Steam Winter 2015

Steam Winter Sale 2015
Completed on 2016-01-04
AKA North Pole Noire
Type	[[List_of_Investigations#Official|Official]]
Creator	Valve
Discovered	2015-12-22
Completed	2016-01-04
Timeline	Timeline

Main Page > List of Investigations > Steam Winter 2015

The Steam Winter 2015 ARG, also known as the "Winter ARG" or "WARG", was an ARG based around Valve's Steam Winter Sale 2015. Along with the normal discounts, trading cards and badges, a noir-style mystery comic was released a page a day over the duration. People soon started to notice there was more to the promotion than met the eye.

Summary

More Than Meets the Eye

Discussions about the Steam 2015 Noir Sale ARG began with a single reddit post on the /r/Steam subreddit. Beginning with the basics, the poster pointed out that there were no special sale events like the previous years.

The main focus of the discussion was on the first North Pole Noir comic page that was released on the Steam store (with a new page planned to be released each day of the sale). Various speculations were made in the comment area as people began noticing things such as the similarity to the Hitman artwork and the barcode scanning as Agent 47’s barcode number on the front cover of the comic (see clues, Hitman Barcode). Another user was quick to point out some faded text he noticed at the bottom of the page which he believed was the word "NESSE" (see clues, Nesse). Suggestions were made that the community may have an Alternate Reality Game (ARG) on its hands. Valve had been known to dip into this territory on previous occasions.

After all this speculation, /u/imnotgoats decided to create his own subreddit for gathering anything related to the possible mystery afoot. A troll by the name of /u/ck__ was quick to share this screenshot which, after some people realized was a Vigenere Cipher. It was decoded to ‘You are a bunch of idiots’ by https://www.reddit.com/user/notmuchwbu /u/notmuchwbu]. /u/MilkGames created a Discord chat for real time investigation (see community, Discord).

Community members started combing for clues everywhere. Artwork was analyzed, URLs investigated, every last detail was scrutinized. It became apparent that they would probably have to wait until the next day to get more clues, but they noticed something strange. The comic pages were being released at different times depending on where you lived (see comic, pages). The fact that Australia, in particular, was one page ahead of everywhere else gave access to more information earlier. In an effort to find out if other countries had different releases already the Discord chat began looking at Steam using a VPN. They figured out that the comic pages were stored in directories encoded with Hexadecimal and devised a small bruteforce team.

Confirmed ARG

During the few days before Neon Scalar arrived, morale was quite low. New discoveries were being made, but there was nothing yet that pointed to any conclusive evidence of an ARG. On 25th December, the barcode previously found on the front cover of the comic was removed. This lent some credence to the idea that the contents of the barcode were in some way significant, a theory only amplified by the fact that references to a Red Herring Badge had appeared on a Valve translation server. The description of the badge - ARG? - was for many a confirmation that an ARG existed, but we still didn’t know the best way to proceed.

Everything above is generally referred to as "pre-neon", with the following events referred to as "post-neon".

Neon Scalar was a user who connected to the Discord server on the 29th December. Back then, the Discord server was a far closer community, with around 40 connected users rather than the 1,000 or so commonly seen today. It was surprising, then, when Neon said nothing at all for the many hours the account was connected to the chat window. This remained the case until they posted four messages before falling silent once more:

Neon Scalar: I'm late for class but I might have found something? There's a super shady looking "nothingtoseehere.js" in the hotline miami store page header. Looks like it's sending requests to a actions/clues page.
Neon Scalar: http://store.steampowered.com/app/274170/[2] view source.
ekim_gaf: Why in the hotline Miami page?*
Neon Scalar: Might be on others. It was just the first I clicked
Neon Scalar: Quick spot check shows it's probably on all of them.

Neon has been in the server ever since, but hasn't spoken once apart from these four messages. Whilst not officially proven, it is generally accepted that Neon Scalar was Valve pointing us at the right direction. Neon Scalar's discovery lead to rapid growth on both Discord and the subreddit you're reading this on today:

The Hitman Thread

With the discovery of the Javascript code SEARCH prompt on each game store page, which could be accessed by typing SEARCH and then pressing Enter, the community had its first method of proceeding with any clues derived from the cards and comic pages revealed from previous days.

The link between the Comic Book Cover and the Hitman series had been specifically discussed by numerous people (Unknown Persons>) over the previous days. The image of Gingerbread Jake (see character, Gingerbread Jake) on the comic book cover resembles the pose of the Hitman character depicted on the box art for numerous games in the series and the barcode at the bottom left of the cover is very similar to the Hitman character's barcode tattoo. But it was /u/DevinWatson who first used the SEARCH prompt on the Hitman: Codename 47 Store Page, utilizing the barcode as the passcode, which resulted in the prompt returning the text ic/4f21ca7.

This was the first clue validating /u/yuv912's idea that there is more to the Winter Sale than meets the eye. The comic book cover was then changed by Valve, two days after it was initially released and after /u/DevinWatson discovered the Hitman prompt, in which the bottom left corner of the page which included the barcode had been torn off, revealing the page beneath it. This action is commonly believed to be a congratulatory message from Valve that the community had figured out the first step.

