What are those scrambled pages of Al-Qaeda’s English language magazine?

They’re a list of the best cupcakes in America.

Last week, a .pdf of “Inspire” magazine, an alleged English-language publication from Al-Qaeda, appeared on Jihadist message boards.  The magazine’s table of contents boasted of a letter from Osama Bin Laden, a section on “open-source Jihad” (which I actually wanted to read), and the infamous “How to Make a Bomb in the Kitchen of Your Mom” article.

An Inspired Hoax

The posting of the .pdf got press in the New York Times, the Colbert Report, and The Atlantic, just to name a few. (The original is available on Archive.org)

However, after the first three pages, the rest of the .pdf was gibberish.  Jihadist message boards claimed a virus had been inserted into the .pdf and warned against downloading it.  Others claimed that it was the work of intelligence services to disrupt the distribution of the file.

The gibberish is certainly not a virus, and I doubt the gibberish is the work of intelligence services–Why wouldn’t the original author just re-post the complete .pdf after the first had been scrambled?  These terrorists are supposed to be in a network, right?

After downloading the .pdf, I changed the margins to reveal some cropped content on the pages (thanks to ActionFromTheBackSection on the Atlantic).

On the top of all the pages of gibberish, was this filename and directory (C:\Users\m50\Desktop\ellenbca.pdf).  My assumption was that the gibberish in the Al-Qaeda pdf came from that file.

Inspired Gibberish

A quick web search for “ellenbca.pdf” will turn up this file, posted on the website of Hudson, Ohio’s Main Street Cupcakes, LLC.

Ellenbca.pdf turns out to be the first page of a list of “The Best Cupcakes In America” from the Ellen DeGeneres show.  For those looking for a conspiracy, the list was complied by Dulcy Israel, a New York City based writer who has also complied a list of the best music for kids for TimeOut NY.  Dulcy Israel????

Anyway, the garbled text is really a bunch of ASCII character encoding.  It looks like someone opened up Ellenbca.pdf as an ASCII encoded file in a Windows-based text editor, printed a pdf from the text editor and then merged it with the first three pages of the Inspire Magazine pdf.

Below is the first line of the garbled text in the Inspire magazine pdf.

The bit of garbled text

When you open Ellenbca.pdf in a hex editor, which allows you to see the hex values that the computer sees (Hex is a couple level of abstractions up from 1s and 0s), you can do a search for this group of characters.  I did my search for the “>;” characters first.

Here’s what I found in Ellenbca.pdf (I’ve highlighted both the hex and the translation provided by my hex editor):

Some hex-dump from Ellenbca.pdf

Looks pretty similar to what’s in the Inspire magazine pdf, doesn’t it?  (it actually looks exactly the same when you convert the hex into ASCII encoding; my hex editor is displaying ANSI encoding) All that’s missing is that NULCAN part after the gibberish.

Those two dots at the end of the gibberish in the hex-dump of Ellenbca.pdf stand for ASCII characters that can’t be printed, such as a Tab, Backspace, or New Line.  Cross referencing those dots with the hex gives the values of 00 and 18, which stand for the Null and Cancel ASCII characters.  Or in other words, NULCAN (shorthand for Null and Cancel).  This bit of hex translated into ASCII matches the beginning of the gibberish in the Inspire magazine pdf.

I’ve dug through the hex of other .pdfs and cannot find the same string of characters, so I can assume that the above string of hex (and corresponding ASCII encoding) is unique to Ellenbca.pdf.

So what makes this a hoax?  Tongue-in-cheek humour about bomb-making + Ellen DeGeneres’ list of the Best Cupcakes in America sounds pretty un Al-Qaeda like to me.  And if there ever was original full version of Inspire magazine that was hijacked by intelligence services, I would imagine they would be able to do a better job of obfuscation.

With a clear trail from leading from Jihad to cupcakes, whoever posted Inspire magazine is probably having a good laugh over all the media coverage.

    • karel
    • July 9th, 2010 7:43am

    I will add that the PDF actually WAS posted – in the exactly same form, with the hexdump of the best cupcakes – to some islamic web forum – see http://bit.ly/b2mpYL (redirect to google cache, probably won’t work after a while).

      • Lee Gillentine
      • July 13th, 2010 11:47am

      So that’s where it originated! I just pulled the archive.org copy from a link on The Atlantic. Thanks for the link.

      On a related web forum note, I found this forum post on an islamist forum where there is some speculation over the username on top of the files

      http://www.as-ansar.net/vb/archive/index.php/t-23034.html (you’ll have to run it through Google translate).

    • Mary in LA
    • July 13th, 2010 1:14am

    Nice job on the computer forensics! :-)

  1. I can’t figure out how to subscribe to the comments via RSS . I want to keep up to date on this, how do I do that?

      • Lee Gillentine
      • September 25th, 2010 2:23am

      There should be a “Comments RSS” link above the start of the comments box that will let you subscribe. But in terms of this issue, I was wrong, and the Inspire magazine was not actually a hoax. http://jarretbrachman.net/?p=726