Council of 9

By Mystic of Co9 I have been working with The Council of Nine to solve puzzles since 2012. Our team is made mainly of people who met entirely through attempting (and failing) to solve the Defcon 20 Badge Challenge. Through the years we've continued to work together, eventually earning two black badges for being the first to solve DC23 and DC24. We have learned a lot about puzzle solving through this experience, but we've also learned a lot about working as a team. My intention with this post is to share a bit of this wisdom. I will start by dispelling some common misconceptions and then present what I think might actually make a good puzzle solving team.

Misconceptions

1. Tools: Great teams have some kind of magic tool that solves everything. Tools help, but a good puzzle will be resistant to advanced tools and/or require only the most basic of tools to solve. Every Defcon badge puzzle that I've worked on could have been solved with nothing more than pencil, paper, and google. Occam's Razor is always your friend. Forgetting that can lead you down some interesting rabbit holes (See the CryptoK Cipher: https://twitter.com/0xCryptoK/status/1292316580957700096). 2. Genius: There's one uber solver on the team that does all the work. You may in fact have some real smart people on the team, but beware that solving puzzles isn't something you can master like programming or music. Even if you have someone who is a master cryptographer on your team that person isn't going to just know that, for example, the drum beat in the background of the audio is morse code. That takes more than technical skill to solve. That master cryptographer on your team is very useful for running cipher text though obvious solutions (like Caesar or basic transposition) but don't assume that they are going to be able to throw intellect at every problem while everyone else sits back and enjoys the show. 3. Team Size: Having 30 people on your team means you are 30X more likely to solve. It's more about how you organize your team than how many people are on it. The last thing you want is lots of people generating lots of noise. If you can pull off a 30 person team, more power to you, but you'll find that most large teams only have a small number of people actively working on a puzzle at a time. You'll also find that smaller teams tend to be way more organized, which is critical if you want to succeed. With good organization you could have a bad ass team with only 3 people. For more on how to organize your team see the suggested team roles later in this post. 4. Deception and Social Engineering: The best teams social engineer their way to the solution and play dirty. We use every tool available to us and social engineering and deception are part of the game, however it is rare that teams succeed on this alone. Information gained through social engineering, in my experience, can certainly give you an edge, but only a small one. Your team has to combine this with your own unique solves. The reality is that if your team is good you'll be so far ahead at points that social engineering is useless. Let me also give you a word of warning: beware of social engineers who want to join your team. They might at some point use their skills against you. I'm sure every good team has a story about this to tell over some beers.

What Actually Makes a Good Team?

If you are still working on the Badge challenge, be warned! Spoilers below!

If you’d like to play along, you can grab all of the required materials for free at:

https://media.defcon.org/DEF%20CON%2028/DEF%20CON%20Safe%20Mode%20Badge.rar

Exposition:

Before getting into the badge challenge write-up, we would first like to take a moment to thank all those who helped make this possible. First and foremost, a big shout out to 1o57 for putting together these amazing puzzles every year, and the sacrifices required to make it happen. Also a big thanks to the DEFCON organizers as a whole, who allow people like us to engage in these puzzle-solving shenanigans, and giving 1o57 a place to create and foster the hacker mindset.

Finally, a big thank you and congratulations goes out to Co9’s newest members, and four complete DEFCON newbies (congrats on your first con!):

Cr0wn_Gh0ul (@Cr0wn_Gh0ul) 

JTobCat (@jtobcat) 

LeFevre (@Lefevre) 

motive (@leemsparks)

With that, let’s get into it.

The DEFCON 28 Badge 

The Council of 9, undaunted by the irregular startup routine of DEFCON Safe Mode, prepared to scuffle and rumpus against the bewildering puzzles of 1o57 once again. After purchasing our DC28 badges, the fun began.

As 1o57 puzzles go, you never have an official starting place. You have to find it. So as we found answers or interesting information, we would record it for possible future use, and move on to the next thing we could find. Eventually, the breadcrumbs resolve into a path to follow.

This years badge consisted of three physical items:

A traditional printed cassette tape insert booklet

An old school audio cassette tape

The Lanyard

Booklet 

The cassette tape insert booklet had several codes printed across it.

First, looking at the track listing:

Taking the first letter of each song on the side A tracklist spells out “LOSTINTIME”. For the uninitiated, 1o57 is the longtime Defcon badge designer and puzzlemaster. These track names also contain hints for later - Keywords like Lissajous.

