Transmedia Storytelling: Modern Science Fiction

P.S. My Team is Called the A-Team.

Approaches to test a “hackable website”

Testing how obvious it is that the user should attempt to hack the site: Testing how much of a push in the right direction a player needs to have in order to realize they’re supposed to try to ‘hack’ the website.

Without telling them what the website is, have the players visit the ‘hackable’ test sites in the order of what I believe to be the least obvious to the most obvious. This can be done by just asking the test players to explore the sites.

The order would be something like:

1. Extremely obscure: Seemingly normal autobiographical page of a ‘researcher’ at MIT (completely fictitious but high-fidelity). Have a hidden link be one of the links on the page with a username and password dialogue box appear when they click it. (The means of actually hacking the site can simply be looking at the source code where a plain text reference to the password appears. Since the test is for finding if the user will actually attempt to hack, the difficulty is less important.)

2. Obscure:  Seemingly normal autobiographical page of a ‘researcher’ at MIT (completely fictitious but high-fidelity). Have an “administration” link be one of the links on the page with a username and password dialogue box appear when they click it.

3. Moderate: Seemingly normal autobiographical page of a ‘researcher’ at MIT. The researcher writes on the page somewhere that somebody has been changing his page somehow and would be very grateful to find out how they’re doing it.

4. A bit obvious: The researcher explicitly mentions that there are secrets to the website that can be unlocked if the player is good enough to break through the dialogue box.

5. Extremely obvious: The researcher’s page loads as normal, but then changes to appear to be hacked. The ‘hacked’ page then says they’ve found an exploit and intend to discredit the researcher shortly. The researcher pleads for help on any part of the site that he still has control over.

Testing the difficulty of the hacks

Let the players know that the goal is to hack each site. Use a background timer that records how fast they solve each exploit.

Ideas for hacks:

·         Javascript password box. The password is somewhere in the source code.

·         HTML password box. The password is never set, however, so the password is then just blank. The user hits submit and they can continue.

·         HTML password box. Compares the input to a text file somewhere on the server. The user opens the text file and finds the password.

·         Include a “Forgot Your Password” link. This should have a hard-coded e-mail that it sends in. The player should download the source code, change the e-mail address, then visit their local file so that the e-mail is sent to their e-mail address.

·         Same as before, however check the referrer page so the same trick doesn’t work. Instead the player must use a javascript injection by changing the value of the form using javascript. (This can be done via the address bar or using the Firefox extension: Firebug

·         Javascript password dialogue box. The password is in an obscurely named text file on the server. The user then has to use code injection in order to find out the filename.

·         Same as before except with PHP.

·         Use a cookies exploit. (Change from unauthorized to authorized)

The Stata Center Scavenger Hunt Challenge

For this test, I would like to find out more about what kinds of hiding places are feasible to use for a visual scavenger hunt. This would be useful for a puzzle involving a visual search for items hidden in various hiding places. When developing a puzzle involving something like this, you always run the risk of completely underestimating or overestimating the difficultly of the tasks they give. In this case, I want a better idea of what how hard things are to find in open public places.

To run the test, I would like to take small papercraft robots and spread them across the 1st floor of Stata. The robots will be placed on walls, under desks, on pillars, behind artwork, etc. I will then send people one at a time to find and log all of the robots they find.

To learn the most, I would like to try to find a broad range of places to hide things and classify how hard I think each of the things are to find. Then I’ll try to come up with more absolute ways to classify each of the hiding spots like whether or not you have to leave a normal walking path to find it, how high it is, how far away it is from where a person might be, how dark the spot is, etc. I also might change things about the robot itself like putting LEDs on some of them.

Then I will send people out one at a time for a half hour and ask them to take a picture of each one when they find it so I can get a timestamp and verification of when they found each item as well as maybe approximately where they were when they found it.

Afterward, I should be able to get an idea for which ones were harder to find based on how long it took them to find it and which ones were found at all.

Potential Test

Here is a potential test that I wrote up:

<!— @page { margin: 0.79in } P { margin-bottom: 0.08in } —>

TEST game design

TRACK ONE

Puzzle one (Standard word puzzle, on paper or online, etc):

You are in a Cathedral

There are doors leading to caves 5, 3, and 9.

