Inspire Magazine Email and Encryption Key Comparison

One of the more interesting aspects of Inspire magazine is its use of a public key encryption system for communication based upon a program called Asrar al-Mujahideen. The fundamentals of using this program are explained in the first issue of Inspire magazine. Throughout the first six issues of the magazine the same four email addresses are listed alongside a public key for use with the Asrar al-Mujahideen program. In the September 2011 issue there is a different public key listed, though the email addresses remain the same. All four email addresses used are associated with free email providers located in the United States. All of the providers log IP information for users of their services and the suggested program used for encryption does not take any steps to hide the sender’s identifying information. Though the guide to using Asrar al-Mujahideen in the first issue of Inspire does recommend sending messages with the program from a neutral location, such as a coffee shop, subsequent issues do not reinforce this concept. In fact, some issues of the magazine only “recommend” using encryption. Thus, the authors of Inspire magazine appear to be delivering their supposed supporters and potential aspirants directly into the hands of a carefully logged and easily subpoenaed evidence trail.

Thanks to Mikko Hypponen for first noting the change in public keys.

Update May 3, 2012: Issue 9 of Inspire magazine again changes the public encryption key.

Update March 1, 2013: Issue 10 of Inspire magazine again changes the public encryption key and email addresses.

Issue 10

Email addresses:

inscont@yahoo.com
pirezine@yahoo.com

Public key:

#---Begin Al-Ekhlaas Network ASRAR El Moujahedeen V2.0 Public Key 2048 bit---
pyHAv2KZ9gRLgLtwb4spOh0Xb1cFjsZ3tcbo6CnuUT+wOy74p7
uZnEbshDmLZFXVSe5RntWOI5m86+rdl2HRcC401JZIgxsmMI5I
KaSLmepn6dElNoWTbVAjtsFERXcjtEOYkZvhQN3JCIAlNTs6Xk
I8zxI4U7VU2LoZzJw4QEdRcWutnZ3yCS5VxLnTOUtIawwZKd3C
HFLrkzmhEr5G1Nxe6+OlU6ZI8aomCOfwFkYLao28RLDL8vGag7
JFbxSXy7f6LOBrCCO8Mu4lfUpUGOZCGP4RXJfRLTEEmH9sFf/C
ZEwJEeWm9o2fo2yU/4nXMZIxN441iVzvlGTPbuPxy2f0+p/NMV
X+orew/pvkoofnw0lxFhVxYU99eixHBEgEQCAusw7FVGHbpRJg
gULtulLCd9VLAZRFvhyUk+lHPpsoedrQLvSoHlVC/Ga7ZIMJYX
2PNuYqbafJpUZAqU1Ghq/YKIICeClbLuWSaDErp+K3kMz0m6Ay
qCFcrv6gcxMqzHPIj9VJ3ZS97vMqgux3VeZKRG1TCV+Jm1whg8
/32OnzZILNtYBWLvWavpum
#---End Al-Ekhlaas Network ASRAR El Moujahedeen V2.0 Public Key 2048 bit---

Issue 9

Email addresses:

inspire11malahem@gmail.com
inspire2magazine@yahoo.com
inspire22malahem@fastmail.net

Public key:

#---Begin Al-Ekhlaas Network ASRAR El Moujahedeen V2.0 Public Key 2048 bit---
pyHAvqTp3Mxye8vscUGr+92wvuhK6eyL9QBseQ4gsX3Fcnr2xO
ERLLpA5w+rjkZENPNR61Xf0fYNPSRyUpDXamNXzfDVF4upScX8
ufGGgxZeTaz6m3kwS6A87nayVakI83NK7eXp+Ugc1Jm1Nxq3lq
8suJvXA/ft3KgsHyeumaORsbM382mJ3PTXt3Z88La49Kw3hYL5
6lYP7G4/FS9lAxn2mzKfPKay2tcKKpdfDK+RSNgDhbWaCdbjw5
5kVMcoR5knEN3lqD/cd8WM7XvmkbF4+gmuqKC5NPtz5/bNPIMS
QncdyFQlHU7IKILJiNbvpx/XZYzrRFRFHqi+kOX8edDthD5+cW
dCv0WQw3lMbn3iKCJKasLe9e9IARPGBKqz9ubkwcSZntmB+9gr
c5hRRb+/SembIh6RBNucNYd22oGnenmBenM2O/sRzkHhg0R7Oi
1zdR5Qn8CcUxKzO2OebPaTOxpFtdizzvBciLjyE9mV45M4Qspf
56QSWTDFinhNZGDW3WWkRp4fCsV2Mr8M9wvNHan+2QISsdBj
#---End Al-Ekhlaas Network ASRAR El Moujahedeen V2.0 Public Key 2048 bit---