Color Block Sub Cipher

Written, the color boxes read

Orange White Pink

Purple White/Green Orange/Green

Blue/Green Green Pink White

Purple/Green White/Green Orange White 

and

Orange Blue Yellow/Yellow Green/White Purple

Green/White Green/White Yellow

By substituting the letters directly below for colors the first image, decodes to DEF CON SAFE MODE. It's basically a key.

So the second is

Skull Text

This string of text wasn’t nearly as simple to decipher. This skull artwork was a throwback to DC21, which had us scurrying to find notes and write-ups on the Badge puzzles from that year. Ultimately, however, we found the solution by taking the text string and pasting it into a 6x6 route transposition cipher, yielding:

tIstFCOnRFoofFioumYrgureoohrDOuntlon

Which is read Come on four dot four is right in front of you

We didn’t yet know what to do with this, so we put it aside for later.

Cipher Text Page

Xbaw maek wzme pgty zvxy izwk iwhk lnhy

agrl rrlp fsis xadh uflx dsqh rzrg qegu

itwb wveq aslo moii xmzx mvea rtil yekd

lvks jrbo arvy nmjz wodi gcxe tkrr cyir

xbsu rwyf slwr ixyk lrwz sbzr zbpg rrrw

hjsi alXX 1o57

The solution to this text really came from the fact that we were paying attention to 1o57 dropping random hints in various locations - not from anything in the booklet itself. 1o57 had played a video on his Twitch channel from The Adventures of Buckaroo Banzai Across the Eighth Dimension. Most notably, Buckaroo is famous for using the phrase: “No matter where you go there you are”

Using this as an OTP key...

nomatterwhereyougothereyouarenomatterwhereyougothereyouarenomatterwhereyougothereyouarenomatterwhereyougothereyouarenomatterwhereyougothereyouarenomatterwhereyougothere

...you get another Buckaroo quote (actually written by Greek philosopher Odysseas Elytis) :

Know that as in life there is much that many have looked up on but few have seen because as my father told me and his father told him you will come to learn a great deal if you study the insignificant in depth

Cassette Tape

With the booklet sorted, we turned our attention to the DC28 cassette tape. Upon listening to the tape, there are some immediate … features… that stick out.

Tones

One of the first things anyone listening to the tape will notice is the odd tones that sound at different times, and seem to repeat. These were halves of a DTMF (Dual-tone Multi-Frequency) tone, known better by many as “touchtones”, and appeared in two (2) groups of fourteen (14) tones that repeated three (3) times. By combining these single frequency pairs back together, we restored the dual frequencies and, by examining the peak frequency of the tones, we were able to identify the keypresses that generated the given tones. The flow of tones came out as:

DTMF Numbers: 2 6 3 3 9 6 7 3 7 9 9 9 4 9

We’re not done yet, though! Not yielding any immediate plaintext, we continued checking for a second-stage decipherment. As we’ve learned from other puzzles, any phone-related cipher should be checked for T9 coding, which turned out to be exactly what we have here.

By looking at a phone keypad,

Reading those indices onto the available letters, we get: CODEWORDSYZYGY

Oscilloscope

 It’s not just the obvious side of the audio that we need to examine - the audio on the cassettes had much more than meets the … ears. Based on some hints that 1o57 dropped, and our experience with past puzzles, we decided to examine the audio for any hidden waveforms or other hidden data. Using a software oscilloscope, we examined the tape audio and discovered plenty of hidden text, as well as Lissajous patterns (remember that word from the Tracklist? Ya, that was the hint to get us here). The patterns we saw included a spaceship, a heptagon, a butterfly, and some very interesting text. The text we needed was:

The full text that shows up in the oscilloscope reads:

FIND A KEY AT LOSTBOY.NET SLASH PALEBLUEDOT

These two lead us to http://lostboy.net/PaleBlueDot

When we found this, though, the site was not yet active (since DEFCON hadn’t officially started). Oh well, better solve the Lanyard while we wait.

The Lanyard 

This year’s lanyard proved to be quite tricky. We went through several iterations of attempts to make sense out of it. Pictured below is the lanyard with our attempts at dividing up and delineating each shape.

1o57 offered quite a few hints about the symbols on the lanyard - and with good reason. Finding the appropriate reading for the text was pretty difficult. Here are some of the most important hints that came out:

...now excuse me while I go read more about French aristocrats fleeing a post 1789 revolution. 

