![quest-pt-2-STEEMIT-MASTER-TITLE-PIC2.jpg](https://cdn.steemitimages.com/DQmSPKoLyQCFEfvbiCrmrLo4kw9DHkfsCXf9cCFFiycooU1/quest-pt-2-STEEMIT-MASTER-TITLE-PIC2.jpg) Solutions to the first 5 clues can be found [here](https://steemit.com/wikileaks/@fortified/wikileaks-or-quest-of-random-clues-solved). # CLUE 6 ![6-wikitweet.jpg](https://cdn.steemitimages.com/DQmUnrwxhP3JyV9pJbqBFQVkXHCg6dqEeVxN8eAjP2qsLzp/6-wikitweet.jpg) [Source](https://twitter.com/wikileaks/status/1049370714594312197) ##### 6. Start here: "Supporting technical consultations at the Consulate." - There are **3 parts** to Clue 6. - **PART 1:** The text in the tweet is taken from a previously released Vault7 CIA document revealing how the **Engineering Development Group** (EDG) used/uses the **US Consulate in Frankfurt, Germany**, as a cover for their **hacking operations**. ![6-c.jpg](https://cdn.steemitimages.com/DQmZiAJZWCyAMgAAjvmoZcZbZqCb9Pq9i9Jug9Zi7ufopck/6-c.jpg) [Source](https://wikileaks.org/ciav7p1/cms/page_26607630.html) - The **coordinates** of the US Consulate in Frankfurt are: ![6-part5-us-con-frankf.jpg](https://cdn.steemitimages.com/DQmXh2TnEih7xq2wRgiFuZkQefF1XcRqn5keWzmuy6u5qAg/6-part5-us-con-frankf.jpg) [Source](https://www.google.com/maps/place/50%C2%B008'26.3%22N+8%C2%B041'38.7%22E/@50.1395747,8.693976,720m/data=!3m1!1e3!4m5!3m4!1s0x0:0x0!8m2!3d50.140644!4d8.694094) ##### Consulate Coordinates: 50°08'26.3"N 8°41'38.7"E - **PART 2:** There were 2 images attached to the tweet. *Image 1* ![DpAb_zMW4AE79x2.jpg](https://cdn.steemitimages.com/DQme8RMojj1pWEKuNFe2yVuKNY5FPH6c18gGZQc26oKmqbZ/DpAb_zMW4AE79x2.jpg) - Assuming the Hour Hand is Black, the Minute hand is Yellow, Second hand is Red the clocks would read (Hours | Minutes | Seconds): ##### LEFT CLOCK: 12:01:17 ##### RIGHT CLOCK: 12:02:42 (Convert 12 to 00 for 24 hr clock.) *Image 2* ![DpAcLhhX4AEQ3xB.jpg](https://cdn.steemitimages.com/DQmWXeQgk5LbJwvY3EDhsCgt1QnV1GmvK9qk67Npd7pCCQX/DpAcLhhX4AEQ3xB.jpg) - ***Image 2*** was taken from the [**HIVE Engineering Development Guide**](https://wikileaks.org/vault7/document/hive-DevelopersGuide/hive-DevelopersGuide.pdf), another **Vault7** document. ![6-hive.-dev-guidejpg.jpg](https://cdn.steemitimages.com/DQmZd7rGe2UWofjcSZLX7u9i4Tw7aM4Y6q7H7qXauCRJrcA/6-hive.-dev-guidejpg.jpg) - Here is a little about what **HIVE** is. ![6-hive-press.jpg](https://cdn.steemitimages.com/DQmYeRMCUL8yBcX8NFzqFeiMvZCbo225EQooh8J6HbvUXLa/6-hive-press.jpg) - **PART 3:** Wikileaks provides **first hint**. ![6-part3-wiki-tweet.jpg](https://cdn.steemitimages.com/DQmWsDJhzg4B3AtdGhoZz6ZYwGNYbqnsrGEbScHwr6vnWc9/6-part3-wiki-tweet.jpg) [Source](https://twitter.com/wikileaks/status/1049370714594312197) - The highlighted portion of text was taken from the same HIVE Engineering Development Guide as above. The text reads: ##### (the system clock gets set back from the time of original execution) ##### (the system clock gets set forward by more than the delete delay) - **PART 4:** Wikileaks provides a second hint. It's a picture of a buoy in a place called **Null Island**. ![6-soul-buoy.jpg](https://cdn.steemitimages.com/DQmUn4WjwqV8zNVatMYicJQC1XXrT8LV8X8hLqhS8raXH3h/6-soul-buoy.jpg) [Source](https://twitter.com/wikileaks/status/1049421987683192837) > [Null Island](https://en.m.wikipedia.org/wiki/Null_Island) is a name for the area around the point where the prime meridian and the equator cross; in the WGS84 datum, **this is at zero degrees latitude and longitude [0°N 0°E.]