Issues 7-8

Email addresses:

inspire11malahem@gmail.com
inspire2magazine@yahoo.com
inspire22malahem@fastmail.net

Public key:

#---Begin Al-Ekhlaas Network ASRAR El Moujahedeen V2.0 Public Key 2048 bit---
pyHY2q3DSBasVBCwh13bFtgFu+t4ioqKkBmXxYOy96mp5RKO7C
u2zLT87G7jzSw3X5UZg87ew9Z60a4X/XShrNuqE6dLioT3c84d
PMDOyPiA4wSNN/btukSvnw6gdjygH+lm0SxJmnOH+Sxjd9piZZ
VTxSsj20/KQbhzPCj/QacCZDW9sCY2iybKnfOp0lU2WNr+O264
Sr36krjbxZ8Oj8+G7QJUMq0w0m/e9d/uNIFRJSQccWhHErUBO+
xDBCm4g1zoFr3Rc4d9hRoFOwUdGEyxIX95L8V3A8LCA1F+HJ+4
cLPeujgzgqyhqPNrO+FS2nqUV11QRJl/1Ljfa/FTYZQydwDVSI
VoXKxaKIjK4eqdI+9MJNjQzax/gbrw2wsuVukEooY1htj2b5eX
esM46n5+ugixB18AM6DMDtbyLhciiGyw685/MYfiwYZXowfvdV
Dkrj/ybql8bQgzq//QzXkrbVqCwn9d4J2wTktbiWoOu+zdg07B
jbWCJr+nfStEo/Qo+Hx3BDu3VhIptj/aAXxPVhgLg9q3Hur8ln
XJKIvi4fUF0A==
#---End Al-Ekhlaas Network ASRAR El Moujahedeen V2.0 Public Key 2048 bit---

Issues 1-6

Email addresses:

inspire1magazine@hotmail.com
inspire11malahem@gmail.com
inspire22malahem@fastmail.net
inspire2magazine@yahoo.com

Public key:

#---Begin Al-Ekhlaas Network ASRAR El Moujahedeen V2.0 Public Key 2048 bit---
pyHAvNeRKLqFHJG+LA5hZfEYlSJCYB6zeKc5Bq1F5EwjBuJyt0
9cMJHoSdEv98hVymwhLsOgLzigJHPTfxA0Ani7EWNaZx1hLaRm
/hBmHErTQ6hZFuBiqnZ1WCEf5NbM7r8iKc0JEkryxlT8jehgIo
C2e0/uG35q1cmRudP4eanVKfikQnojeEz3D1bD3iKWZNx7HBhL
2z6YOtfG8sFb8AyjXv8SEHaRHGO37uwlD8UNguxIRwanb5yEYP
bD1bc4XFfy8JJgRNY8xWqAOwDZAciQ9MykgLZDoxxk/fBxm+Ni
x+VRQsxDk9BDg6OYw4hcgqhu1yWItz6858NA9rl7Y2ki78bMZP
J9HXAD3J6OiW9dKXYLE4mhwpe0C9iqfsDNhwepvawL0K8R8sZj
3MnlUAwm8hLjEX794qGPD2cPonp3lxICMddtQRSR3sN23bJOLF
/OOZhU9Shqv3k0rA4YfT3XoqLoeprXucHzXFRX0CCQOdrnFQzG
+49YV1YeTPpv7TtHvLoYxbsI31ieOPogM7/rKXvQRRzZFstkxA
==
#---End Al-Ekhlaas Network ASRAR El Moujahedeen V2.0 Public Key 2048 bit---

 

Explanation of Asrar al-Mujahideen software from first Issue of Inspire magazine:

13 comments for “Inspire Magazine Email and Encryption Key Comparison

  1. a non
    October 1, 2011 at 9:19 am

    Fascinating! Thanks! A quick google also reveals:
    “one downside of using this custom tool to cipher messages is that the encrypted messages always start with the unique text: “#—Begin Al-Ekhlaas Network ASRAR El Moujahedeen V2.0 Public Key 2048 bit—” giving away that the user is likely an Al-Qaeda supporter since this encryption software is not publicly available for download.”

  2. October 2, 2011 at 3:28 pm

    Just from reading the article, it appears to me that it was written by an American. There is no broken english at all.

  3. October 2, 2011 at 8:16 pm

    Yeah I’ve always thought Inspire was written either by CIA assets as a honeypot for American radicals or an already radicalized US insurgent. It would be more probable for the writer to be of UK origin seeing as they seem to have a higher density of radicalized individuals, but I see no evidence of localization to that area based on meter, sentence structure or spelling differences.

    Either way, the implementation of a public-key infrastructure with a program integrity function is rather sophisticated and kind of scary.

    • October 2, 2011 at 9:51 pm

      I’d describe the grammar and sentence structure of at least some of the articles – including the one shown above – as fluent, educated, and British-influenced, but not actually British. To me, it seems more indicative of someone from, or educated in, India or Pakistan. Or, for that matter, Canada or Australia. ;)

      • Public Intelligence
        October 2, 2011 at 11:07 pm

        What about someone educated in Israel?

        There seem to be purposeful mistakes in the grammar and spelling of some articles in the publication, as if to give them a more unpolished authenticity. The disjointed structure of some sentences seems to indicate a native speaker of Semitic languages, such as Hebrew, but is obviously fluent in English. Also, the tone of the content, reveling in the usage of the word “terrorist” has always seemed odd. After all, they don’t recruit people by saying they’re a bunch of murdering psychopaths . . . they have an ideology.

        The original issue with the cupcake recipes is still the biggest indicator to me. Who would have access to a pre-release terrorist magazine? In fact, I honestly think that if it wasn’t for media coverage there wouldn’t have even been any more issues of Inspire after that. 3 pages of content and then 64 pages of gibberish that’s actually cupcake recipes by a person named Dulcy Israel? The reported death of Samir Khan in Yemen could also potentially be a cover for the cessation of any further issues of the magazine. The most recent issues have had less and less content in each release.

      • Michael Saint
        October 12, 2011 at 10:52 pm

        I agree there are purposeful mistakes in grammar and spelling. But what are we to make of it’s feminine design?In Arab society, such colors and designs as INSPIRE has displayed would be wholly unacceptable. Then there is the slang; a cold diss ? a come to jihad production? The Creative Suite graphics are not so widely developed in the United States, but I have noticed them in Australian media. All this may be attempts to hide the true origins.
        But even more telling, is that the individual who has very poor Arabic skills, who created an afterthought header on page 7 of Inspire 6, wrote the eulogy that was published on Shmikh. His use of the Arabic words for “comrade” and “revolutionary”, I believe, reveal him to be a communist secularist, leftover from the Soviet influence on Yemen. The absence of proper Islamic Quranic citation prove he is not a salafi. And why wouldn’t a salafi eulogize Awlaki? And why would an author of Inspire be a secularist? And have poor Arabic skills?
        I have gone from believing INSPIRE to be an intelligence agency to a rogue contractor, type of project….to simply not knowing. The only thing I am quite certain of, is that it is not about AQAP or an Islamic state in Yemen.
        What would motivate Awlaki to label the secessionist movement with a big AQAP in bold type, and ally with KGB trained comrades? And who would fund it ? (not the Russians…nahhh).
        A true Yemenite knows foreign occupation would resolve nothing.
        And since nothing really useful has come from Team Awlaki, it’s still a big puzzle.
        Did the Arab spring derail the true intentions?
        Was this a Creative Dance just to encourage the mass production of thousands of predator aircraft? (now that would be lame).
        Even Yemeni’s don’t know.
        Hell, they didn’t even know Awlaki!
        Who knows?

  4. October 4, 2011 at 11:53 pm

    @Public Intelligence

    Has anyone ever done a study on the telemetry of this magazine? How does PI get it? I think there are so many possibilities as to how or where it was created that we will never know, but on further inspection there are clues that it might be created by the Mossad. The flags include the Desert Eagle (pointed out by P.I. in a previous post) and the cupcakes incident including Dulcy “Israel” as the author.

    Then again it could just be a honeypot for idiot domestic jihadists. There is absolutely no possible way to authenticate the creator of the magazine or the cryptography program. For all we know this supposed “cryptography” program is in fact a rootkit and sends all pertinent data on your computer straight to a server in Virginia. Unfortunately I haven’t been able to get my hands on it to disassemble it or analyze network traffic produced by it so it’s impossible to tell. (P.S. I love the Colt SP1)

    One strange thing though is that the issue after the cupcake perpetuates the idea that the PDF got hit by a “virus”. Now obviously the media sees any type of malware or obfuscation as a “virus” so it seems this was just done for attention. But the magazine itself perpetuating this thought only plays further to that, if it had a legitimate creator as technologically experienced as the later issues presume then it would have explained how they just replaced the data. Maybe their are multiple creators?

    All of it is rather confusing and be it made by some alphabet-soup agency or some dude with a laptop in a cave- it’s creepy.

  5. Niels Groeneveld
    October 6, 2011 at 2:23 pm

    Interesting discussion. For those unaware of the article published by McAfee Labs on one of the earlier Inspire issues, I would advice to check this publication :

    Odd Magazine: Disinformation at Play ?
    http://blogs.mcafee.com/mcafee-labs/odd-magazine-disinformation-at-play

  6. DontTreadOnMe
    December 11, 2011 at 10:42 pm

    Fascinating the comments made here. New to the site. This will now be a regular read. The insights into determining the writer of Inspire is remarkable.

  7. Animedude5555
    February 2, 2014 at 7:12 pm

    Just because they don’t repeat the same instructions exactly as in the first issue (send mail from a neutral location) in every future issue doesn’t mean that it doesn’t still apply. If I ever sent info sensitive enough that it demanded encryption (regardless of the software I use), it would be sensitive enough to send it from a neutral location so my IP address couldn’t be tracked. Anyone sending stuff like that from their home is an idiot. It doesn’t have to be specifically stated in every issue of the magazine. It’s lack of inclusion in later issues is not proof of any CIA involvement in the magazine. Nor is changing your RSA key pair periodically. It’s smart actually. It keeps your opponent (the US spies in this case) guessing.

    Also in reply to the first commenter who said that it wasn’t publicly available, you are completely wrong in that assertion. It is publicly available, and I have even downloaded it myself (and I’m certainly no Al-Qaeda member), just out of curiosity. It’s actually a very nice freeware public-key text encryption/decryption program. Though the site I downloaded it from ( http://ansar1.info ) appears to have been shut down. It was the website of Ansar Al Mujahideen, an Al-Qaeda linked terrorist group in Pakistan. Maybe the building that housed the server got pwned by US drones. LOL. I wouldn’t trust downloading it from any other site, as the ansar1.info site said to only download it from them, as other copies on the net could be compromised with CIA/NSA malware that would log the IP address of whoever downloaded it and install spyware on their computer. So I downloaded it from that one site only, as it appeared to be the only official download, and I didn’t want to accidentally get on some FBI terrorist watchlist by unknowingly downloading a hacked copy of the software. But yes it was a publicly available download, as the website that had the download link (ansar1.info) was a publicly viewable website (not limited to Al-Qaeda members).

Leave a Reply

Your email address will not be published. Required fields are marked *