More hints will start flowing from the font of knowledge tomorrow after DEFCON officially starts....

These sorts of hints eventually point towards the Crackly font, hosted on emigre.com (https://www.emigre.com/PDF/Crackly.pdf). Using this font, we were able to extract the following values from the lanyard segments:

Note first those mad MSPaint skills. Note second that all of those numbers are below 26, we immediately changed them into letters, giving us:

Q X U N

E K K E

V I O Q

Q G C O

Throwing this through a ROT, because you should always ROT everything, discovered that it was ROT-24’d. (Side note: Why ROT-24? Because ROT-24 is a negative ROT-28. Tricksy)

O V S L

C I I C

T G M O

O E A M

While not immediately obvious, one observant council member noted the presence of the C-O-M series of letters when reading in the vertical 4x4 pattern. Reading it in this way gave us what we were after:

OCTOVIGESIMALCOM → http://octovigesimal.com

Octovigesimal.com 

This new page contained quite a bit of new content that we needed to sort through, and any answers were certainly not obvious.

Image filename: besidenequals2.jpg

The summation equation written at the bottom of the Goonies skull key implied that we need something that follows the pattern 1.1 + 2.2 + 3.3 + 4.4. The banner of the website implies that we need to look at the album “The Great 28” by Chuck Berry. This is further hinted at by the text “Record your answer~”, as in a record. We even think the tilde, from the latin for ‘title’ was probably part of the hint.

Upon looking at the Track list of “The Great 28” we saw that there is a track called Come On, which is right before a track called “Nadine (Is it You)”. This seems to link back to the text that we extract from the cipher text on the cassette tape insert “Come On Four Dot Four is right in front of you” Come On happens to be Section 4 track 4 of the album (4.4) and is “right in front of” (before) “Is it You”.

Going with that train of thought, and concatenating the titles of tracks 1.1, 2.2, 3.3, and 4.4:

Chuck Berry - The Great 28:

we get: MaybelleneRockandRollMusicMemphisComeOn

However, we don’t know what to do with this yet. Note it and move on.

Last on this site, but certainly not least, is another URL. Hidden right in plain sight underneath the logo is a pointer to the URL “Base-28.com”.

Alright, time to move on. 

base-28.com

The first thing to look at here is the ciphertext in the top center of the page. We have a few strings to play with from previous solves. With the earth, moon and sun being in a line on the page, we figured it was a good opportunity to try the key that we found previously (from the audio DTMF codes): SYZYGY. This ciphertext is Vigenere encoded with SYZYGY as the key, and decodes to Who are you going to call? Definitely sounds like Ghostbusters to us.

Also of note here, is that the image on the arcade cabinet was identified as being the Temple of Gozer - a Ghostbusters scene. This scene is actually Chapter 28 on the GhostBusters DVD, and is titled “Crossing Streams”. This reinforces the Ghostbusters clue that the vigenere text gives us, and will prove critical to the next step.

On either side of the website we see pictures of members of the band The Commodores. 64 of them, in fact. These two clues combined tell us that we need to look at the Ghostbusters Commodore 64 game. What specifically about it? We don’t know yet.

Visually, it looks like this...

Pale Blue Dot 

The Lissajous from the audio on the cassette tape pointed us to lostboy.net/PaleBlueDot. Upon accessing this page, we were greeted with… a wall of numbers. A giant freaking wall of numbers. Oh, and a joke.

How many Sagans does it take to change a lightbulb?

A quick google search will reveal the hilarious answer: “Billions and billions”

How it’s supposed to be solved

The numbers in the image are divided by the decimal, with a number of seemingly arbitrary length on the left, and eight (8) digits to the right of the decimal.

Left-Hand Numbers 

Noticing that the numbers, with appending a few leading 0s, can be paired into values all less than 26.

Separating them out, and converting them via Letter-Numbers

Then, Vigenere decode using the key “billionsandbillions” (from the Sagan riddle) to get the plaintext:

ChineseTakeout

CrunchBar 

Eggs 

Twinkie 

Marshmallows 

Popcorn 

Pizza 

PotatoChips 

Gum 

Cheezits 

Beer 

These resulting words are the Game Franchise Username for the Ghostbusters c64 game, save bankroll amount.  This consists of the Username (left side decoded) + 8 digit account number (right side number), with the decimal separating the two.

