Free Republic
Browse · Search
News/Activism
Topics · Post Article

Skip to comments.

Possible break in the anthrax case? (Actual title: Anthrax-Nimda Connection)
Dept. of Computer Science and Software Engineering, Seattle University ^ | November 9, 2001 | M. Spector

Posted on 11/13/2001 12:42:52 PM PST by Mitchell

ANTHRAX-NIMDA CONNECTION

Two Prongs of One Attack on Our Communication System

M. Spector
Dept. of Computer Science and Software Engineering
Seattle University
E-mail: spector@seattleu.edu

November 9, 2001

It appears likely that the recent anthrax mailings and the Nimda computer worm are two prongs of a single coordinated attack on our communications infrastructure. If this theory is correct, there may be two undiscovered anthrax-laden letters, including one mailed in late October whose victims would still be in the incubation period.

A Summary of the Evidence

The anthrax mailings and the Nimda worm were released on exactly the same two dates. Moreover, they were distributed via essentially the same method, and they shared a common apparent purpose. The details follow.

Released on the Same Dates
The anthrax-laden letters were postmarked on Sept. 18 and Oct. 9, 2001. These are precisely the same dates that the destructive Nimda worm and a new variant of this worm called Nimda.B were released on the Internet. Sept. 18 was the date that the Nimda worm was released on the Internet, and Oct. 9 was the date that the Nimda.B variant was released.

Same Method
Both involve mailing (either by the Postal Service or by e-mail) a destructive payload to unsuspecting individuals. Although the two attacks (anthrax and Nimda) appear at first glance to be very different from one another, a similar mind-set seems to underlie both.

Same Apparent Purpose
Both attacks may have had as their combined purpose the simultaneous disruption of all our mail communications -- both the U.S. mail and e-mail. Luckily, neither attack has been particularly successful in this regard, at least so far.

In addition, the anthrax letters were sent to people in the mass media, which is another component of our communications system.

Consequences

Still-Undiscovered Anthrax Mailings? (Kathy Nguyen's Death and Another Possible Forthcoming Attack)
Three more variants of the Nimda worm were released after Nimda.B: Nimda.C (on October 12), and Nimda.D and Nimda.E (both on October 29). If the anthrax-Nimda connection isn't a coincidence, there may have been further mailings of anthrax on October 12 and October 29.

Are there undiscovered anthrax letters that were mailed on the later worm release dates of October 12 and October 29? Is it conceivable that a hypothetical October 12 mailing was responsible for Kathy Nguyen's death? I think anybody infected by a hypothetical October 29 mailing would still be in the incubation period for the disease, with signs of infection to show up shortly.

I hope I'm wrong about the possibility of an Oct. 29 anthrax mailing, but it's important to be alert for more anthrax cases as we near the end of what would be the incubation period (and this is also a test of whether the theory is correct).

Notice that these hypothetical anthrax release dates are consistent with the warnings of terrorist attacks within the following few days issued by the FBI on Oct. 11 and by Attorney General John Ashcroft on Oct. 31 (especially in light of both the incubation period for anthrax and the inherent uncertainty in warnings such as these).

Connection with Code Red II and earlier worms
The Nimda worm makes use of "back-doors" left by the earlier Code Red II and sadmind worms. It is unknown if this is an opportunistic use of these back-doors, or if one or both of these earlier worms were released with the specific intent of following up with the Nimda worm. It is also unknown if Code Red II is actually related to the original Code Red worm (in spite of the names assigned by security experts). In any event, the sadmind worm was released on May 8, 2001, Code Red was released on July 16, 2001, and Code Red II was released on August 4, 2001. It would be of interest to see if there were any apparently unrelated anthrax threats, terrorist threats, etc., on May 8, July 16, and/or August 4. (I have seen a news report indicating that Bill O'Reilly and Sean Hannity of Fox News may have received letters before Sept. 11 apparently similar to the later anthrax mailings.)

The People Behind the Attack
The coincidence of dates and the similarity of methods and purpose indicate that the same group of people is behind both the anthrax attacks and the Nimda series of worms. It appears that at least two people must be involved, since one person is unlikely to be so skilled at both microbiology and software development as to have been able to create and carry out both attacks.

Speculation

Speculation - Connections with the 9/11 attacks
The first Nimda attack occurred almost precisely one week (to the hour, and maybe to the minute) after the first plane hit the World Trade Center, strongly suggesting a connection between the Sept. 11 attacks and Nimda, and now therefore suggesting a connection between the Sept. 11 attacks and the anthrax mailings.

Speculation - Place of Origin
This theory may point to a foreign connection with the anthrax attack. It has been widely suggested that Nimda may have originated in China; this is purely speculative and is based only on early widespread propagation in Asia and on the fact the worm itself contains a reference to China.

