator and brilliantly convinced him to come out of retirement one last time to make our sculptures!* He provided the specifications and quantity, and we were set for November delivery.
The limiting item was the Lichtenberg figure, without which there would be no replica. And with the Lichtenberg figures on order for a November creation, we moved our attention to the more attainable items.
Go ‘Topes!
Armed with a list of specific materials our other builder junkmail (hey thats me!) started to dig. I found research sites that allowed for scientific samples of radioactive material to be sold in the US. These sites united our efforts to obtain nuclear samples of:
Trinitite Fragments
3% Uranium Marbles
Europium powder
Uranium Ore
Torbernite
Uraninite
Pitchblende
Carnotite
Gummite
YellowCake
Tritium Vials
Europium powder is cool. It glows like nothing else - really brightly - especially when you hit it with Ultraviolet light to charge it.
The remaining components are rocks, dust and sand. These ores and samples are placed under each of the two skulls as indicated.
We’re not going to go into detail on where these materials could be purchased exactly, but with a united effort and research university credentials, you might locate the nuclear materials. Or not.
Uranium Glass was actually pretty common until the 1940s. It was used for a long time in glassware until people started watching Godzilla movies. Nah - it was WWII and availability of U that reduced its use on plates used for food). I ordered the Uranium marble from our supplier. I admit I did panic a bit on opening the package: Clear marbles were shipped! They were the correct size, but not matching the need. After a few emails, and my insistence that the supplier’s website image still showed the 5/8" pink variety, he dug through his old stock supply and made the exchange.
The Skulls were found with google fu, notably appending “-Indiana” to every search. In the end we determined that Swarovski (oooh fancy!) crystal skulls were exact matches. There remained a question to their patina - some online images of the Uber showed a prismatic effect, while others showed clear. It appears that different skull hues were used among the final badges. The prismatic effect in sample skull I got seemed to be far too strong compared to the comparison images, so after some debate we opted for clear skulls on both left and right sides.
Inside the left skull is a Tritium Vial. This vial is the type used for watches, gun sights and exit signs to glow for years of its own nuclear decay. It was pretty straightforward locating the T1-sized vials. T1 vials fit into the left skull bore. The vials were selected to match the color (light blue) and sized to fit in to the Crystal Skull. Did I mention the skulls are actually jewelry beads? So there was already a small hole available for the vial.
A Challenging Coin
And finally the most time consuming part - the Challenge Coin. I had never duplicated (or made) a challenge coin before, so I had no reference how long or how much effort this would entail. Originally I had considered a laser etched version and a 3D printed but after some tests realized that the laser etching a black at depth would be time consuming if even possible, and using my 3D printer just couldn’t provide the resolution, especially in the finer Korean characters and intricacies in the central pyramid.
I started the duplication with the artwork. Having little experience and an Adobe creative cloud account, I learned to use Illustrator. Now Illustrator has an auto-trace function available and despite my modern and surprisingly affordable sculpture being crushed on the Hydraulic Press Channel (yes other Co9 members - I just plugged myself), I am no fine artist. So autotrace sounded perfect right?! I loaded one of our better images, sat back and waited for the file to be ready for the vendor…. So yeah - it’s not that easy. The auto object was about a billion polygons, and far too heavy to open, let alone edit down for use. In the end I took another approach and searched for clip art.
The main Pyramid is quite similar to the Illuminati all-seeing eye on a dollar bill and there are many many renditions online. Fortunately Adobe provided the material needed. The Korean characters, UBER block letters front crypto text and some clip art edits were all hand drawn, removed or traced manually to match the images. Remember kids - if you are copying a coin, make sure the original picture is proportionally correct! It took a little while to realize that the coin in my image should be circular… (First you do, then you do over!) The artwork took a long time primarily due to my inexperience with illustrator.