As soon as this first step had been obtained, work began to decipher the text ic/4f21ca7. Originally this phrase was though to obtain a cryptographic message leading to the next clue, but it was /u/picapi_ who noticed that the Steam Store URL for the web comics store.steampowered.com/wintercomic ended with ic, and combined the phrase into the URL. This resulted in the user downloading an Audio File named 1fce82a72c633.wav from the Steam page. When the audio file is played a man can be heard saying:

“I was on the right track. I could feel it. Tomorrow I was going to search again”

At this stage no more information or clues have been deciphered from this audio file, but the Audio File is perceived as another message from the ARG’s creators that this game had only just started and that there would be more clues tomorrow, specifically in the Day 4 Comics or Cards, as the Audio File was uploaded on the third day of the Winter Sale.

The Red Herring Badge

With the completion of several steps of the Hitman Thread, users began to go back to other Comics and Cards to develop similar threads. While symbols have been discovered on several images distributed during the Winter Sale, as of now there has been only one completed thread, which results in a user receiving the Red Herring Badge. Further speculation regarding the Red Herring thread even suggests that this thread is itself actually a Red Herring, distracting us from more complex unsolved clues.

Using various methods including manipulating images in image editors to reveal hidden details, analyzing audio spectrums, and pure dumb luck, the community was able to combine clues from the Day 7 Trading Card as well as the “Blitzen Incident”, to give a Steam Action URL that results in the awarding of the Red Herring Badge by typing in the final password ('1v7531') in the SEARCH prompt on the Ikaruga store page.

Brute Force

With the numerous demonstrations of the SEARCH prompt being a vital instrument in proceeding with the ARG game, numerous members were frustrated when trying to complete the carefully laid out riddle and began to determine a method to brute force the SEARCH prompt into revealing its secrets. These efforts led to the user Dinnerbone writing two scripts that users could run to try and find the next clue. The first, being a script to test a list of passwords on the Steam store page prompt and the second, a script trying a single password on the prompts of all Steam products. These scripts were adapted by a handful of users who used a google-doc to track their progress. User Brendan used this tool to run a password he got from the users processing the audio file, suddenly finding the link to the page that would get you the Red Herring Badge.

At this time, an announcement thanking the Bruteforce channel got enough attention to see a serious spike of users, which meant a lot more trolls, which would no longer allow us the use of public docs for tracking progress as it was susceptible to abuse. This called for a better system. One better defended against trolls and more easily distributed to people who wanted to help.

The demand for this system spawned two new systems. The first one, a web based automated system that used what Dinnerbone's script did, but made it easier for users who were new to coding and consoles to try out passwords by giving them a queue to enter suggestions in for him to automatically run. This was great for the new users, but the more technical users were dissatisfied to step down to testing a single password at a time. This inspired Discord user Opl to create a webclient much like Xpaw's but using it and a server to distribute passwords to bot-clients that the users would install on their machines, creating a botnet of sorts for bruteforcing the SEARCH prompt. After the discovery of the badge, 3 days went by, but nothing happened. Xpaw and Opl had tested over 7000 passwords, and the botnet was greatly improved with the help of users Zephy, Fillerino and Mousey, but nothing had been achieved. People started to put bruteforcing's effectiveness into question and support dropped when user Helloworld111, used the password database to bruteforce the winter comic url (a feature implemented in scripts by Users Xpaw, Nepeat and Windsdon) where a wave file was discovered earlier and proceeded to find a new wave file at http://store.steampowered.com/wintercomic/794E2CEA991F which is believed to be a missed step that should have led us to the "bullet hell" password and lead to Ikaruga

Lambda and Crowbar

Every new image connected to the Steam Winter Sale went under intense scrutiny. To this end, someone discovered discrepancies in the blacks used on the new Santa Baby Steam profile background. Post analysis, two distinct shapes were discovered in the top left of the image:

Whilst compression artefacts are common in JPEG images, it's highly unlikely that those artefacts would just so happen to be in the shape of the Half-Life 2 logo and a crowbar! However, when questioned by a /r/halflife user, Marc Laidlaw stated "that doesnt *[sic]* look like anything to me", as well as that "[the ARG] is not intended as a way to roll out a new game." The Lambda and Crowbar have since been ignored as a potential lead, although it should be noted that the image is rumoured to be related to the Red Herring Badge as it was part of the same clueset.

End of Winter Sale

On January 4th, 2016, the Steam Winter Sale 2015 ended and along with the pages relating to it being pulled, a lot of the ARG pages are no longer accessible too. This includes most, if not all, of the .wav sound files, the SEARCH prompt activated by typing SEARCH and hitting enter on any page, and the nothingtoseehere.js Javascript file. Previous clues originally found on the Steam Store by searching, such as that of Blitzen and Blitzen Incident began to show no results rather than what would be displayed previously. The JSON associated with the ARG was also pulled, preventing people from still using the Javascript via pasting it into a browser console window.

As a result of these actions by Valve, the Red Herring Badge became unobtainable for more users, though the ones that did obtain it have not lost it. It is presumed that this is the end of the ARG and that it was just one big "red herring".

Additional Resources

Timeline

Clues