Cast your gaze upwards to the eye.

See how easy it is to count the spokes?

A number so beautiful and even,

Follow it outside,

Where the stone can speak back to you.

This should send the players to the stone benches outside of building 16, where the acoustics create an echo effect. Once there, there will be another clue, printed on paper, perhaps taped to a miniature lawn gnome.

41 20 63 6f 64 65 20 74 6f 20 65 6e 74 65 72 20 62 75 74 20 6e 6f 6e 65 20 74 6f 20 6c 65 61 76 65 0d 0a 79 6f 75 20 6b 6e 6f 77 20 79 6f 75 20 61 72 65 20 6e 6f 74 20 61 6c 6f 6e 65 0d 0a 74 68 65 20 70 72 69 6e 74 65 72 73 20 77 68 69 6e 65 20 61 6e 64 20 74 68 65 20 63 6c 69 63 6b 69 6e 67 20 6b 65 79 73 0d 0a 79 6f 75 72 20 47 4e 4f 4d 45 20 61 77 61 79 20 66 72 6f 6d 20 47 4e 4f 4d 45

It reads, in HEX,

“A code to enter but none to leave

you know you are not alone

the printers whine and the clicking keys

your GNOME away from GNOME”

A quick translation and google search should send students to the 5^th floor of the Student Center to the athena cluster. The first part of the object will be here, inside a small gnome within sight of the door. There will also be the next clue.

<!— @page { margin: 0.79in } P { margin-bottom: 0.08in } —>

F=G(m₁m₂/r²)

ONCE I DROPPED MY OFFSPRING ON A MAN’S HEAD

REST IN MY SHADOW,

FIND THE FRUIT OF YOUR EFFORTS

This should, if MIT students still remember how to use Google, lead them to the Isaac Newton apple tree in the President’s garden. There, they will find the final piece of the puzzle.

Track Two

First Puzzle:

This puzzle is given much like the first puzzle of track one. It is printed on either paper or online.

Once I was the only,

But still I am the first,

The SENIOR place to live in hell,

I’ll never be the worst

Come into my yard today,

So we can have some fun,

Try not to get so TIREd, man

Before your time is done.

This should direct players to the Senior House courtyard, particularly the tire swing, in which they will find another clue.

Beneath the BEL tower,

In a DECADE’s cove,

These treasure chests spit sheets of green,

But not coins of gold.

Halfway down 47.2 rods,

Across from the BUSH,

Put your card in the slot

And give it a push

This should lead players to the ATM machines in Lobby 10. There will be the second piece of the device, an apple, and a sheet that says this:

Ring a bell?

Maybe I could inspire some epiphany,

If I fell on your head,

When you were sitting in a GARDEN.

At least, that’s what happened when I did it to that NEWTON guy.

Why don’t you come visit me?

This should lead players to the President’s garden and the Isaac Newton tree.

The beneficial thing about this is that we could send both of the first puzzles to players, setting them on both tracks, or give a mix to the first players. We would need them to sign up for something, to be “let in on it”.

Or, if this is just a test, we could give the players a mix of the clues.

If we find that people aren’t following the clues in the right order (or can’t solve one),

we could make sure the proper clues are dropped somewhere along the way for them.

MIT Folklore/Hacks

Courtesy some fantastic alums.  Most of the stories and more are retold here: http://everything2.net/index.pl?node=hacking+stories&lastnode_id=124&searchy=search

Compiled by an old Senior House type person.

<!— @page { margin: 0.79in } P { margin-bottom: 0.08in } —>

List of MIT Folklore/Hacks

I’ve included some interesting hacks because they seem to be at least in the peripheral memory of a lot of people.

• If you rub the nose of the George Eastman plaque in Lobby 6 on your way to an exam, you’ll have good luck.