Right-Hand Numbers 

The numbers on the right of the decimal, being 8 digits, are the account numbers for the Ghostbusters game. These can be plugged into the game (via an emulator) to discover the corresponding amount of money that is ‘saved’.

Emulator Franchise Username and account number screen:

Account Amount after validation of Username screen:

The Final Step 

Realizing that these account balances all have trailing ‘00’s, remove the 0’s and convert the remaining numbers into letters to reveal the next destination.

Numbers: 13 25 19 20 5 18 25 19 3 9 5 14 3 5 20 8 5 1 20 5 18

Letters: M Y S T E R Y S C I E N C E T H E A T E R

Also, noting that each segment in the graphic is separated by the text ‘PaleBlueDot’, place a dot between the words, to arrive at a web address.

https://mysteryscience.theater

How we actually solved it (the narrative of pain) 

One of our immediate observations was that the numbers always had eight digits on the right of the decimal. From the base-28.com site we knew about the c64 Ghostbusters game, and had the Crossing Streams chapter title as a potential hint that we needed to use clues across websites. In our reading about the c64 game, we learned that it was one of the first that allowed players to ‘save’ their game. Researching how this ‘save’ feature worked, we noted that it always used 8-digit account numbers, which curiously lined up with our 8-digit numbers to the right of the decimal. This felt like a crazy idea at the time, but we were frustrated enough to try it. Given the account numbers, we needed to find a way to reverse out the Names and Balances that would give those account numbers.

This video explains how the ‘save’ feature works: https://www.youtube.com/watch?v=_3cpbCCfK5A

Rather than digging into the algorithm, like we should have done, we discovered a Chrome extension that generated Ghostbusters accounts.

We tempted fate and downloaded the extension, only to rip out the code in order to reverse the algorithm. With that, we wrote the below brute forcer which, after inputting a Name, would try all possible account balances and then check if any of the resulting account numbers matched any of the account numbers from the image.

We immediately set out trying names that came from 1o57’s Twitch streams or other areas of the puzzle so far - and we found a few that worked:

'REAGAN,RONALD',

'POLLY,SKATING'

'SOTER,STEVEN',

'MORANIS, RICK',

'BROLIN,JOSH',

'HOUSE,BRICK'

But note that we said ‘a few’. We couldn’t find hits for every account balance. Fortunately, these were enough to assure us that we weren’t crazy, and we began attempting to interpret our output. While working through this, we realized that we didn’t even need the names. Using the information from the aforementioned YouTube video, we learned how to derive the information we needed. Take the account number for 1o57 which is 27710104. Reverse the number by pairs to get 04017127. Then convert from octal to hex, you get 101E57. The middle byte, 1E, is the hash of the name. The account balance is the first and third byte, so 1057. We filled in the remaining few accounts to come up with a full dataset. As it turns out, the whole page could have been solved like this on a calculator.

Examining the resulting balances, and knowing that the game’s algorithm divided the balance by 100, we dropped the trailing ‘00’ and then converted the remaining numbers into letters, revealing the string mysterysciencetheater. After trying this on a few of the known sites with no luck, we discovered that this was pointing us to mysteryscience.theater The PaleBlueDot in the middle of the numbers was also a hint to look for a domain.

While we had discovered some new information, it was not a complete solution. We still hadn’t used the left-hand side numbers from the PBD image, so we now shifted our focus to those numbers. After realizing that the numbers seemed to be relatively low when split into their component digits, we tried Letter-Number conversion again. We then Vigenere’d that output with the riddle answer ‘billionsandbillions’, and came up with a list of delicious food from the Ghostbusters movie. As it turns out, these were the names we were supposed to use to get the balances via a Ghostbusters c64 emulator. oops.

The complete output was:

Mysteryscience.theater 

This page was kind of interesting in that there wasn’t really much to do with it… at least not immediately. From time to time, 1o57 will time-gate an area of his puzzles, and this is exactly what we ran into here. So, fast forwarding something like 24 hours, let’s begin examining the final puzzle-filled state of the page.

The top of the page now contained ciphertext. After a few attempts at deciphering it, we tried one of our old unused pieces of data (the concatenated list of Chuck Berry song titles) as a key and were greeted with a successful decipherment:

An y QewpFyyvRqd,

WehjhwpIclpVtme:

Ioqfig oloage.

Using OTP key: MaybelleneRockandRollMusicMemphisComeOn

On a PaleBlueDot,

WrestleWithThis:

Things change.

