Toronto Dead Drop Explained

I thought I’d give my own story of the Toronto Dead Drop as It was really interesting to read Karl Freeman’s take on the London drop after he had successfully retrieved it.

I’d always read about other dead drops and been waiting to see Lee come to Toronto for a while, unfortunately I happened to be at the FITC job fair earlier on that day and ran into some friends I hadn’t seen in a while. Long story short I got home at 4am and saw Lee’s post saying it had been planted.

Clue 1
I immediately looked through the page source to check for hidden links, I found none so proceeded to tell my room mate Adam, who is a huge gamer and generally good at puzzle solving about the dead drop. Embarrassingly, this part took us the longest to find, I tried looking at the possibility there was something hidden within the reCAPTCHA validation plug in to no avail, then made sure all the links on the page (including the sidebar) led to where they were suppose to. Finally i searched for embedded information within the images on the page, and then while trying to find patterns within the text itself, it hit me that it was meant literally.

Typing clues in the search form led to this page:

Clue 2
If you noticed the title of the page are gps co-ordinates. I plugged those into google to get:

Adam and I headed to the location, which wasn’t really close to where we live, but we were so excited that it didn’t matter! We got there around 7:30am to find a sign, which i don’t have a picture for, but Lee thankfully took one, here is the image from his blog:

Clue 3
Not having mobile internet was horrible, but we had our laptops and we wrote everything on the sign down and quickly headed over to the Hilton where FITC was being hosted at, which wasn’t far at all actually.
After connecting to the FITC wifi (which was horrible the whole conference btw, thanks Hilton!), plugging in the numbers at the bottom of the sign into the page led us to a new page, with a flash file that looked like this:

I ripped the audio from the flash file (click to download) which was obviously a phone dialing sequence. We tried googling DTMF translators online but didn’t find any fast enough and I grew inpatient and just loaded it up in Audacity.

By comparing the levels of sound on the spectrum view and matching a few tones up to the sound of tones on my cellphone, we quickly found a phone number – 1-866-989-3451.

Clue 4
Calling the phone was a frightening ordeal in itself, it was a creepy voice telling us numbers, listen to the recording here. Sounded like the girl from the ring!

We reached a consensus on what the number was after two or three dials, but it was only 10 digits and there were 11 boxes which six switches in each. I noticed how clicking next on the page passed every containers on/off state through as a variable and set to work to try find a way to make a 10 digit number containing numbers 1-9 fit in 11 spaces containing 1-6. I tried changing the base number to Octal, Hex, and a few different numbering systems to see the variations but after about 10-15m we found out it was braille. We were still missing a digit however, but after I suggested we look up the annotation for a full stop (period) in braille we found the ‘number following’ sign which we inserted into the first box of the page along with the rest of the number.

Taken from wikipedia:

Clue 5
This took us to a new page with requested access to a webcamera, the webcamera had this logo besides it.

It was clearly an augmented reality application, but we were still in the Hilton at the time and heading home to print this image would have taken a long time. A few minutes later we found ourselves in the business center at the hotel printing the image. We printed it out once and nothing happened, so then watched the first 20 seconds of Lee’s tutorial on augmented reality that I remember he posted a little while ago.

The square he had been using to trigger the reaction from the application in the tutorial had a border and was inverted from this logo, so I quickly made a border for this image, inverted it and tried printing it again. I was convinced this would work, but it didn’t. I blamed this on the shoddy quality of the printers at the Hilton, whom liked printing out grey rather than black.

All was not lost, decompiling this file lead me to see this line of code:

This was loading an external texture (mat.png). So i navigated to http://leebrimelow.com/mat.png and found this image:

Clue 6
We set of to find the package and arrived on scene around 9:20am, we looked around the bushes where it was suppose to be for a good half hour i think, because I remember Karl saying he looked for a good period of time before he found it in the bushes for the London drop.

We felt defeated when we couldn’t find anything but called it quits and headed to get some lunch. We knew it was a long shot when we started out at 4am and as we had expected, later on in the day we found out that just 2 hours earlier than us somebody had already claimed it! Great job to who ever found it.

Next time hopefully I’ll have a portable device with internet connectivity. That would be majorly helpful these days in general. I hate not having twitter or email while I’m on the move, I also like having a roof over my head though so I think I have to put money towards rent first and foremost!

Thanks for doing these Lee, It was a lot of fun! See you at your Byte Array presentation in a few hours!

-Raz

Comment (1)