Krypt3ia

(Greek: κρυπτεία / krupteía, from κρυπτός / kruptós, “hidden, secret things”)

5 Reasons to Doubt Al-Qaeda Magazine’s Authenticity: Gives One Ideas, False Flag Anyone?

leave a comment »

The 5 reasons:

(1) Bin Laden and Zawahiri are extremely secretive and issue statements rarely and directly to the media. It would be unusual for them to write for a third-party publication, especially one put out by the Yemen-based AQAP, with which they have little or no direct ties. However, it is possible that the magazine’s producers simply copied old statements they had made.

(2) The language of the magazine, such as “Make a bomb in the kitchen of your mom,” reflects either a poor command of English or a light-hearted sense of self-parody. AQAP is not known for either. Awlaki, whose location in Yemen makes his participation very plausible, is a native, fluent, and very articulate English speaker. His fiery English-language sermons are not funny.

(3) The magazine includes an essay by Abu Mu’sab al-Suri. But Suri, whose connection to al-Qaeda is uncertain, has been locked up in Guantanamo–and possibly a CIA black site–since 2005. However, as with bin Laden, it is possible the magazine simply copied old statements.

(4) Analysts tell me that the magazine PDF file either does not load properly or carries a trojan virus. This is unusual because al-Qaeda and AQAP have produced and disseminated such PDF publications many times without such problems. If the report was produced by U.S. counterintelligence, or if the U.S. operatives attached the virus to the original file, would the trojan really be so easily detectable by simple, consumer-grade virus scanners? Surely U.S. counterintelligence has less detectable viruses at their disposal.

(5) The web-based “jihadi” community itself seems suspicious. The report has received little attention on web forums, especially given its apparent importance. A publication including such high-profile figures would normally receive far more attention than it has so far.

Full article HERE Inspire AQAP Glossy HERE (CLEAN)

Exploit or Ineptitude?

When this file came out I too had some issues with it not downloading fully from the myriad of uploader sites that the Jihadi’s had “ostensibly” uploaded it to. I attributed it to a lack of understanding on their part that the original had been corrupt somewhere along the line between sharing partners and propagated that way. However, given all of the data post release and some looking into, I think there are a couple of scenarios that might fit the bill;

1) The original was sent out to the trusted before going wide. Once sent wide, it was quickly infected with malware per persons unknown and propagated further on the internet.

2) The reason for the placement of the malware could be to sow distrust on the part of the jihadi’s trafficking in the data by persons unknown. This makes it an untrusted channel and more likely people will not download it too quickly in the future. I say this because the malware was easily detectable by current AV products. Had this been a program of the intelligence agencies, they would have indeed used 0day that was not detectable. The same could be said for certain factions of the hacking community who may have an interest in helping the other “community”

3) This was indeed some sort of poorly conceived exploit by some organization as the malware was easily detectable.. They screwed up.

I cannot say either way and I as yet, have not seen a copy of the “infected” file to prove out that it did indeed have malware embedded in it. The current version that I have on my server (linked above) is clean, but I believe that I have another dirty copy on another *nix box. I will check that later and amend this post once I have. All of this though does not lead me to believe that the magazine was part and parcel created by anyone else but a jihadist movement faction that offered it to AQAP.

You can go on the cues from above about the language and the other telltale clues that this is not a straight out work of GIMF or As Sahab. The writer of the article is right on this account in that the language would have been much better constructed by bi-lingual speakers of Arabic and English as you have seen in the past. The Al-Awlaki connection too may be there, but he likely did not have oversight directly of this magazine. In fact, when I pulled the metadata on the PDF file that I got hold of today, there was NONE in it. So it is hard to say who made the file at present. I will check again once I find that dirty copy I downloaded when it came out for metadata in situ.

As for Giving One Ideas..

All of this has given me ideas on perhaps how the information war should be waged against AQ and other online Jihadist movements if it already isn’t being done by the likes of the NSA. What if such PDF files were commonly compromised with 0day? The jihadists usually traffic pretty much only in PDF files nowadays. If you go to their sites you can’t even get a lock on the files there because they have uploaded them all to share sites all over the globe. So, who’s to say that there isn’t some governmental bodies out there with access to those .com .net sites and are infecting the files soon after the uploads happen?

I’d be doing that…

Hell, I’d be loading the files with malware for all the major OS’ out there not just Windows variants… Which, we know a good percentage of these online jihadi’s are using Windows as you may have seen in the posts I have made. The only problem then would be that if you are doing this to the downloaders, it leaves the creators still potentially unaffected.. How to get the creators boxes I wonder….

I guess the question Is… is this already being done? If not.. Why not? Seems to me that we could get a pretty nice haul if you compromised all those down loaders boxes and set up a nice back channel server somewhere to aggregate all the data as well as do some escalation….

Maybe the government just needs a good copy of Core Impact huh?

CoB

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: