Leesome?

They’re a list of the best cupcakes in America.

Last week, a .pdf of “Inspire” magazine, an alleged English-language publication from Al-Qaeda, appeared on Jihadist message boards.  The magazine’s table of contents boasted of a letter from Osama Bin Laden, a section on “open-source Jihad” (which I actually wanted to read), and the infamous “How to Make a Bomb in the Kitchen of Your Mom” article.

The posting of the .pdf got press in the New York Times, the Colbert Report, and The Atlantic, just to name a few. (The original is available on Archive.org)

However, after the first three pages, the rest of the .pdf was gibberish.  Jihadist message boards claimed a virus had been inserted into the .pdf and warned against downloading it.  Others claimed that it was the work of intelligence services to disrupt the distribution of the file.

The gibberish is certainly not a virus, and I doubt the gibberish is the work of intelligence services–Why wouldn’t the original author just re-post the complete .pdf after the first had been scrambled?  These terrorists are supposed to be in a network, right?

After downloading the .pdf, I changed the margins to reveal some cropped content on the pages (thanks to ActionFromTheBackSection on the Atlantic).

On the top of all the pages of gibberish, was this filename and directory (C:\Users\m50\Desktop\ellenbca.pdf).  My assumption was that the gibberish in the Al-Qaeda pdf came from that file.

A quick web search for “ellenbca.pdf” will turn up this file, posted on the website of Hudson, Ohio’s Main Street Cupcakes, LLC.

Ellenbca.pdf turns out to be the first page of a list of “The Best Cupcakes In America” from the Ellen DeGeneres show.  For those looking for a conspiracy, the list was complied by Dulcy Israel, a New York City based writer who has also complied a list of the best music for kids for TimeOut NY.  Dulcy Israel????

Anyway, the garbled text is really a bunch of ASCII character encoding.  It looks like someone opened up Ellenbca.pdf as an ASCII encoded file in a Windows-based text editor, printed a pdf from the text editor and then merged it with the first three pages of the Inspire Magazine pdf.

Below is the first line of the garbled text in the Inspire magazine pdf.

When you open Ellenbca.pdf in a hex editor, which allows you to see the hex values that the computer sees (Hex is a couple level of abstractions up from 1s and 0s), you can do a search for this group of characters.  I did my search for the “>;” characters first.

Here’s what I found in Ellenbca.pdf (I’ve highlighted both the hex and the translation provided by my hex editor):

Looks pretty similar to what’s in the Inspire magazine pdf, doesn’t it?  (it actually looks exactly the same when you convert the hex into ASCII encoding; my hex editor is displaying ANSI encoding) All that’s missing is that NULCAN part after the gibberish.

Those two dots at the end of the gibberish in the hex-dump of Ellenbca.pdf stand for ASCII characters that can’t be printed, such as a Tab, Backspace, or New Line.  Cross referencing those dots with the hex gives the values of 00 and 18, which stand for the Null and Cancel ASCII characters.  Or in other words, NULCAN (shorthand for Null and Cancel).  This bit of hex translated into ASCII matches the beginning of the gibberish in the Inspire magazine pdf.

I’ve dug through the hex of other .pdfs and cannot find the same string of characters, so I can assume that the above string of hex (and corresponding ASCII encoding) is unique to Ellenbca.pdf.

So what makes this a hoax?  Tongue-in-cheek humour about bomb-making + Ellen DeGeneres’ list of the Best Cupcakes in America sounds pretty un Al-Qaeda like to me.  And if there ever was original full version of Inspire magazine that was hijacked by intelligence services, I would imagine they would be able to do a better job of obfuscation. LATE UPDATE: Turns out I was totally wrong

With a clear trail from leading from Jihad to cupcakes, whoever posted Inspire magazine is probably having a good laugh over all the media coverage.