Yesterday Bad Dragon sent out 3 emails to their user base, 1 from the main list, 2 to the forum list. These emails appeared to be automatically generated error messages filled with cryptic messages and encoded hints. Being a generally inquisitive rabbit, I’m trying to figure out what it all means. In this post I’ll share the emails, and everything I’ve been able to decode so far
Lets start with the main one, witch went out to the full Bad Dragon Mailing list though icontact.
This is the only email most people received, and it contains the most information
QR Code:
This seams to be the main clue, and the only thing most people have decoded. Scan the QR code, and you get
Subj: Alarm Condition
MSG: KG7NPM-H;
Point value: Off ;
IN ALARM;
5/14/15 09:00:00 PM;
Point Id: 39°31'25.3"N;
Point Id: 119°46'45.9"W;
Channel Id: 145.126 Mhz;
Channel Encoding: Scot/S1;
Some parts of this are easy. The Time, Date, Point ID GPS coordinates all point to Biggest Little Fur Con. The frequency in Channel ID is an Amateur Radio band in the 2 meter range. Often used by hand held radios or for “Fox Hunt” style games. The rest of the information looks like gibberish, but I hope I’m wrong
Binary Code:
01000011010100100100111101
00111000100000011001100100
0101101001011010001100101011
00100
Putting this into any Binary Decoder, and it spits out more gibberish. ” CRON fE��+ ”
Links:
Every link in the email points to an Guest Access Error page on the new Dragon Island website. No clue if you can do anything else from this URL to get more information, But I hope there is.
Other:
“A: /> setup.bat” – Just for show, or hints on a URL file location?
“Updating Setting Files 165 . . .” – The “165” in this is colored to match the background of the email, making it invisible, Could just be a coding error when they built the email. I don’t think it has any other meaning.
“Fatal system error: CRON has malfunctioned, please evacuate the island as soon as possible!” – Another bit of hidden text. The email has the word “Cron” a lot in it, at first I though it was to make the email look like it was automatically generated by a cron job. Now I think this is the name of the next toy to be released from Bad Dragon’s Dragon Island campaign.
The next email went out to their forum list
T̮̩̭̩̲̹H̉̒ͣͣ̇͑̍E̸̠̭͚͆ͣ̓R̼͈ͪ̍ͮ͘E̫͓̮͇ͦ ̶̟͔͍̘͕̓̆͛ͣ̌I̶̳͎͕̭̩̰͆ͫS͚̦̘͔̈ ̧̩̏̈͋ͭͬṆ͓͇̣͕̗̟͌ͥ́ͫͣO̘̅̽ ̷̠ͣͬͫ̈́͐̊E̠̮͛̔ͣ̉̿ͩX̳̆̑͑͐͋̽́I̙̘͎̐̚T̻̓ͩ̒͑̔͊̚
[05:24:10] >start system rerun program: whiterabbit.obj
[05:24:32] >system FAIL: corruption detected
[05:24:47] >unusual seismic activity detected
[05:25:12] >system movement determined fatal
[05:25:15] >early disaster alert system malfunction
[05:24:10] >release message from local host QR<
S͔̗̬͟Y̗̱̬͞Ş̘͉̜͍͉̝̫T̗̮͙͘E̖̙̹̥͖͔̥M ̪E̤̗̦̪̯͉̰R̨̮͔ͅR̢̗̥͈̙̙OR,͓̠̗̝̬
S̝͕̬E̞̠̱I̲͙̫͍̹̬͞S̵̹̩̱̼̰̹̗M̪͔͓̜̣IC̺̜̥͎̣͖
̢͎͙͓A̲͓̭͓C͓̭̻͖̭T̺̜̹̪̬̬̩͡I͇̟̱̠̦ͅV̧̪I͍̩͈̺̬̦̬T͠Y̧
̤M̺͎̖ͅͅA͖L͍̩̮͈̭F̧̖̫͓UN̗̣̫͎̮͢CT̯͎̟̺̙͖ĮO̜̘̣͉̤͈N̸̲̰͖͙̞̘̭, ̺͖͟ͅE̩͚͢Ṉ͍͈̺̩͎̙Ḍ
M̮̹E̱̦͍̤S͔͙ͅS͈̗͜ͅA͔̪̪̺͓G̖̦͎̝E͚̤̱͇ͅ
l͔͈̺̗͚̭̼ͅo̼͕͇͔̰a̳d͇̠̼̣͕̗i̭̫̗ṇ̰̝̝͚͓͙̭g͕͙ͅ
͔̪͚̫͎̩̝ͅi̘n̯̯̻̜͈͕̗̜̘d̬͎̙͎͚e̻̫̻̲̪x̜̘̠̘
…..
f̮̱̬̺̺=͈̱̥̳ͅ1͎̳̮̜̙̭̠2̞̬͈͎6͓̲&͙̮̠̜̳͈t=3͏̞̖̘ͅ0̥̩̖̦͕2̦̘̜̪̀6̹͓̞̗̭̩̣5̡
Lots of garbled text, It brings up the QR code and has what looks to be 2 URL query parameters “f=126&t=30265” After some work I found out they are used in the forums
https://forums.bad-dragon.com/viewtopic.php?f=126&t=30265
This is a post about a “Mile High Airlines Conspiracy” A very cute post, but not sure how it fits in with “Cron”
The 2nd forum email came an hour later.
///WARNING///
cron malfunction pattern recognized
subsume E:\ override pattern: cauterize and expunge
generate readout log:[05:24:10] >start system rerun program:
whiterabbit.obj
[05:24:32] >system FAIL: corruption detected
[05:24:47] >unusual seismic activity detected
[05:25:12] >system movement determined fatal
[05:25:15] >early disaster alert system malfunction
[05:24:10] >release message from local host
QRS͔̗̬͟Y̗̱̬͞Ş̘͉̜͍͉̝̫T̗̮͙͘E̖̙̹̥͖͔̥M ̪E̤̗̦̪̯͉̰R̨̮͔ͅR̢̗̥͈̙̙OR,͓̠̗̝̬
S̝͕̬E̞̠̱I̲͙̫͍̹̬͞S̵̹̩̱̼̰̹̗M̪͔͓̜̣IC̺̜̥͎̣͖
̢͎͙͓A̲͓̭͓C͓̭̻͖̭T̺̜̹̪̬̬̩͡I͇̟̱̠̦ͅV̧̪I͍̩͈̺̬̦̬T͠Y̧
̤M̺͎̖ͅͅA͖L͍̩̮͈̭F̧̖̫͓UN̗̣̫͎̮͢CT̯͎̟̺̙͖ĮO̜̘̣͉̤͈N̸̲̰͖͙̞̘̭, ̺͖͟ͅE̩͚͢Ṉ͍͈̺̩͎̙Ḍ
M̮̹E̱̦͍̤S͔͙ͅS͈̗͜ͅA͔̪̪̺͓G̖̦͎̝E͚̤̱͇ͅ
f̮̱̬̺̺=͈̱̥̳ͅ1͎̳̮̜̙̭̠2̞̬͈͎6͓̲&͙̮̠̜̳͈t=3͏̞̖̘ͅ0̥̩̖̦͕2̦̘̜̪̀6̹͓̞̗̭̩̣5̡
l̘̫͎̼̬͉̀o͕̳͎̦̼͈͞a̤͍͎̲̜͕d̹̯́i̗͜n̵͔͍̗g̞̱͔̖͎̠͕
͖.̶̺̼̰̭͖.̣̘̩.̣͙̖̳̣̀.̖̳̝̤̹͍.̥̪
̜̮̻̹̻F̳̹̮͕͘A͇̫ĮL̙͚͖͉̬͕UR҉͖̣̼̜̮E̶͍̞̯̩̫͍ͅ
̨̥F̵̹͕̣A̪̪͇̱͎ͅͅI̵͎͓̱L͏̲U̘͟ͅR̛̺͉Ḙ̝͉
̺͉̞F̜͉̖͟A̩͕͈̩̬͘I̳͇̟̻͔̦L̹͈̰̜̗U̲̤̞̗͜ͅR̗̝͎̬̝͚͢E̖ ̣͚͜
̪̹̦̭̺́
͚̦̦͎̭r̯͢e͍di̗̙̪̘̫͓̠͜r̝͙͖̬̭e̥͈͎̜̭c̴t̗̘͕͇ͅ
͞f=̵̫1͖̹̥2͇̖̯͘6̙͖̥̯͘ͅ&͔̳͇͖t̝̥̣̖̠ͅ=3͕̼͉̠̗͕̱͢0͙̲2̶̭̭̖̹̱̖65̭̖̻ͅ
͡b̮͔͍̘̞͔i̡̖͈̪t̢̬̘̺̪̺͓̮.͞l̦̻̙͇y̭̯̜̗͇͎͡/҉1̛͙͙̙̜H̰̭̖d̬̲͓q҉̠͍͉͚͚j̟͠ͅd̨͙͚̳̠̟̪͕Y̤͙̪̪̭̞̕
̞̥G̻̪͎̖͇U͏̖͔̩̜̥E̖S̠͔̦̞̭̺͟T̴ ͓̰̹̺͞À̪̹͖ͅC̪͝C̞̪͎͓͠ES̜͍̦̭S͍̭͈͍͚
̠̙̙ͅN̪̤͇͘Ơ͇̫͉̲̤T̢͕͇̖ ͓F̰̺͜O҉̲͙̖͙̫͙U̙̲̘N̹̝̘̗D͏͔̹̯̠͉͈
̬̖̟͔̤̘͟ͅ
͇̗͍͖E̷̟͕̪R̯̼R͖̞̻̠̻̦O̵̤͇͚R҉̖͙̘̥̠
Ḙ̛͍̬̣ͅR̷͈̼̫̘̟̹͕R̤̝͕̘̝̗̜O̷̙͇̻R̸̰̹̝
̦E͙͔̹̳͉̞̘̕R͏̝R̦Ọ͝R̯̘͉̭̲͘
Now this email has a lot to decode.
“cron malfunction pattern recognized” – Another references to “Cron” witch sounds like a name rather then a program term.
“whiterabbit.obj” – Being a white rabbit my self, this part really got me excited. In the first Jurassic Park movie; Whte_rbt.obj was a computer virus-like backdoor programmed into the system by Dennis Nedry, which led to the Isla Nublar Incident. Dragon Island being a Homage to the Jurassic Park series and the upcoming Jurassic World movie, this connection makes sense.
“f=126&t=30265” – Same Url query parameters we saw in the last email.
“bit.ly/1HdqjdY” – Leads to the same QR code from the main email.
“Guest Access Not Found” – Same as the link from the main email as well
Conclusion
Cant be sure, but I believe that at the date and time listed in the QR code a new toy will be announced, Cron’s toy. As for the radio channel and encoding, I could see them doing a “fox hunt” and the first person to find the transmitter getting the first Cron, or a coupon.
The only problem I have with this theory is it that a lot of the encoded hints would just be useless, and sending out 3 emails to your entire fan base when only a few will be at Biggest Little Fur Con; even fewer will have the necessary equipment for a Fox Hunt to begin with (I only know of 2 people going who do.) Would give this marking plan a very limited scope.
But hay, the fun is in the figuring it out. I guess we’ll see what happens on the 14th at 9pm
Update!
We have some photos, looks like Cron is a Utahraptor!