The reverse side (coins have obverses and reverses, not fronts and backs, though heads and tails will do…) was more challenging. Even with an original in our remote possession, the coin details were not clear through the ½" thick acrylic Lichtenberg. Luckily, 1057 had distributed a few loose coins to friends – a result of having both deserving recipients and minimum quantity coin orders. This image shows a Vulcan Live Long and Prosper hand sign as a posthumous tribute to Leonard Nimoy, a stylish skull, cryptotext (which we had not yet deciphered), and 1o57s signature. I followed a similar route as the obverse and manually recreated all the components as I could not locate any clip art.
Now with the file and Occam’s razor in hand, I used the simplest method for creation: Outsourcing. There are too many challenge coin vendors out there to be sure but I suspect many just send them overseas for production which was the case from our nearly random selection. Showing the purchase agent my design and images of the coin, I had to explain that this was a copy, not the original because, uhh, we had, umm, lost the file. She could not see any difference. Encouraged the order was placed.
There appears to be a minimum line thickness possible with stamping coin. In a few cases I was below that minimum though it is hard to detect unless you are looking.
I received the coins a few weeks later and I was stunned. They looked Amazing. I put one on my pocket and it has been there ever since :-)
The Build
Parts started arriving in early 2016. It was February before everything was in hand but I was still missing something… glue! What adhesive was used? it was not totally clear, but close. At first, cyanoacrylate (superglue) was considered, but this tends to off-gas and leave a whitish vapor residue. Epoxies and other glues were considered but none dried optically clear until I came upon GS Hype jewelry cement. It is made specifically for attaching glass beads to jewelry and stay clear. Importantly it also works well on plastics and glass. And that it could hold diamonds and emeralds to those Fabergé eggs was good enough for me. Amazon for $6.
Now the easy parts: Measure and drill some holes (standard ¾" drill bit), apply thin glue, drop in ores, more glue, and a skull on top. Slip in the tritium vial and cap with more glue. Wait until dry. I followed the same procedure for both skulls and the Uranium+Europium marble combo at the bottom. Also, Europium gets into everything. That tablecloth still glows after I turn off the lights.
The final two steps were gluing the Challenge coins centrally, and adding the hook/lanyard, both of which I got at a local HD. Not perfect matches, but pretty close. I had to rework the hooks in to a more 'diamond’ shape and noted the way the original lanyards were tied.
*Denouement: The Joke’s on Us.
Remember that retired guy who we expertly coaxed back into making the Lichtenberg figures for us? At the EFF badge hacking contest at DC24, 1o57 let several things be known:
1) The Lichtenberg figure guy really is retiring, but he just has a deal with 1o57 to make us work for his help! (Another counterfeiting team got the exact same story - that he’d 'come out of retirement’ for this project). Even better, he also contacted 1o57 when someone ordered the triangular figure. So 1o57 totally knew what was up. Well played 1o57… Well played.
2) The real Challenge Coins have a secret mark on them! 1o57 added a random looking scratch to the coin to mark it as his own, but it blends in like just another scratch. Good luck locating it without an original! (or with an original…)
Thanks to the rest of Co9 for trusting me with the project. For the time, money, and effort spent on this build, it was fantastic experience with amazing results. I do hope to do it again with our DC24 Terminator UBER!
Presentation to 1o57
Co9 loves the Badge Challenge. We realize the incredible amount of effort the 1o57 volunteers every year to make this happen and are greatly appreciative. We built an extra replica to give to 1o57 to show our appreciation, and gave it to him right before the DC24 opening ceremony. He loved it and wore it on stage. He gave us a shout out too that this was the best counterfeit he’d ever seen. So Happy.
If you like to make/build IRL hit me up. [No, I won’t make you one so stop asking!]
Council of 9 ventured forth to DEFCON 24 to compete in this year’s badge challenge, brought to us each year by 1o57. There was determination among the team to win at DC24 to ensure that last year’s win was not a fluke. After many sleepless nights in Vegas, we emerged victorious for a second year in a row.
Here is the entire adventure as we experienced it, with all of the puzzles we encountered, and how we defeated them. Understand that this may not contain solutions to all of the puzzles in the challenge, but there will be plenty of spoilers.
