Fwd: Re: Karen is missing!

Question

From: Ada Hughes <[email protected]>
Sent: Thursday, April 7, 2016 7:03 PM
To: Joe Dorsen <[email protected]>
CC: Jason Bernz <[email protected]>; IT Guys <[email protected]>
Subject: Re: Fwd: Re: Karen is missing!

Hey Joe,

That sequence underneath the image: Do you think it means anything?

I tried changing some of them to letters, but didn't come up with anything. Did you get anything from your numbers idea?

‐ Ada

---

From: Jason Bernz <[email protected]>
Sent: Thursday, April 7, 2016 6:25 PM
To: Joe Dorsen <[email protected]>
CC: IT Guys <[email protected]>
Subject: Re: Fwd: Re: Karen is missing!

Joe

Okay, good; that helps. I'll get on trying to find Karen, and those kids, from my end, while you guys continue to work on that side.

Keep me updated!

‐ Jason

---

From: Joe Dorsen <[email protected]>
Sent: Thursday, April 7, 2016 6:21 PM
To: Jason Bernz <[email protected]>
CC: IT Guys <[email protected]>
Subject: Re: Fwd: Re: Karen is missing!

Jason,

You asked me to email you the information that we talked about, earlier, so that we had a record of it.

Some updates. There was a hidden message in the letter that stated: "Helps us figure out the clue key is understand". You're definitely going to want to work under the assumption that this is a kidnapping matter, at this point. We'll work, further, to see if that key means anything useful, or not.

We also noticed that strange discrepancy, that I mentioned earlier, with the name of the image that his wife sent him. The email stated that it had a specific name, but when we dug down into the server, it really had a different one. I don't know that it matters, but I went ahead and modified the text, down in this email thread, so that we can reference it, later.

Also (which you know, since you came to see me), we spent several hours trying to figure out if the image that he sent means anything and, quite honestly, we came up blank. I'm not sure if it will really provide us any insight, but we will, of course, keep looking, just in case I am wrong.

‐ Joe
FIB Technical Team

---

$\color{red}{NOTE:\ ORIGINAL\ PUZZLE\ STARTS\ HERE!}$

From: Jason Bernz <[email protected]>
Sent: Thursday, April 7, 2016 1:12 PM
To: IT Guys <[email protected]>
Subject: Fwd: Re: Karen is missing!

Hey, guys.

We've got a situation here. My partner is missing, and her husband received this really odd email, earlier today.

Please check into it, ASAP, and let me know if you guys find anything suspicious going on here. The rest of my team is not around; I've forwarded the entire thread to you, so that you can understand why I'm concerned.

Please let me know if you can figure out what's really going on, and if there's someone that I need to be looking for or if she legitimately left him.

Thanks,
‐ Jason

---

From: Sam Stone <[email protected]>
Sent: Thursday, April 7, 2016 1:10 PM
To: Jason Bernz <[email protected]>
Subject: Re: Karen is missing!

OMG. This is a picture we looked at, a few months ago, when we were searching for where we wanted to take our vacation.

Here's the image from my computer, in case it helps you any. Please let me know what you find out!

---

From: Sam Stone <[email protected]>
Sent: Thursday, April 7, 2016 1:06 PM
To: Jason Bernz <[email protected]>
Subject: Re: Karen is missing!

Sure. Here it is:

From: [email protected]
Sent: Thursday, April 7, 2016 12:46 PM
To: Sam Stone <[email protected]>
Subject: I can't deal with this anymore

Dear Sam,

I just wanted to write this letter, in the hopes that it he𝚕ps you to know why me and the kids are gone. It's not about you. It's about uѕ. We really just need to find a way to fiɡure out how to work things o𝚞t. Sometimes, I just think that t𝗁e problem must be that you really haven't a clu𝖾, but maybe it's me. Maybe I'm the problem.

Please remember that I do love you, and that's really the 𝗄ey to any relationship. I hope this i𐑈 only temporary, and that we can come back soon, but I feel that it is entirely up to you. Remember where we wanted to go? I sent an image to remind you. Please try to unⅾerstand and I will contact you in a week. We'll take things bit by bit, but try to, at least, understand how significant this is for me.

With love, Karen

---Inline Image---
106t154iq20rig62yyuj91atnfl173vecbof29gfjyqcn98.png
2p:4a;4d;43

This picture looks really familiar. Why does this look so familiar? I have to think on it.

Could you look into this, please? I'll try to figure out where I've seen that, before, and I'll let you know when I do.

---

From: Jason Bernz <[email protected]>
Sent: Thursday, April 7, 2016 1:04 PM
To: Sam Stone <[email protected]>
Subject: Re: Karen is missing!

Sam,

Please reply to this and copy the email you got from her into it. It sounds really strange for Karen to do this to you, and I want to see if there's anything unusual in the email, okay?

Send it, ASAP.

‐ Jason

---

From: Sam Stone <[email protected]>
Sent: Thursday, April 7, 2016 1:01 PM
To: Jason Bernz <[email protected]>
Subject: Re: Karen is missing!

Jason,

I just got an email from her. I...can't believe this. She left!! What the hell am I going to do, man? She even sent me some random picture with it, for some reason. I'm dying here! We haven't had any issues. Everything's been going great!

Oh man...

---

From: Jason Bernz <[email protected]>
Sent: Thursday, April 7, 2016 12:07 PM
To: Sam Stone <[email protected]>
Subject: Re: Karen is missing!

Whoa. Slow down, Sam. There's a reason that the police hold off on these kind of things. No, I haven't seen Karen. She didn't come in to work, this morning, either, but neither did Kyle, Jim, or the rest of my team, so he may have them off doing something that I wasn't told about, yet. Try to calm down, and let me know if you hear from her, soon. I'll keep an eye on my email, in case you hear anything.

Don't worry about the personal matters issue. I'll deal with that. She is my partner, remember.

Good luck, ‐ Jason

---

From: Sam Stone <[email protected]>
Sent: Thursday, April 7, 2016 10:23 AM
To: Jason Bernz <[email protected]>
Subject: Karen is missing!

Buddy. I need some help. I know that you aren't supposed to your use privileged position for personal matters, but I don't know where else to turn!

When I got home from work, yesterday, Karen and the kids were gone. I waited around for a few hours, and I called her cell phone, but I couldn't get an answer. Finally, I got tired, while waiting, and passed out.

This morning, I woke up on the couch and checked the whole house again. They're still gone!! I called the police, but she hasn't been gone long enough for them to look into it. I'm going nuts here, man! Please, you've got to help me. Please let me know if her, and the kids, are up there at you guys' work.

‐ Sam

Answer 1

Ok, an excellent puzzle like this deserves a complete answer, so I'm going to bring everything together and fill in the missing blanks...

---

First, we have to determine if there's actually a reason to look for Karen and the kids, so:

WorldSEnder noticed that in the text there are multiple unicode characters used as substitute for normal letters. If you take each of the words that contains a unicode character you can find:

"Helps us figure out the clue key is understand"

The next thing to note is that the text below the photo, 2p:4a;4d;43, points us to:

the 2nd paragraph of text, and within it words 74, 77 and 67, giving us: "least significant bit"

From here, we can follow 2012campion's lead and take the photo and:

extract the least significant bits from the RGB components of each pixel. Then we convert each 8 bits into ascii characters (taking the least significant bit first), to produce the text:

Mnp, M uawn'g oynyi pgn. Wr'yy ohie cbdadjchh! Jgfebqy jdw nsbtvqa nw lfex wuhh gki baws nqx V jsk laeeh uag hiszgrg of ryk. Lael juih qv s vozsoghv kg prvwy lry rf xmnlf, fr cfm pohoxa'w pfgd fbu gr, eyk yht qlmguetlxd ob nuh ozvl fbu u zrqvfm. I'z oynymey roh wbvv qvklath mb bsl utn yhn Wdwff dnbz quhvv lh fvqx hv. Xywr'rr nyrsmey ns nw 3746 Fnqhff Lt - gky boh rttnqrhrg lflxl ahue pezf ltehyg. Zi'iw bn frgr nmev hf hqxrukignnq eoanii, tnt gkyeh'w ffey gklrh sw laez. Wbrb eiw trzhx, fr qrcx shuy gkek zx cbpyf uirvr. I yrix isiotrq wi fhizfz ybx utdme. Dhvr bih, Neiwg P.F. L bvg xyw gazh is wlv hxrfrh jks bawnnsjrg yj ag tuh ielkzftl zhmfdkv, ag cnvy gkmj yxtf iihqh. Jltrg zcgk 'M' rfw itqieh 1 xyjhutk 7

Note, that the "original" image is not needed in the solution except that diffing the two images (as many of the other posts here do) guides us to the number of bytes we need to examine for the text above.

