Number stations on Twitter: Whatever happened to @WhiteCardSystem?steemCreated with Sketch.

in #crypto7 years ago

wcs banner.png

http://archive.is/https://twitter.com/whitecardsystem

White Card System is- or rather, was- a twitter account that posted mysterious encrypted data at a regular pace.

While active, the account posted a set of 10 tweets every hour. Each consisted of a hex-looking string (32 chars), a base 64-looking string (64 chars), a "#wcs", and a bracketed identifier that appears to be a timestamp. This identifier has a d, three digits, t, 10 digits, p, one digit- presumably day, time, part.
D is days since Sept 27 2015 (account creation). T is the Unix timestamp matching when the first tweet of the set was posted. Sets are usually four seconds past the minute, sometimes three. The in-tweet timestamp seems to be significantly off from Twitter's timestamp, like eight hours ahead.

As of late July the account's most recent tweets were from July 8. The last two tweets are p0 and p1 with no further parts. Further back, there's another gap starting on June 8 (with a missing p9) and picking up again on July 6.

The account was created September 27 2015. The sidebar says "tempori servire", apparently a latin phrase meaning "to accomodate oneself to circumstances". It's also the title of a tumblr blog that hasn't updated since August 2015, right before the twitter account was made. COINCIDENCE? Probably.
Avatar was a black chess piece backed by two golden keys. Reverse image search finds nothing of value except the twitter account itself.
The name appears to be a reference to the concept of "carte blanche".

The account's website URL was a link to a youtube video featuring a bad CGI Max Headroom and staticky audio. It was uploaded May 28 2016, most of a year after creation of the account. Channel is named "White Card System", same as the twitter, and this video is the only upload. Titled "mh-wcs" (obviously "max headroom white card system"), the description is "Oculos tuos et audies", latin for something like "close your eyes and listen". Tags are "Max Headroom", "Max", "Head", "Room", "237", "42" and "WCS".
The video has gone largely unnoticed; only 210 views at this time with three subscribers to the channel.

Sometime prior to July 22 2017, the account was set to "restricted" for "unusual activity"- I'd assume this was automatically done by Twitter for appearing like spam. Unfortunately this blocks archiving.
And now, as of September 10, the account is straight-up suspended. RIP.

The account had one post liked, whatever... this is:

wcs like.png

Both accounts involved seemed to be normal anime shitposters.

WCS also followed one account... oh.

wcs follow.png

Well, that's a little on the nose, innit?

Now while that may be the end of WCS, that's not the end of the rabbit hole!

On March 15 2016, reddit user and apparent r/conspiracy regular /u/nolifebill was visited in a near-dead public Skype group by an individual named "Quabo". Along with a link to a Youtube video, the user left a copy of a WCS tweet:

a74850b2adbc1a453cf39e08d27ac2f2 xbjUJnjL4zd0xLtYC95b1FsVtU3WeqyEAJOotai4hVEREdTDXv4dOMyGjTxXYxgm #wcs [d170t1458043683p4]

What followed from this over the course of over a year was a slow trickle of cryptic Youtube videos as well as a .onion webpage.
... Only problem is, Quabo's content is pretty darn lame. One redditor described it as "sophomoric"; it seems to be mostly generic meaningful-meaningless anarchy catchphrases and boilerplate codes.
As regards WCS, the tweet Quabo copied over was not apparently a complete message in and of itself but a random part four of some sequence of tweets- obviously WCS was never cracked but I kind of doubt any random part of a set would be a message all on its own.

But what we do get out of this is a few snippets of information that I couldn't be bothered to get myself while WCS was active.

For example, here's the account's very first tweet:

01bb5d6ce657798998ef87790ffec1e8 Srz8a8gCsTsnMqIuaAWFu7rQvLPvkidSXasU8vCQEv4QcCB4CX9xTpDF1T1b2TuO #wcs [d0t1443388082p0]

The twitter timestamp was apparently only four hours ahead of real time back then, but this may be due to the poster's own timezone. I don't know, I've confused myself now

Additionally we have whatever form of audio-to-image this was on the mh-wcs video:

wcs aud.png

Aside from the spooky scary skulls (again... a little on the nose, isn't it), we have the avatar image and an "advertisement" for the twitter account.

This whole bit started up about a month after the mh-wcs video was uploaded, which may indicate WCS was an ARG and the creator was just starting to advertise, but this is circumstantial and nothing else really supports it. Overall it looks like "Quabo" was just a gamejacking LARPer who didn't understand what he was copy-pasting.

So, can we crack it?

bitch fuck if i know

At the very least, the archives I posted up top contain four full 0-9 part sets of tweets to work with. Depending on how the June and July cutoffs I mentioned above work- if it's a message that got cut off midway or if it's a smaller complete data package- I do also have the last two tweets from July, albeit in screenshot form.

wcs.png

So what was this?

The one thing that gets me is that, while similar accounts like the ones covered in my Twitter number stations post remain active, WCS was suspended. There's nothing I was ever aware of that made this account any more of less suspicious than the others.

Between that and the name- "carte blanche" basically means "give free reign to"- I almost suspect WCS was being used as a public botnet "command and control" conduit, like so. But that still wouldn't explain the more "personable" elements of WCS, such as the plaintext timestamp/part number and the hidden "advertisement" for the Twitter account in the video's audio.

Coin Marketplace

STEEM 0.19
TRX 0.14
JST 0.029
BTC 65771.81
ETH 3174.77
USDT 1.00
SBD 2.61