The meaning from this was clear! Head on over to http://lostboy.net/PaleBlueDot/WrestleWithThis

WrestleWithThis

Not much to see on this page, just the text “It’s only a tiny problem” and a YouTube video.

In the page source was the following comment:

<!- bFNhZ2FuQExv ->

And the title of the page was:

Wrestle With This y6nk3z9y

The comment Base64 decodes to lSagan@Lo

Additionally, the hint on the page about a ‘tiny’ problem, combined with the page title, resulted in a tinyurl link for our next destination:

tinyurl.com/y6nk3z9y → http://lostboy.net/PaleBlueDot/EverythingWasFineWithOurSystem.jpg

EverythingWasFineWithOurSystem

The image on this page immediately presents us with two sets of ciphertext, and a curious little man yelling at us from the corner.

As seen lightly overlaid into the blue of the car:

U2VuZCBDb3Nt =base64=> Send Cosm

And in the rear light:

TG9zdGJvWSBkb3Qgc2xhc2ggSEhI =base64=> LostboY dot slash HHH

Navigating to http://lostboy.net/HHH, we were greeted with two more youtube videos. The first one was titled “Close but no Cigar”. Immediately realizing that this meant we hadn’t interpreted the clue correctly, we Nope’d right the heck out of there. Luckily, we also knew what HHH was referencing from watching 1o57’s Twitch stream on 8/7. so we wasted no time in discovering the correct endpoint.

lostboy.net/HappyHarryHardOn 

Here we go, a YouTube video and some encoded text. This feels right. The video was of RayParker Jr. performing the GhostBusters theme song, and below it was the text “What a singer! LostboY.net/PaleBlueDot/?” Also on the page was the text “F1LZuQ9E4JQ”.

The F1… text was another YouTube video; Chuck Berry and Tina Turner performing Rock n Roll Music. In an interesting twist, we discovered that by sorting the video comments by Newest first, there was a comment from NEW SOUND AGENCY with the text “b3MgdG8gQ2Fy”.

Also, if we look at the NEW SOUND AGENCY channel on YouTube, it has just one video of 1o57 playing around with a MiniMoog. Yep, this is a clue. This text of the comment base64 decodes to “os to Car”....hmmm.. That seems to fit with the other ciphertext we’ve found so far.

As for the URL, the team immediately recalled that Ray Parker Jr. may have, probably, almost certainly, likely, stolen the Ghost Busters theme music from Huey Lewis and the News’ “I Want A New Drug”. The next URL, then, was pretty simple to guess:

http://lostboy.net/PaleBlueDot/HueyLewis/

HueyLewis (and the Solve) 

This page was pretty simple. A single ciphertext was present on the image and gave us the following:

c3Rib1kubmV0 =base64=> stboY.net

And finally, putting together all of the fragments that had been discovered:

U2VuZCBDb3Ntb3MgdG8gQ2FybFNhZ2FuQExvc3Rib1kubmV0

Base64 decodes to => Send Cosmos to [email protected]

We shot off an e-mail (several e-mails?) as directed, and got replies letting us know that Defcon 28 Badge Challenge: Complete … phew. The e-mail also linked to another video and requested that we watch it as a team.

We immediately shared a screen as a team and viewed the video together.

With that, DC28 badge challenge was complete.

@TheCouncilOf9

Co9.io

write-up by junkmail(co9). replica by wumpus(co9) and junkmail(co9)

Four years ago I met a group of randoms at DEFCON 21. I had heard that the Badge had a competition and started puzzling it out. My small group grew larger as people saw what we were doing. 72 intense hours later, we finished - Second place - not bad for n00bs. Defeated but resolute we formed the Council of Nine with intent to compete again - and win. After our second defeat we repeated the resolution and Lo! DC23 was our first victory.

There is always interesting math of how many badges are awarded for any particular Defcon contest - Most have a single Uber badge granted and others receive one per team member. At DC23 we received a single Uber for winning the Badge Challenge. The DC23 badge is an awesome tribute to Richard Feynman and includes captured lightning, several radioactive isotopes and a kickass crypto coin with brilliant artwork. Immediately discussions began - can we counterfeit this Work of Art?

Yes. Yes we can.

We had one official badge awarded for winning DC23. The DC staff forces that badge to be assigned to a self-dox'd individual (as in Give us your Name, alias, and signature in a little black book or you get nada! Boo!) After all that, our designated owner was (quite reasonably) reluctant to physically ship it about. Instead he took a bunch of measurements and photos, and I worked from them.

Our total project time spanned over about 6 months, most of which consisted of research and awaiting order fulfillment. But we feel the results were -up on his making of the Uber, complete with its rich history and tribute to physicist Richard Feynman. As descriptive material, he noted the many radioactive components, the sculptural Lichtenberg figures and the crypto coin.

Lightning the Load

One of our team (let's call him wumpus) researched the Lichtenberg and found one single source! Easy right? Not so much. The creator alluded he was retiring and would no longer be producing these amazing figures. As we didn't have a 5 million volt, 150 kW particle accelerator readily at our disposal, we figured we were out of luck... or were we?

wumpus contacted the creator and brilliantly convinced him to come out of retirement one last time to make our sculptures!* He provided the specifications and quantity, and we were set for November delivery.

The limiting item was the Lichtenberg figure, without which there would be no replica. And with the Lichtenberg figures on order for a November creation, we moved our attention to the more attainable items.

Go 'Topes!

Armed with a list of specific materials our other builder junkmail (hey thats me!) started to dig. I found research sites that allowed for scientific samples of radioactive material to be sold in the US. These sites united our efforts to obtain nuclear samples of:

Trinitite Fragments

3% Uranium Marbles

Europium powder

Uranium Ore

Torbernite

Uraninite

Pitchblende

Carnotite

Gummite

YellowCake

Tritium Vials

Europium powder is cool. It glows like nothing else - really brightly - especially when you hit it with Ultraviolet light to charge it.

The remaining components are rocks, dust and sand. These ores and samples are placed under each of the two skulls as indicated.

We're not going to go into detail on where these materials could be purchased exactly, but with a united effort and research university credentials, you might locate the nuclear materials. Or not.

Uranium Glass was actually pretty common until the 1940s. It was used for a long time in glassware until people started watching Godzilla movies. Nah - it was WWII and availability of U that reduced its use on plates used for food). I ordered the Uranium marble from our supplier. I admit I did panic a bit on opening the package: Clear marbles were shipped! They were the correct size, but not matching the need. After a few emails, and my insistence that the supplier's website image still showed the 5/8" pink variety, he dug through his old stock supply and made the exchange.

The Skulls were found with google fu, notably appending "-Indiana" to every search. In the end we determined that Swarovski (oooh fancy!) crystal skulls were exact matches. There remained a question to their patina - some online images of the Uber showed a prismatic effect, while others showed clear. It appears that different skull hues were used among the final badges. The prismatic effect in sample skull I got seemed to be far too strong compared to the comparison images, so after some debate we opted for clear skulls on both left and right sides.

Inside the left skull is a Tritium Vial. This vial is the type used for watches, gun sights and exit signs to glow for years of its own nuclear decay. It was pretty straightforward locating the T1-sized vials. T1 vials fit into the left skull bore. The vials were selected to match the color (light blue) and sized to fit in to the Crystal Skull. Did I mention the skulls are actually jewelry beads? So there was already a small hole available for the vial.

A Challenging Coin

And finally the most time consuming part - the Challenge Coin. I had never duplicated (or made) a challenge coin before, so I had no reference how long or how much effort this would entail. Originally I had considered a laser etched version and a 3D printed but after some tests realized that the laser etching a black at depth would be time consuming if even possible, and using my 3D printer just couldn't provide the resolution, especially in the finer Korean characters and intricacies in the central pyramid.

I started the duplication with the artwork. Having little experience and an Adobe creative cloud account, I learned to use Illustrator. Now Illustrator has an auto-trace function available and despite my modern and surprisingly affordable sculpture being crushed on the Hydraulic Press Channel (yes other Co9 members - I just plugged myself), I am no fine artist. So autotrace sounded perfect right?! I loaded one of our better images, sat back and waited for the file to be ready for the vendor.... So yeah - it's not that easy. The auto object was about a billion polygons, and far too heavy to open, let alone edit down for use. In the end I took another approach and searched for clip art.

The main Pyramid is quite similar to the Illuminati all-seeing eye on a dollar bill and there are many many renditions online. Fortunately Adobe provided the material needed. The Korean characters, UBER block letters front crypto text and some clip art edits were all hand drawn, removed or traced manually to match the images. Remember kids - if you are copying a coin, make sure the original picture is proportionally correct! It took a little while to realize that the coin in my image should be circular... (First you do, then you do over!) The artwork took a long time primarily due to my inexperience with illustrator.