Now, as WorldSEnder notes, the original email has:

Several unicode characters replacing their standard ascii representations, extracting these spells out: "Helps us figure out the clue key is understand"

This gives us the key for the Vigenère ciphered text above, producing:

Sam, I didn't leave you. We've been kidnapped! Someone was waiting at home when the kids and I got there and dragged us out. They gave me a computer to write you an email, so you wouldn't look for me, but got distracted by the kids for a moment. I'm leaving you this message so you can let Jason know where to find us. They're keeping us at 3746 Landon St - the old abandoned hotel near main street. We're in some kind of underground bunker, but there's only three of them. They are armed, so make sure that he comes ready. I look forward to seeing you again. Love you, Karen P.S. I hid the name of the person who kidnapped us in the original message, in case this gets found. Start with 'I' and ignore 1 through 7

Taking this message, and the "filename" mentioned in the email (106t154iq20rig62yyuj91atnfl173vecbof29gfjyqcn98), we can work out who has taken Karen.

If we look at the original email, and start from "I" (i.e the first paragraph, ignoring "Dear Sam"), ignore the first seven strings included in the filename and just take characters: 106, 154, 20, 62, 91, 173, 29 and 98, we spell out: Itiskyle. So the kidnapper is Kyle!

Wait... I recognise that name...

Looking back at the original email trail, we see Jason mention that "[Karen] didn't come in to work, this morning, either, but neither did Kyle, Jim, or the rest of my team". Looks like Jason's team has gone rogue and, led by Kyle, has taken Karen hostage.

#BringKarenHome

Answer 2

The two images differ by at most 1 bit per color per pixel, suggesting that data was encoded in the least significant bit of the image.

Now "obviously" the only reason to provide the encoded image and the original cover image was that the difference between the two was important. This assumption was so basic that I never questioned it.

However, I recently found some clues that the puzzle author posted in their chat room:

Yeah - the initial image is purely a red herring (I can give you that, since I added it in the update, several days ago)
initial being the one that he "found"

Well I asked the person if they could possibly be looking at too much information (I already stated that they WERE in a clue, the other day), but they are adamant that they are right.

This seems to mean that the later addition to the puzzle:

[...] we spent several hours trying to figure out if the image that he sent means anything and, quite honestly, we came up blank. I'm not sure if it will really provide us any insight [...]

Doesn't mean:

The images haven't been solved yet

(obviously true), or

The images don't contain any useful information

(obviously false), but actually means:

The cover image can be ignored in decoding the encoded image

---

Now all of my previous analyses still apply; we know the encoded images contain 7-bit printable ASCII, LSB first. The fact that the ciphertext appeared to be xor'd with a key was due to the fact that I had inadvertently xord it with an effectively random stream by subtracting the cover image from the encoded image.

The original encoded image contains printable ASCII with no extra encoding:

Sam, I didn't leave you. We've been kidnapped! Someone was waiting at home when the kids and I got there and dragged us out. They gave me a computer to write you an email, so you wouldn't look for me, but got distracted by the kids for a moment. I'm leaving you this message so you can let Jason know where to find us.
They're keeping us at 3746 Landon St - the old abandoned hotel near main street. We're in some kind of underground bunker, but there's only three of them. They are armed, so make sure that he comes ready. I look forward to seeing you again.
Love you, Karen P.S. I hid the name of the person who kidnapped us in the original message, in case this gets found. Start with 'I' and ignore 1 through 7

The updated encoded image contains the same message (but with the Windows-style newlines removed) enciphered by Vigenère cipher with the key:

UNDERSTAND

Answer 3

Partial answer, since I don't have time, but still want to contribute.

1. (Solved) In the text there are multiple unicode characters used as substitue for normal letters. If I caught all of them and you spell out the words they are in you get

"Helps us figure out the clue key is understand" They are in severe danger, I think they got kidnapped.

2. (Unsolved) The name of the image is suspicious, but I haven't gotten very far, but it can be arranged like this:

1 K
56 DS
26 UDR
27 LKFD
71 MFDJC
78 URTNDF
150 ADAWJOL
148
Noteworthy is that it forms sort a pyramid.

Also 2P:4A;4D;43 leads to

2P: JMC which I think is a hint that we have a 3-letter Vignère cipher for the above text (after a bit of work)

3. (Partly solved) A quick comparison of the images reveals that they use different color encodings, so I don't think that there is anything hidden in the binary data. A image diff (substracting the image from one another) reveals subtle differences of the images, which is worth further investigation:

The image originates from the Hotel Grand Hyatt Goa this home page which may as well be the holiday target.

Answer 4

This string is probably too long to put into a comment (or at least obnoxious), so I'll put it here. I've analyzed the red/transparent image posted by @WorldSEnder and come up with this string...

$a$ represents x number of red (solid) blocks in a row
$b$ represents x number of clear (space) blocks in a row

2a 3b 9a 1b 17a 1b 5a 1b 11a 1b 4a 1b 1a 1b 5a 1b 5a 1b 4a 1b 4a 1b 1a 1b 11a 1b 4a 4b 6a 1b 5a 1b 9a 1b 1a 1b 13a 1b 1a 1b 5a 1b 2a 1b 2a 1b 4a 1b 7a 1b 14a 1b 1a 1b 10a 1b 5a 1b 6a 1b 3a 1b 10a 1b 4a 1b 3a 1b 4a 1b 6a 1b 1a 1b 4a 1b 31a 1b 10a 1b 2a 1b 6a 2b 18a 1b 3a 1b 1a 1b 17a 2b 22a 1b 1a 1b 2a 1b 3a 1b 5a 2b 5a 1b 2a 1b 1a 1b 11a 1b 9a 1b 1a 1b 6a 1b 13a 1b 9a 1b 14a 1b 15a 1b 5a 1b 4a 1b 1a 1b 3a 1b 7a 1b 16a 1b 23a 1b 5a 1b 14a 1b 5a 1b 2a 1b 7a 1b 2a 2b 13a 1b 9a 1b 1a 1b 2a 1b 6a 2b 2a 1b 7a 1b 9a 1b 2a 2b 1a 1b 17a 1b 2a 1b 13a 1b 13a 1b 12a 2b 1a 1b 8a 1b 4a 1b 2a 1b 4a 1b 8a 1b 7a 1b 2a 1b 5a 1b 3a 1b 5a 1b 3a 1b 11a 1b 30a 1b 9a 1b 10a 2b 18a 2b 9a 1b 4a 1b 2a 1b 1a 1b 6a 1b 7a 1b 14a 1b 10a 1b 5a 2b 4a 1b 3a 1b 8a 1b 14a 1b 10a 1b 15a 2b 17a 1b 6a 1b 6a 1b 2a 1b 1a 1b 4a 2b 1a 1b 4a 1b 4a 1b 18a 2b 4a 1b 9a 1b 10a 1b 3a 1b 6a 1b 1a 1b 4a 1b 12a 1b 4a 1b 9a 1b 13a 1b 6a 1b 10a 1b 4a 2b 18a 1b 1a 1b 19a 1b 18a 1b 1a 1b 2a 1b 10a 1b 12a 1b 6a 1b 10a 1b 5a 2b 6a 2b 4a 1b 8a 1b 7a 1b 1a 1b 1a 1b 44a 1b 13a 1b 13a 1b 4a 2b 3a 1b 9a 1b 28a 1b 4a 1b 12a 1b 19a 1b 9a 1b 8a 1b 14a 1b 19a 1b 9a 1b 7a 2b 4a 1b 1a 1b 4a 1b 1a 1b 4a 1b 2a 1b 13a 1b 8a 1b 19a 1b 14a 1b 3a 2b 5a 1b 11a 1b 5a 1b 1a 1b 7a 1b 10a 1b 2a 1b 2a 1b 6a 1b 8a 1b 13a 1b 20a 1b 11a 1b 9a 2b 5a 1b 4a 1b 1a 2b 14a 2b 23a 1b 27a 1b 10a 1b 12a 2b 10a 1b 6a 1b

If anyone would like it in a different format, please comment below.

For the sake of logging it and also so that anyone else can reuse it, here is the code I used to count the squares. I used PHP because that's the project I already had up and I am most comfortable in. It should be easily reusable for other pixel-counting tasks with these commands.

    $img = imagecreatefrompng('https://i.sstatic.net/wiU2R.png');
$i = 0;
    $j = true;
for($y=0;$y<4;$y++){
        for($x=0;$x<584;$x++){
        if($x==155&&$y==3){
            break;
        }
        $rgb = imagecolorat($img, $x, $y);
        $colors = imagecolorsforindex($img, $rgb);

            if($j==true){
            if($colors['red']==241){
                $i++;
            }
            if($colors['red']==255){
                echo $i.'a ';
                $i=1;
                $j=false;
            }
        }elseif($j==false){
                if($colors['red']==255){
                $i++;
            }
            if($colors['red']==241){
                    echo $i.'b ';
                $i=1;
                    $j=true;
                }
            }
        }
    }

NOTE: Please don't mind the indentation. Leaving it correct in the editor introduces missing spaces at random in the post. *shrug*

Answer 5

I follow @WorldSEnder answer.

Decrypting the images shows that the difference gives 1-bit variations for many of the first pixels in the image. The binary code, converted to hex, gives, for red, green, blue, respectively:
04b9e44c580604042240881240125e6140c460004cd208780414141cc45014804e9c1408a404080ac41d00600c4440020448444410108c10808a8018188804cce44cc84240d8085480e2241880ac5026040c0ccc00164682c0401c040e5e14309cc01c86c404b4ec50842044c280500c501034ac00011c6e0c02d08080b8106e5c0c0c1808840c6c48429c40cc104a005c1c14b00c1404ac0608da001c0a00000402100cf0540c181e66ae1470c08d8610060400088ac4048000a482ec9a880684a56c4404128e400210c04a064006400e0cc6dc02800604041000d20c1800a212a3964c06ec5c041206f016040020
80806223300012008250202202e400144220860432306024c7240270323014202680978210200727204044207127340260101220a03023a48526f0427023144466920630f4326002c28200d0240030b62624006020e700e4072056e00026200450644274f0a4c4c602e53823124602a434132484023410a096170014e066d460a4a000200030108426442010500690009274a5a49020c2a6535426030207066283943000c40222a240e0c016602030a4008024b054f012b46422022210c26001023480202214503261b414b03680202281a484f03424740045f0c01740708680646000146060024362a40734e662e0
411c112310a588221004051003a20530069086129407810327060386113ba0218711250201230613030f06808284310103122c019a85348330909115038208111020890380180101018101bab4003120b3288885040787811522012d2b00038709130f318101a681818225233000849331202002000c18830a04b1109180221601812e1183010013302604183b00002220018730320291930106810112a6701c06110631902225039305138017102e8085933110b18101b080070ab121061302ea1f010082009b88050121839b830284268302000026a5161012020403a9a08690010028901f21160503910105a000

Now time to figure it out.

Answer 6

Just some thoughts/additions, because Karen is not going to find herself, and I can't fit this all in a comment.

Remember where we wanted to go?

The place in the picture is the Grand Hyatt Goa (WorldSender), and in the edit history, the asker seemed to place emphasis on the city:
She even sent me a picture of that place we were planning on going, next month - you know, in India?

Looking at the new file name we have: 106t154iq20rig62yyuj91atnfl173vecbof29gfjyqcn98.png

The latitude and longitude of Goa is 15.498605°N 73.829262°E. Notice that 15 (154) and 73 both appear in the file name. Perhaps the sequence 2p:4a;4d;43 is meant to lead us to clues in the file name which would reveal the coordinates. Or the ordering of the coordinates of the hotel will help make sense of the text. 106t154iq20rig62yyuj91atnfl173vecbof29gfjyqcn98.png

Notice that the pyramid structure that WorldSender noticed in the file name is still there with the new name:

106 t   
154 iq   
20- rig   
62- yyuj   
91- atnfl   
173 vecbof   
29- gfjyqcn   
98- .png

This has to be significant unless someone is just messing with us.

I'haven't looked at the XOR stuff yet, but some potential cipher keys are:

GOA, UNDERSTAND, KAREN, LOVE, BAMBOLIM