Leave Me Here

Mr. Robot is probably the most technically accurate and surprisingly realistic portrayal of the hacking culture . The thing I like most about this TV show is how the show creators take great care in details and are even a step ahead in creating meta easter eggs . Last month while watching Silicon Valley , I happened to pause at a screen and found a URL to Coderag and thereafter realized the producers had gone onto creating other such sites as well . So I thought Mr Robot’s producers might have done something similar. In s02ep01 , we see Darlene using the Social Engineering Toolkit and entering an IP address 192.251.68.254

Press enter or click to view image in full size

So I type in the IP address in my browser expecting to be redirected to Mr Robot’s or Evil Corp’s site , instead I am greeted with this

Press enter or click to view image in full size

The page has a fsociety mask gif , a message reading “ YOUR PERSONAL FILES ARE ENCRYPTED . More Instructions Forthcoming” and a 24 hour countdown timer . I am obviously not going to wait for a day to see what happens after the countdown finishes so I open the page source and see this

Press enter or click to view image in full size

“YOU ARE NOT ALONE” written in ASCII art at the bottom of the page. I also tinker around with the javascript files to see what happens after the countdown finishes. A file named web_analytics.js looks interesting

The source itself acknowledges to be an Easter Egg . Of particular interest is the variable ‘q’ on line 9 which gets executed after the countdown finishes . The variable’s value looks garbage at first glance

but is actually a base64 encoded string . So I decode it and get

Nice , this quote fits in perfectly with the events of the episode . All this was way too cool , so in hope of finding some more clues I decided to watch the episode again and boy I did miss more details . In the first 4 minutes , we see Elliot at his terminal . The window in the background shows that he has logged into bkuw300ps345672-cs30.serverfarm.evil-corp-usa.com via SSH .

Press enter or click to view image in full size

So I open it up in my browser and it IS actually Evil Corp’s website

Press enter or click to view image in full size

I tried looking at the page source but couldn’t find anything interesting here .

Maybe there’s more interesting stuff out there , so I continue watching the episode . There’s this scene where Elliot is writing in his diary , and we catch a glimpse of a drawing here

Press enter or click to view image in full size

Definitely looks like a QR code but I was unable to scan it . I thought it may be because of the image quality , so I scanned a reconstructed QR code and voila , it linked to Confictura Industries .

Press enter or click to view image in full size

It’s a silly page which looks like it was made in the 90’s . Not recalling anything named ‘Confictura Industries’ in Mr. Robot universe , I googled the term which led me to a few interesting threads on reddit . Apparently I wasn’t the only one to scan the QR code . Things of interest on this site are :

• It has a few broken image links like /img/pic02.jpg . I tried changing img to images , the file extension , image number but couldn’t find anything here . Still looks fishy to me .
• There’s an email ID listed here : [email protected]
• A counter at the end of the page which look like a page visit counter but isn’t

The mystery with this site isn’t solved yet , maybe we’ll get more insight into this after a few episodes .

I later stumbled onto this blog post which also looks into the easter eggs and found that a treasure trove of Mr Robot related sites that can be found in the SAN field in the SSL certificate

DNS Name: www.racksure.com
DNS Name: racksure.com
DNS Name: *.serverfarm.evil-corp-usa.com
DNS Name: www.e-corp-usa.com
DNS Name: iammrrobot.com
DNS Name: www.conficturaindustries.com
DNS Name: www.iammrrobot.com
DNS Name: *.seeso.com
DNS Name: *.evil-corp-usa.com
DNS Name: e-corp-usa.com
DNS Name: *.bxjyb2jvda.net
DNS Name: whoismrrobot.com
DNS Name: seeso.com
DNS Name: fsoc.sh
DNS Name: www.fsoc.sh
DNS Name: conficturaindustries.com
DNS Name: whereismrrobot.com
DNS Name: www.whoismrrobot.com
DNS Name: www.whereismrrobot.com
DNS Name: evil-corp-usa.com
DNS Name: www.seeso.com

1. www.e-corp-usa.com is just like the Evil Corp’s page with a few striking differences .

Press enter or click to view image in full size

Press enter or click to view image in full size

2. https://www.whoismrrobot.com/ leads us to this incredible puzzle page

Press enter or click to view image in full size

A quick Google search reveals that it was an elaborate treasure hunt which ended with some people winning fsociety hoodies !

3. http://fsoc.sh/

Press enter or click to view image in full size

This is where it get interesting . We see an eye surrounded with characters (hex) . The eye points out to different characters and a blinking cursor which looks random . Delving in the Javascript file which controls the eye and cursor movements

Press enter or click to view image in full size

is what controls the speed of the cursor clicking, this can be converted into ASCII,

It translates into Morse code to

Which in English means

This worked in the password field and I was redirected to this page

Press enter or click to view image in full size

Arrived a little late here . I am sure there will be many more such surprises in the forthcoming episodes . Until then, I am off to watching Season 1 again in hopes of finding some more easter eggs :-)