** (the location is in the Gulf of Guinea off the west African coast). - Now we have all the parts of the clue we can put them together. **Part 1** Consulate Coordinates: 50°08'26.3"N, 8°41'38.7"E **Part 2** LEFT CLOCK: 00.01.17 RIGHT CLOCK: 00.02.42 **Part 3** (the system clock gets **set back** from the time of original execution) (the system clock gets **set forward** by more than the delete delay) **Part 4** Null Island is at: 0°N 0°E. - First use the Consulate coordinates (**50°08'26.3"N, 8°41'38.7"E**) as a starting point (like **Null Island**). - Then subtract (**set back**) the LEFT CLOCK (**00.01.17**) from the first part of the Consulate coordinates (**50°08'26.3"N**). - Finally, add (**set forward**) the RIGHT CLOCK (**00.02.42**) from the second part of the Consulate coordinates (**8°41'38.7"E**). 50°08'26.3"N - 00.01.17(Left Clock) = **50°07'09.3"N** 8°41'38.7"E + 00.02.42 (Right Clock) = **8°44'20.7"E** - Search Google Maps for **50°07'09.3"N, 8°44'20.7"E** ![6-interxion-datacenter.jpg](https://cdn.steemitimages.com/DQmcdBfohEHgsCVmZreriZBDPtFRFCTPmF7x2HCFf4LFJ5h/6-interxion-datacenter.jpg) [Source](https://www.google.com/maps/place/50%C2%B007'09.3%22N+8%C2%B044'20.7%22E/@50.1191502,8.736208,720m/data=!3m1!1e3!4m5!3m4!1s0x0:0x0!8m2!3d50.11925!4d8.7390833) - 200 meters to the right of where the coordinates took up is a data center owned by a company called **Interxion**. They claim to be the cloud hub of Europe. ![6-interxion-website.jpg](https://cdn.steemitimages.com/DQmZKDfYKmb4NW8MWbR5E1WpoTgzxorgqe5nP83LaPp5Ug1/6-interxion-website.jpg) [source](https://web.archive.org/web/20181011012501/https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=https%3A%2F%2Fwww.interxion.com%2Fde%2FUnsere-Standorte%2Ffrankfurt-campus%2F&edit-text=&act=url) - Wikileaks confirm this in a later [Tweet](https://twitter.com/wikileaks/status/1049476261788172288). # CLUE 7 ![7-wiki-tweets.jpg](https://cdn.steemitimages.com/DQmNsNzAoP132Ri6j6Abe4VoHwQzNoHEQwT1AyKHZkb9dia/7-wiki-tweets.jpg) [Source](https://twitter.com/wikileaks/status/1049483264480698380) ### PART 1 - **PART 1:** First take the HEX color from each row of X and O. ![7-Spreadsheet.jpg](https://cdn.steemitimages.com/DQmTJgySVqi9vxySa8qkssf6daq2rS6utA6PLPxJhAyubLm/7-Spreadsheet.jpg) #### 687474703a2f2f6a7768696575776a36333263696274612e6f6e696f6e2f - Turning the hex colors into one string and convert it using a hex to utf8 [tool](https://onlinehextools.com/convert-hex-to-utf8) gives you a .onion address. ![7-hex-to-utf.jpg](https://cdn.steemitimages.com/DQmeScmRANeW6vUAcZTp9nNWoqRhLMGEKqv48TJkwcyGHE3/7-hex-to-utf.jpg) ##### http://jwhieuwj632cibta.onion - The .onion webpage contained a large amount of base64 text whiich you can find a copy of in this [Paste Bin](https://pastebin.com/H7duaj1Z). - **PART 2:** Convert the table into binary by swapping O for 0 and X for 1 (**O=0 and X=1**). ![7-Spreadsheet-10.jpg](https://cdn.steemitimages.com/DQmWqBPLv97MdtSW7GtjEyQxiPwbqU7WGpwQcv8MTHzCgBc/7-Spreadsheet-10.jpg) ##### 01110111011010000111000101110010011011010011011001101000011001110110111101110100011110010011011001100110011101110110010000110011001011100110111101101110011010010110111101101110 - Converting the binary to text using this [tool](https://onlinebinarytools.com/convert-binary-to-text) returns a second onion address. ![7-bin-to-text.jpg](https://cdn.steemitimages.com/DQmXZ7giWZZ4DwLXiZvFAz7m7V7mNJXc4qRGyQJBe2XVTqz/7-bin-to-text.jpg) ##### http://whqrm6hgoty6fwd3.onion/ - The second onion address contains a picture of a plane. ![whqrm6hgoty6fwd3.onion.jpg](https://cdn.steemitimages.com/DQmaihSCaxGd3eC2cK8s9fj2bmNMfmZVtTRZHZvwmxtHQp3/whqrm6hgoty6fwd3.onion.jpg) https://www.flickr.com/photos/45404673@N05/25278974689/in/photostream/ - The tail number is N379P. A quick search reveals this plane is dubbed "Guantánamo Bay Express" and was involved in covertly moving detainees to various blacksites around the world. > [N379P](https://en.wikipedia.org/wiki/Rendition_aircraft#N379P) was a tail number assigned to a Gulfstream V executive jet. The aircraft has been reported in several press sources as a U.S. Department of Defense prisoner transport, also known as "Guantánamo Bay Express". The craft has been reported to being used to transport suspected terrorists to undisclosed locations for either extraordinary rendition or into the CIA prison system. It has been the subject of criminal complaints and parliamentary inquiries. - Read more about it [here](http://www.washingtonpost.com/wp-dyn/articles/A27826-2004Dec26.html?noredirect=on) and [here](https://web.archive.org/web/20060416092850/http://web.amnesty.org/library/index/ENGAMR510512006). - Wikileaks then [tweeted](https://twitter.com/wikileaks/status/1049720500732215297) out 3 hints in a row. Each one pointing to the **XOR** function. ![7-3-hints.jpg](https://cdn.steemitimages.com/DQmNSBLoHPavggNsHcDt7pVG4QV2kZvFzMsbc5dENKYmd9B/7-3-hints.jpg) - By XORing the image of the rendition plane from part 2 and the base64 string from part one produces an mp3 file. The mp3 file contained morse code that spelt out **WQYT651**. (I've yet to recreate this step myself). - Searching for **WQYT651** takes you to a license agreement on the FCC website for a company called **VADATA INC**. ![7-licence.jpg](https://cdn.steemitimages.com/DQmXCAEbXaND3gn5FQbWxEHQ71Wxk9FoghiyeTkzdFd2uCm/7-licence.jpg) [Source](https://archive.is/sjwqZ) - The FCC license page contains 2 addresses. ##### ADDRESS 1: 12900 WORLDGATE DR., FAIRFAX, HERNDON, VA ##### ADDRESS 2: VADATA, INC., 22651 DULLES SUMMIT CT., STERLING, VA 20166, ATTN WILLIAM LASSITER - **ADDRESS 1** is for a **Amazon** data center, **ADDRESS 2** is a data center ran by **Vadata inc**. Here is a little bit about [**Vadata Inc**](https://www.bizjournals.com/columbus/blog/2014/08/amazon-eyes-1-1-billion-investment-in-central-ohio.html) getting a huge tax break. ![7-data center.jpg](https://cdn.steemitimages.com/DQmVPont9bw5AvP6pnB9KUWQ4DXjMefRrrJ73B5aQ1vSPdG/7-data%20center.jpg) [Source](https://www.google.com/maps/place/Amazon+Web+Services/@38.9548701,-77.3978855,873m/data=!3m1!1e3!4m13!1m7!3m6!1s0x89b647edefbe333d:0x923d719436efbd74!2s12900+Worldgate+Dr,+Herndon,+VA+20170!3b1!8m2!3d38.9558004!4d-77.3964076!3m4!1s0x89b647edef49a797:0xafacf58f79a0ec48!8m2!3d38.9557916!4d-77.3963883) ![7-data-center-2.jpg](https://cdn.steemitimages.com/DQmXoP75fsLp4Paap4qHoUvtLMEVb4ht3unS73WQgFLeAia/7-data-center-2.jpg) [Source](https://www.google.com/maps/place/22651+Dulles+Summit+Ct,+Sterling,+VA+20166/@38.9890768,-77.4500549,873m/data=!3m1!1e3!4m5!3m4!1s0x89b638bfb5b0c64b:0xfc91a8baca1b7320!8m2!3d38.9906154!4d-77.4485046) # CLUE 8 ![6-wiki-tweet.jpg](https://cdn.steemitimages.com/DQmbaVXfykeGVQejpfUtimk4bFm3FZA4v9cNbX15ApbvgKc/6-wiki-tweet.jpg) [Source](https://twitter.com/wikileaks/status/1049775007667245056) - Increasing the exposure of the image in Photoshop reveals a bird in the background. ![DpGMi6eX4AIZQOh.png](https://cdn.steemitimages.com/DQmYodn4xXg9RUgqt4mU671qPdEi5gY6QFJmH8W9wQP81ES/DpGMi6eX4AIZQOh.png) - The bird is a Gold Crest, the national bird of Luxembourg. ![8 goldcrest.jpg](https://cdn.steemitimages.com/DQmWrU1dxR36PwRGvpRDVwkqxxPRDjrim3Hzi2WvaFQXSgv/8%20goldcrest.jpg) - Searching **Gold Crest and Amazon** returns a story about an Amazon tax scam in Luxemburg. ### Revealed: how Project Goldcrest helped Amazon avoid huge sums in tax | [Guardian](https://www.theguardian.com/technology/2016/feb/18/revealed-project-goldcrest-amazon-avoid-huge-sums-tax) > Documents released during the internet giant’s court battle with the US Internal Revenue Service over a possible $1.5bn in unpaid taxes detail a complex restructuring and a deal with **Luxembourg** that delivered Amazon multimillion-dollar savings. - Wikileaks [tweeted]() a hint. ![8-hint1.jpg](https://cdn.steemitimages.com/DQmP7M5MsKVYXx8XuXG7YuGBmfQPRbJASMDnCPy2ptTvfEy/8-hint1.jpg) ##### ... = 0 - Line 10 (...) has 0 syllables. Hints towards counting the syllables in the other lines. ##### Profits were not (4 ) ##### subject to corporate taxation (9) ##### a result of (4) ##### part of the reorganization (9) ##### IP that was transferred to (7) ##### an empty shell (4) ##### reduced (2) ##### intangible as well (6) ##### Investigation showed (6) ##### ... (0) ##### this is illegal (5) ##### In a comparable situation (10) ##### the holding company is not (8) ##### to avoid taxation (6) - Put the numbers into GPS format. ##### 49.497426, 6.051086 ![7-data-center.jpg](https://cdn.steemitimages.com/DQmd5TKzYijNFgkKt3RqCC31gLEdWyRPKPbYTXACGsZw2wX/7-data-center.jpg) [Source](https://www.google.com/maps/place/49%C2%B029'50.7%22N+6%C2%B003'03.9%22E/@49.4958058,6.0503618,729m/data=!3m1!1e3!4m5!3m4!1s0x0:0x0!8m2!3d49.497426!4d6.051086) - Wikileaks later confirmed the location in this [tweet](https://twitter.com/wikileaks/status/1050062915544469504) # CLUE 9 ![9-wiki-tweet.jpg](https://cdn.steemitimages.com/DQmZzdgYjmMfokPf3h89pahEetxynqCpfPT5FUPvfM7TEHE/9-wiki-tweet.jpg) ##### rl2w2tgacotbld6j.onion/ - The onion address take you to a page with a single picture of some clouds. ![rl2w2tgacotbld6j.onion.png](https://cdn.steemitimages.com/DQmNZ4i9XJmJMaWd5rQCWUD23ojvVrUnCFPtx4neLPvH4Kh/rl2w2tgacotbld6j.onion.png) - Opening the image up in a text editor revels some plain text: ![9-cloud-image-ascii.jpg](https://cdn.steemitimages.com/DQmWf4jhbKcZbuNAFWqUKQEPfKnmYVKj5YbuWCChequvkmB/9-cloud-image-ascii.jpg) ##### host vital digital infrastructure - A quick search for **'host vital digital infrastructure'** returns this article about a power outage at a data center in west Sydney, Australia. ### Banks, websites down as wild weather knocks out Amazon Web Services | [Financial Review](https://archive.is/uKJUZ) - 06/06/2016 > A ME Bank spokeswoman later said the outage was caused by a service crash at First Data, a third-party payment provider. First Data said it crashed due to a power outage at the **Western Sydney Data Centre, which is owned by Fujitsu**. - A search for **Fujitsu Western Sydney Data Centre** on Google maps reveals another data center: ![9-data-center.jpg](https://cdn.steemitimages.com/DQmd3ZEYqiFnWnZP3sYSuTb5hPFPpdt9CnYirxCNe21S15s/9-data-center.jpg) - Wikileaks have also confirmed the location of this data center in a recent [tweet](https://twitter.com/wikileaks/status/1050191989789077504). ![10-hint-2.jpg](https://cdn.steemitimages.com/DQmUYRrcjtw4LsFDH94JMWKZAAvDvfn4ZWd2VoTwrTWJ2E4/10-hint-2.jpg) [Source](https://twitter.com/wikileaks/status/1050217741788045312) ##### "λέξον δή μοι, τί παθοῦσαι, εἴπερ νεφέλαι γ᾽ εἰσὶν ἀληθῶς, θνηταῖς εἴξασι γυναιξίν; οὐ γὰρ ἐκεῖναί γ᾽ εἰσὶ τοιαῦται." - Translated: ##### "Tell me, if they're really clouds, what's the reason why they look so much like mortal women do? Sky-clouds don't resemble these clouds." http://www.thefamouspeople.com/profiles/images/aristophanes-1.jpg The verse is from Aristophanes' famous comedy, [**Clouds**](https://books.google.co.uk/books?id=8yAKBgAAQBAJ&pg=PA36&lpg=PA36&dq=Tell+me,+if+theyre+really+clouds,+whats+the+reason+why+they+look+so+much+like+mortal+women+do?+Sky-clouds+dont+resemble+these+clouds.&source=bl&ots=kIV47M-49U&sig=XefAG6_EmoL2LC9Vj6UWw88a4b8&hl=en&sa=X&ved=2ahUKEwjOgITywP3dAhWDmLQKHcZgB9cQ6AEwAHoECAsQAQ) which is noted for its critique of philosophy, society and education. # VAULT 8 ![Vault8.jpg](https://cdn.steemitimages.com/DQmf336e77a78ctXXR2QesPq2JkW54eQ7hkQBsvet99hNp7/Vault8.jpg) [Source](https://wikileaks.org/vault8/) Wikileaks references **HIVE** in this set of puzzles. **HIVE** was published on November 9th 2017. It was the first and only publication from their **Vault8** series. Wikileaks when dark after this leak. When Wikileaks published **Day Zero**, the first part of **Vault7**, they teased in a [tweet](https://twitter.com/wikileaks/status/839475557721116672) that that was only 1% of the total leak so far. Judging by the size of the Zero Day documents, and the other Vault 7 publications that followed it I estimate there's still over 50% of the cache still to be released. ![vault7-1percent.jpg](https://cdn.steemitimages.com/DQmVeNtyqsPe6sRyMzF1LKUh1s2KkSdMyEhpeXwUuj4rX8f/vault7-1percent.jpg) In Vault 7 we learned about the CIA hacking tools and the code behind them but we learnt very little about who they were used on, or for what reason. So I expect this up-coming leak will provide further details about who the CIA are hacking (**data centers and cloud servers**), and for what reason (**espionage and mass surveillance**). ### Everything is pointing to the continuation of Vault8. Puzzle breakthrough recognition goes to: https://twitter.com/AlmeidaWagner https://twitter.com/SerapChris https://twitter.com/zlatinb https://twitter.com/Nin_99 --------------------------------------------------------- ![HUD-7-Operator-FLAT-FORT_2.gif](https://steemitimages.com/DQmW6Qk4kE6UBip5rE5Ei4AqUxona5kUNEkSmbhZfr2akhe/HUD-7-Operator-FLAT-FORT_2.gif) ### FORTIFIED **[Steemit](https://steemit.com/@fortified) | [Gab](https://gab.ai/fortified) | [Twitter](https://twitter.com/XFortified)** # **THANK YOU FOR READING** ^{- If You Would Like To Help Me To Make More Great Original Content Please Consider Upvoting and Re-Steeming -} ‏