• The reason the skylight over Lobby 7 was covered for decades was because it was covered during WWII to prevent the Nazis from using it as a target in case they ever bombed the US. The cover was removed ~2001. (This is true)

• The Green Building was originally designed to sit at right angles to its current orientation, with the windows looking out over Cambridge. The plans were changed at the last minute when someone (variously cited as an administrator in Course 12, the architect, or the real estate office) determined that river view windows would be worth way more. Unfortunately, this was after the wind tunnel testing for the building, and the winds off of the Charles sweeping under the building caused the first floor entry doors to be unusable. (Reasons included in story variations include pressure differentials causing the doors to be unopenable or high winds causing the rotating doors to spin dangerously fast. The first is more likely.) The Great Sail was designed by Calder as a windbreak. This is why there is not only the Great Sail next to the Dot, but also the Little Sail in the Media Lab (formerly in front of Building 9, and its plaque was still there last time I looked) and the ItsyBitsy Sail in the wind tunnel building’s model display case.

• There was a hack in which The Great Sail had a giant smiley-face sphere hung inside of it. A smaller smiley sphere was hung off of the Little Sail by Building 9. And an itsy-bitsy sphere appeared on the itsy-bitsy sail model in the wind tunnel building.

• A long time ago, shortly after either Next or New House was built, the house manager was an extremely stingy fellow who insisted on only putting out enough toilet paper for that day in order to prevent students from stealing it for nefarious purposes. This produced a lot of griping, but then came the blizzard. The entire campus was snowed in for days; no physplant, and no new toilet paper. The students were, needless to say, furious; the manager refused to change his policy. During the next big blizzard, a student found a squirrel that had frozen to death in the cold; they took it to the manager’s office and shattered the icy corpse on his desk. Three days later, his office was about as unpleasant as the bathrooms had been in the last blizzard. The story is strangely silent about what happened next.

• Rumor has it that once upon a time, there were tunnels out of East Campus that connected to the Main Campus buildings.

• Long ago, Hal Abelson and Gary Sussman were partners who worked together on creating the 6.001 curriculum, which used Scheme to teach proud and clueless young’uns what programming really meant. In the late 90’s, however, Abelson became convinced that there was no longer any point in teaching functional programming, and that the way of the future was in Windows and Microsoft’s proprietary programming languages; not because they were better, but because no student would ever be using a non-Windows operating system after graduation, and therefore they might as well get that idea into their heads early. He pushed for Athena to be replaced with Windows for Workgroups, and for Scheme to be replaced with Microsoft J++. (Bet you’ve never heard of *that* one. There’s a reason.) Sussman, being a proud independent thinker, declared publicly that Abelson had sold his soul, and nailed “95 Theses Against Microsoft” to Abelson’s office door. (Thirty pages of paper. One four-inch steel nail.) Abelson saw the error of his ways, and although he still uses Windows, he no longer insists that Microsoft is the be-all-end-all of computing.

• Kresge is 1/8 a sphere.

• Philip Gale’s Suicide: For weeks, Gale had been asking classmates how to access the roof of MIT’s tallest structure, the Green Building. On the blackboard of the MIT classroom in the Green Building, he wrote out Isaac Newton’s equation for how an object accelerates as it falls, along with a sketch of a stick figure of someone tossing a chair. He signed the message, “Phil was here,” picked up a chair, hurled it and then himself through a window on the fifteenth floor of the Earth, Atmospheric & Planetary Sciences building, more commonly known as Building 54 or the Green Building. Friday, March 13, 1998

• Tomb of the unknown tool. The “Unknown tool” was rumored to have originally lived in Baker.

• In the 70’s, 90% of all LSD produced on the east coast could be traced back to Bexley.

• East Campus residents have repeatedly tried to officially change the name of The East Campus Memorial Houses to Fred.

• Several decades ago, the CIA tried to establish a secret field office in Technology Square, but was foiled by MIT students who hacked them so badly they left because their cover was so horrendously blown. The front for their office was “The Anderson Music Company”. They were in the same building as the Laboratory for Computer Science.

• After the cover over Lobby 7 was removed, a hack went up: The Wheel of Tuition. It looked like a wheel of fortune, except it was full of ways that students could pay for their ridiculously high tuition (work study, loans, etc).

• Before the end of the Cold War, Helmut Schmidt (Then chancellor of west Germany) gave the commencement speech at a certain graduation. A particular (forgotten) member of administration passed the word along to hackers to not try to hack the speech because it was impossible due to the vast amount of security, body guards, and Germans with big guns that would be around waiting to shoot anyone. Halfway through his speech, two banners, one saying “NOTHING’S” and one saying “IMPOSSIBLE” dropped down on either side of Mr. Schmidt, the hackers once and for all proving that they can’t be told what to do by the administration.

• At some point, Harvard tried instituting a new tradition for them: the Freshmen plate. They engraved a giant silver plate with something and hid it in Harvard yard the night before orientation, with the idea that the freshmen class would have to look for it before orientation could begin, and bond or whatever. Well, MIT hackers thought they could find it first, so that night, they did. They didn’t know what to do with it after they found it, so they dropped it off on the desk of then president Paul Gray with a note that said something like “Some people up at Harvard are going to be looking for this.” Paul Gray put on his academic robes and funny hat and got the deans to do the same. Then, carrying the plate on a sofa cushion, he and the deans arrived at Harvard about thirty minutes after the search had started in a giant MIT-police escorted motorcade and presented the plate to the president of Harvard. The Freshmen Plate tradition never happened again.

Hunt the Wumpus (take 2)

Story
A new Athena game is released on campus by some company. People play the game for a while and then get to a part where the game says something like “come back tomorrow for more.” That night, something bad happens in a physical location at MIT.

People somehow connect the bad thing that happened with the game. There is some contact information on one of the screens that mentions the developer of the game (this has to be realistic somehow). The players contact the developer, who didn’t know this would happen, but had a feeling that the company was up to no good. He installs a backdoor into the program so he has access to a small portion of the game (maybe just the text) without the company ever knowing there was any changes. He uses this to communicate with the players as the game progresses and he learns more about what the company is trying to do.

It turns out the company is trying to sabotage all of MIT (or something like that). Every time the players reach the end of a level, something starts to go wrong at some location in MIT and the players have to stop it from happening, but the company continues on believing everything is still going as planned. The players have to keep playing because they want to learn more about why the company is doing what they’re doing.

Toward the end, the plan starts to become clear and the players learn what they need to do to stop the company. The last part of the game consists of the players mounting an assault on the company and trying to destroy the plan.

Timeline
Beginning of the week is all about getting people to play the game. Advertisements are really really important here. Even more important is a game that can be timed out so that the players reach some sort of checkpoint at a specific time.

Middle of the week consists of nightly puzzles at physical locations that are triggered somehow by the game. This happens every night until the weekend.

Weekend consists of the players mounting the final assault on the company.

Benefits

• If the athena game is fun, it’s a great rabbit hole. And we have something to directly advertise.
• The game gives us an outlet to communicate and guide the players through the game. Our developer is a sympathetic character with important information that can lead the players through the game.
• The nightly events are a good way to bring people together for collaborative puzzle solving.

Areas that still need work

• Everything needs to be believable given a set amount of suspension of disbelief. We need to make clear early how much things will make sense with the real world so people don’t get pissed.
  • Game unlocking real world puzzles
  • Company trying to hack MIT with game
  • Developer caring and being able to help
• Why does the company want to hack MIT?
• We still need to work out how the game will work. Ideally it will be time-based somehow. Think Animal Crossing. It should have things that are based on both the real life clock and on what other people have done. This is a big component of the game.
• The real life puzzles are going to be tough to make well. In addition to figuring out specifics of the story that will allow them to fit in to the rest of the game, we also need to make them fun and big enough that all the players can participate and we only need to have one per night.
• The end game is also going to be really important and we haven’t started trying to piece that together yet.

Potential Roadblocks/Difficulties

• The appeal of this game relies heavily on the appeal of the video game itself. We need to work really hard on this aspect of the game. It may need to stand alone as a fun game by itself or people will lose interest after trying to play it the first time.
• The puzzles need to be more fun than the video game or people will be pissed that they aren’t just playing the video game.
• We need to have a good way of getting people excited about the puzzles so they move from the video game to the puzzles without losing too many people.

Resources Required

• The video game will be hard! We need game designers and coders! And we need to be really smart about it. We are going to have to be coding it from about now until the game starts.
• The puzzles are going to be intricate and will also require a lot of work.
• We need solid advertising for the game. How are we going to get people to play a text-based adventure game they need to be at an athena computer to play? (or we need to allow them to play it online or something)
• We need to write a part for the developer and he needs to be adaptable and probably played by one of us.