The reverse side (coins have obverses and reverses, not fronts and backs, though heads and tails will do...) was more challenging. Even with an original in our remote possession, the coin details were not clear through the 1/2" thick acrylic Lichtenberg. Luckily, 1057 had distributed a few loose coins to friends -- a result of having both deserving recipients and minimum quantity coin orders. This image shows a Vulcan Live Long and Prosper hand sign as a posthumous tribute to Leonard Nimoy, a stylish skull, cryptotext (which we had not yet deciphered), and 1o57s signature. I followed a similar route as the obverse and manually recreated all the components as I could not locate any clip art.

Now with the file and Occam's razor in hand, I used the simplest method for creation: Outsourcing. There are too many challenge coin vendors out there to be sure but I suspect many just send them overseas for production which was the case from our nearly random selection. Showing the purchase agent my design and images of the coin, I had to explain that this was a copy, not the original because, uhh, we had, umm, lost the file. She could not see any difference. Encouraged the order was placed.

There appears to be a minimum line thickness possible with stamping coin. In a few cases I was below that minimum though it is hard to detect unless you are looking.

I received the coins a few weeks later and I was stunned. They looked Amazing. I put one on my pocket and it has been there ever since :-)

The Build

Parts started arriving in early 2016. It was February before everything was in hand but I was still missing something... glue! What adhesive was used? it was not totally clear, but close. At first, cyanoacrylate (superglue) was considered, but this tends to off-gas and leave a whitish vapor residue. Epoxies and other glues were considered but none dried optically clear until I came upon GS Hype jewelry cement. It is made specifically for attaching glass beads to jewelry and stay clear. Importantly it also works well on plastics and glass. And that it could hold diamonds and emeralds to those Fabergé eggs was good enough for me. Amazon for $6.

Now the easy parts: Measure and drill some holes (standard 3/4" drill bit), apply thin glue, drop in ores, more glue, and a skull on top. Slip in the tritium vial and cap with more glue. Wait until dry. I followed the same procedure for both skulls and the Uranium+Europium marble combo at the bottom. Also, Europium gets into everything. That tablecloth still glows after I turn off the lights.

The final two steps were gluing the Challenge coins centrally, and adding the hook/lanyard, both of which I got at a local HD. Not perfect matches, but pretty close. I had to rework the hooks in to a more 'diamond' shape and noted the way the original lanyards were tied.

*Denouement: The Joke's on Us.

Remember that retired guy who we expertly coaxed back into making the Lichtenberg figures for us? At the EFF badge hacking contest at DC24, 1o57 let several things be known:

1) The Lichtenberg figure guy really is retiring, but he just has a deal with 1o57 to make us work for his help! (Another counterfeiting team got the exact same story - that he'd 'come out of retirement' for this project). Even better, he also contacted 1o57 when someone ordered the triangular figure. So 1o57 totally knew what was up. Well played 1o57... Well played.

2) The real Challenge Coins have a secret mark on them! 1o57 added a random looking scratch to the coin to mark it as his own, but it blends in like just another scratch. Good luck locating it without an original! (or with an original...)

Thanks to the rest of Co9 for trusting me with the project. For the time, money, and effort spent on this build, it was fantastic experience with amazing results. I do hope to do it again with our DC24 Terminator UBER!

Presentation to 1o57

Co9 loves the Badge Challenge. We realize the incredible amount of effort the 1o57 volunteers every year to make this happen and are greatly appreciative. We built an extra replica to give to 1o57 to show our appreciation, and gave it to him right before the DC24 opening ceremony. He loved it and wore it on stage. He gave us a shout out too that this was the best counterfeit he'd ever seen. So Happy.

If you like to make/build IRL hit me up. [No, I won't make you one so stop asking!]

After successfully winning the DC24 badge challenge, we ventured out of the 1o57 room. Only to find more crypto & puzzles to solve!

Every year, for the past few years, the EFF has embedded a puzzle in their defcon tshirt.

Council of 9 ventured forth to DEFCON 24 to compete in this year's badge challenge, brought to us each year by 1o57. There was determination among the team to win at DC24 to ensure that last year's win was not a fluke. After many sleepless nights in Vegas, we emerged victorious for a second year in a row.

Here is the entire adventure as we experienced it, with all of the puzzles we encountered, and how we defeated them. Understand that this may not contain solutions to all of the puzzles in the challenge, but there will be plenty of spoilers.