Background: Technical Information on the Nimda Worm (and others)

For technical information on the Nimda, Code Red, Code Red II, and sadmind worms, see the Symantec security web site at http://securityresponse.symantec.com , the F-Secure web site at http://www.europe.f-secure.com/v-descs/w.shtml (click on W32/Nimda.a@mm, etc.), and the SANS Institute web site at http://www.incidents.org .


TOPICS: Breaking News; News/Current Events
KEYWORDS: anthraxscarelist; techindex
Navigation: use the links below to view more comments.
first 1-2021-25 next last

1 posted on 11/13/2001 12:42:52 PM PST by Mitchell
[ Post Reply | Private Reply | View Replies]

To: Mitchell
I only skimmed, but this is pretty fascinating. I'll be interested to see other comments.
2 posted on 11/13/2001 12:48:37 PM PST by NYS_Eric
[ Post Reply | Private Reply | To 1 | View Replies]

To: Mitchell; *tech_index; *Anthrax_Scare_List
Very interesting !

To find all articles tagged or indexed using above index words

Go here:

OFFICIAL BUMP(TOPIC)LIST

and then click the topic to initiate the search! !

3 posted on 11/13/2001 12:48:51 PM PST by Ernest_at_the_Beach
[ Post Reply | Private Reply | To 1 | View Replies]

To: Mitchell; *tech_index
Filing at tech_index
4 posted on 11/13/2001 12:52:21 PM PST by afraidfortherepublic
[ Post Reply | Private Reply | To 1 | View Replies]

To: Mitchell
Bumpin' to check later.

Initial impression - it seems rather far-fetched, but, then again, that's an impressive set of 'coincidences'.

5 posted on 11/13/2001 12:57:55 PM PST by Le-Roy
[ Post Reply | Private Reply | To 1 | View Replies]

To: Mitchell
Now THIS is getting really far fetched ....

Sorry, but the "evidence" is not only weak, it is outright MISSING! try again...

6 posted on 11/13/2001 1:00:37 PM PST by AgThorn
[ Post Reply | Private Reply | To 1 | View Replies]

To: Mitchell
Speculation - Connections with the 9/11 attacks.

Ahhh.... He admits this is speculation.
7 posted on 11/13/2001 1:32:57 PM PST by self_evident
[ Post Reply | Private Reply | To 1 | View Replies]

To: AgThorn
>Sorry, but the "evidence" is not only weak, it is outright MISSING! try again...

"Evidence?"

If the sequence of events as speculated about turns out to be true, what kind of evidence would be available?!

Would you dismiss a connection as unreal until an FBI agent just happens to walk into a two bedroom apartment where, in one bedroom, a guy is mixing up anthrax and in the other a guy is typing up computer code?

I mean, this is 2001. People doing this kind of terrorism aren't idiots. This weird, constant talk of "evidence" has an air of insanity to it.

More likely than not, there will NEVER be evidence that will stand up in a court of law EXPLAINING everything nice and tidy. But so what? Law enforcement or intelligent agencies still have to respond sooner rather than later to this kind of large scale threats. They have to act on something other than "court room evidence." And if we're going to understand what's going on around us, we have to recognize that although "evidence" is great and although it's dangerous to speculate without hard, material evidence, there are many situations where people just have to get creative, people have to trust their judgement, and people have to deal with conclusions based on them being persuasively true rather than true beyond a shadow of a doubt.

Reality is not a court room. It's just not. There is a kind of insanity in trying to deny all of reality that doesn't meet those utterly artificial standards.

Mark W.

8 posted on 11/13/2001 1:46:38 PM PST by MarkWar
[ Post Reply | Private Reply | To 6 | View Replies]

To: MarkWar
What is the connection? the same date? that's it? That's pretty weak.
9 posted on 11/13/2001 1:54:37 PM PST by AgThorn
[ Post Reply | Private Reply | To 8 | View Replies]

To: AgThorn
Two identical dates, plus similarity of method and purpose. How much more evidence could there be at this stage? It merits further investigation.

By the way, the CDC now thinks there is an undiscovered letter, mailed before Oct. 24. This could be the hypothesized Oct. 12 letter in the article. http://www.freerepublic.com/focus/fr/570240/posts

10 posted on 11/13/2001 2:01:19 PM PST by Mitchell
[ Post Reply | Private Reply | To 9 | View Replies]

To: AgThorn
Sorry, but the "evidence" is not only weak, it is outright MISSING

This guy is so far out of his tree that it's pitiful. You see this phenomenon every time something happens on the malware front: a zillion wannabes popping up with one theory more bizarre than the next. Simply put, he's wrong. And if he had bothered to contact any of the people who knows about this stuff, he would know that he was wrong. That would probably not have deterred him from trying for some spotlight, though.

The author of Nimda is out there giving interviews and shouting for fame. Much like this dweeb.

