The mystery of the anonymous email

Question

It is a bright Sunday afternoon. You are on a holiday, enjoying your cappuccino. Suddenly, you get a call from your boss at NSA. He tells you that a psycho-hacker has sent him and the whole staff a weirdo-looking image attachment sent using an anonymous email sending service. Hearing that, you quickly log into your email account and find this:

enter image description here

Now, the question: Who sent this message?

EDIT 1:- Someone changed the password of the Gmail Account an hour ago. So, instead of that hint. See the below hint:-

You spot down all hints and at last, you find an email and password. You login and find the following email in the inbox:-

From:XXXXX

To:mXXXpuXXX@gmail.com

Subject: FINAL HINT
You are an inch away from solving this puzzle. You might want to see the attached image.
<p>BTW I love mosaic tiles :)</p>

Attached Image: Download

EDIT 2:- I have changed the case of the account password. Please don't change the password and hinder the experience of others, the account is blank and is of no use. You may need to use an Indian VPN/Proxy to login (Curse Google!). If the password has been changed again, then use the above edit :)

I'm gonna assume "by the time..." and "I believe that you are one of...." the words the and you are left out on purpose? Also should it not be I will have died? and shouldn't i in that sentence be a capital I? would have indicates he hasn't died?
You have made a picture of it for a reason so i'm guessing you're a master in English and every thing i find odd with the text is deliberate? — Vincent, Jun 12 '15 at 09:59
@VincentAdvocaat Typo and I can't edit that image for a reason now ! BTW that's how hackers write, they don't give a fu## about grammer or thing. — Sharad Gautam, Jun 12 '15 at 10:01
:p haha, so he has died. and the left out words are not intended? Also i wish i had a program to which i could give an image and have it brute force the information out of it much like cryptocrack for ciphers. anyhow, lets get looking for that password ;) — Vincent, Jun 12 '15 at 10:06
"Also should it not be I will have died? " No, instead it should be I would be dead. Anyways, can't edit it now! @VincentAdvocaat Lets See :) — Sharad Gautam, Jun 12 '15 at 10:06
I tried to hexdump the image file (you said you can't edit the image) and find "nullbyte" (ie. 00), but there's many. Is it good way to follow? — Voitcus, Jun 12 '15 at 11:17
I found the password (for the gmail) but it needs an access location.. Is this part of the puzzle? — WorldSEnder, Jun 12 '15 at 13:05
No, maybe a problem with Gmail, tell me where you're from(country) so that I can see the problem @WorldSEnder — Sharad Gautam, Jun 12 '15 at 13:16
@SharadGautam Do you have an acceptable answer here yet? Bob's looks good. — LeppyR64, Jun 24 '15 at 13:48

Bob · Accepted Answer · 2015-06-13T19:52:31.253

13

The sender is going by the name of POOP and...

IAMINCREDIBLE - masterpuzzler007@gmail.com is his email address (not sure of his name yet)

The image contains a hidden message...

...which you can find by opening it with a text editor and looking at the end where there is a link to file hosting site that requires a password.

Once you have found that you need to know that...

...the password is 00 hence the clue "nullbyte"

Then you get:

6d617374657270757a7a6c657230303740676d61696c2e636f6d

Hint:You may need a different point of view for the next one.

454c4249444552434e494d4149

This is...

... a hexadecimal string representation of the ascii values of masterpuzzler007@gmail.com and ELBIDERCNIMAI (I AM INCREDIBLE backwards)

Once you've found this...

you can access the email account to get a picture similar to the one in the original message (https://i.stack.imgur.com/GXdER.png) which has an anomaly in the top left corner. Some of the pixels looked smudged downward but they have actually been more significantly altered. The thin grey strip along the top of the image is not pure grey in the smudged section. Each of the 19 pixels is a different colour to the unsmudged portion of the strip. Presumably these pixels encode the name we are looking for.

The hexadecimal values of each pixel are:

cec1b9 cfc3ba cdc1ba cfc1bb cec0bb ccc0b9 ccc0b9 cdc1bb cec0bb cfc1b9 ccc3b8 cfc0bb ccc1bb ccc1ba cec1bb cfc0b8 cfc0b9 cfc3bb cec3ba

If you are hoping to work this last bit out by hand good luck to you. Credit to Quark and LeppyR64 who worked out the final step, which is:

Enter the new image into http://mozaiq.org/decrypt with the password "00" to get the line "Yes, you've found me. My name is VGVjaFJheA==". This is Base64 encoded and translates to TechRax.

edited Jun 13 '15 at 19:52

answered Jun 12 '15 at 11:16

Bob

4,253
2
21
45

There is still a long way to go. I hope you like it so far :) – Sharad Gautam Jun 12 '15 at 12:50
Am I supposed to mail that address? I'm not sure what else is left. – Bob Jun 12 '15 at 12:53
Professor Layton is dead? Or did I go off on a huge tangent – ʰᵈˑ Jun 12 '15 at 12:57
Everyone, please see the updated QUESTION – Sharad Gautam Jun 12 '15 at 13:55
@SharadGautam Thanks, that helps me keep going :) – Bob Jun 12 '15 at 13:57
@Bob What's the progress? – Sharad Gautam Jun 12 '15 at 18:56
@SharadGautam I've extracted a few bytes that could be a name but I haven't had any luck turning them into text. I almost expected someone else to have worked it out by now. – Bob Jun 13 '15 at 09:25
@Bob The email in the *edit 1* is your ultimate hint. Just wordplay :) and a "rephic" and a "qiasom". – Sharad Gautam Jun 13 '15 at 12:28
This website isn't necessarily general knowledge and wasn't obvious to me the first time I encountered it: see my edit to your answer – LeppyR64 Jun 13 '15 at 16:15
@LeppyR64 how did you know that site was the one used? – Quark Jun 13 '15 at 16:29
@Quark see Sharad's last comment on This answer. Also the Mosaic tiles comment. – LeppyR64 Jun 13 '15 at 16:41
1

@LeppyR64 Ah I just realized "qiasom" is "mosaiq" backwards. – Quark Jun 13 '15 at 16:47

score 2 · Answer 2 · answered Jun 13 '15 at 16:28

2

Credit to Bob and LeppyR64 who basically solved it, here's the last part:

Enter the new image into http://mozaiq.org/decrypt with the password "00" to get the line "Yes, you've found me. My name is VGVjaFJheA==". This is Base64 encoded and translates to TechRax.

answered Jun 13 '15 at 16:28

Quark

6,077
1
20
46

Excellent Work :) – Sharad Gautam Jun 13 '15 at 16:40
Well done! I had never heard of that website so probably never would have solved this. – Bob Jun 13 '15 at 19:48

The mystery of the anonymous email

2 Answers2

Linked