11 posted on 11/13/2001 2:07:32 PM PST by Cachelot
[ Post Reply | Private Reply | To 6 | View Replies]

To: Mitchell; AgThorn
Sorry for the extra URL at the end (a copy-and-paste error). It's the same as the CDC link at the beginning of that paragraph.
12 posted on 11/13/2001 2:11:11 PM PST by Mitchell
[ Post Reply | Private Reply | To 10 | View Replies]

To: Cachelot
The author of Nimda is out there giving interviews and shouting for fame.

Interviews? Can you give a source for this? I've seen nothing on it.

13 posted on 11/13/2001 2:12:58 PM PST by Mitchell
[ Post Reply | Private Reply | To 11 | View Replies]

To: Mitchell
Two identical dates, plus similarity of method and purpose. How much more evidence could there be at this stage? It merits further investigation.
similarity of method, i.e. meaning they are both "mail" (snail and "e") ... Yes, and ???? Does that mean that anyone that ever drove a truck has something in common with anyone else that drove a truck? especially if they did it on the same day? ... these "connections" are weaker than weak!!

Purpose?-That's redundant to "method" ... i.e. if your purpose is to get information channels blocked, you would in effect use the information channel to do the blocking. No, this is a great model for conspiracy chasers only.

Date- I have already stated that the ONLY thing going here is the similarity of dates ... but what is that? nothing.

SANTA and SATAN have the same letters, just rearranged ... heck that's got as much "conspiracy" grounding in it as this does.

14 posted on 11/13/2001 3:17:46 PM PST by AgThorn
[ Post Reply | Private Reply | To 10 | View Replies]

To: AgThorn
SANTA and SATAN have the same letters, just rearranged...

This explains some of Christmas presents I've gotten lately....
15 posted on 11/13/2001 3:31:46 PM PST by self_evident
[ Post Reply | Private Reply | To 14 | View Replies]

To: self_evident
I can relate!! ;-)
16 posted on 11/13/2001 5:29:22 PM PST by AgThorn
[ Post Reply | Private Reply | To 15 | View Replies]

To: AgThorn
Silly speculation is fodder for mockery --except for the speculation that turns out to be true.

Who would have thought that there were Japanese spying all over numerous countries in the late 30's and early 40's, collaborating with Nazi's to boot --including a certain chap who lived for awhile in Pearl Harbor and liked to watch the ships move in and out of port?

17 posted on 11/13/2001 10:35:38 PM PST by unspun
[ Post Reply | Private Reply | To 14 | View Replies]

To: unspun
Silly speculation is fodder for mockery --except for the speculation that turns out to be true.
You got a point there. Santa could after all be Satan, and remember, you read it here first!
18 posted on 11/13/2001 10:39:05 PM PST by AgThorn
[ Post Reply | Private Reply | To 17 | View Replies]

To: AgThorn
Well, I'm not interested in getting into an argument over this. I find the coincidences intriguing, you don't; that's OK.

Unlike the run-of-the-mill conspiracy theory, this ones has testable conclusions; it's falsifiable. If it's correct, there ought to have been anthrax mailings postmarked very close to Oct. 12 and Oct. 29. (Even if such mailings turn up, I would agree that that's not definitive proof. If no such mailings turn up, however, that would be a strong argument against the theory.)

By the way, the similarity of method is much more than the fact that both used mail. Both involve using mail to send unrelated destructive payloads to unsuspecting people. (This may still not be enough to satisfy your standards for a connection, but it is more of a connection than your characterization suggests.)

Also, the similarity of purpose isn't the same as that of method. People have suggested lots of other possible rationales behind the anthrax attack (a warning from Iraq, for instance, or bin Laden aiming at the media to elicit maximum hysteria as he tries to goad us into an attack on all of the Muslim world, or possibly a test of how a biological agent would spread in the mail, or other possibilities). If this connection is true, it suggests a particular specific purpose, namely trying to disrupt or even shut down our mail and other communication systems.

Anyway, since the theory has testable conclusions, I thought it would be of interest to get it out there now, rather than after any further mailings are discovered (since at that time, people might say that the theory was tailored to fit the facts). Time will tell if it is true or false.

19 posted on 11/16/2001 1:06:33 PM PST by Mitchell
[ Post Reply | Private Reply | To 14 | View Replies]

To: Mitchell
Time will tell if it is true or false.

I conceed that for certain. I still see stronger "ties" to Afghanistan/Iraq possible collusion in this than to any Nimda connection. Then again, who's to say that Nimda doesn't have Middle-east ties as well.

There is just too little even circumstantial evidence to make any other correlation at this time. Although we can always speculate ...

20 posted on 11/16/2001 1:07:08 PM PST by AgThorn
[ Post Reply | Private Reply | To 19 | View Replies]


Navigation: use the links below to view more comments.
first 1-2021-25 next last

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
News/Activism
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson