10 Events Surrounding September 11, 2001., page 3

Although secondary to the human tragedy of that day, I raise an idea balloon regarding Number 4 - "Nimbda Virus". The virus arrived almost seven days exactly to the first plane colliding. It stole into computers opened by the Code Red worm and forced administrators to later wipe the device in order to preserve its usefulness.

What can be known about that weeks electronic mayhem is minimal. It is therefore unsurprising that no definitive analyses exist on the impact of September 11 on the Internet, though a few conflicting anecdotal reports have appeared, and much has been studied about the Verizon node at and around the WTC, perhaps the busiest networked computer site on the planet.

What was code red? Code red was a malicious binary injection script that weighed 4Kb and arrived on a windows computer running NTFS and Microsoft IIS web server. It had four distinct versions that grew effectively more efficient, not at stopping the internet as everyone feared, but rather in hiding an intended purpose. What occurred in fact made available a large block of machines from which a remote operator(s) could either transmit commands to the internet or corrupt the stream of data packets running through the machine. This second effect, the rearranging or insertion of code into a data stream seems even more likely when one includes the default corrupted network affected by the worm, Cox Communication who in 2001 ran Verizon wireless services and was a major transmission pipeline for all east coast television viewing and broadcasting.

So, we know code red and Nimda were not responsible for the attacks, nor related in any direct way. We know that whatever proof that may have existed on a hard-drive affected by code-red was wiped by Nimbda's havoc and administrators following best-practice advise.

Who ran these scripts? Where from? Why were they so specific in the attacks: not just on ANY Windows un-patched box, but later Code.red.c and .d appeared, and as the worm morphed, it opened a backdoor and allowed for attack remotely triggered by a trojan. AN .exe deposit created an "always on" computers that Cisco and Verizon and the major media centres used for their border routers and their internal media switching devices. Code red produced no culprits- there was no embezzlement, larceny or swindle. Just opened up specific systems to a remote operator, then seven days later....zzzzzt.

So, if you know that a major story is going to break, and that the flow of information must be controlled, what stronger way to do a control run that by having a single "Man in the middle" switch with the ability to sabotage or process which feeds go live successfully?

Its a bit of a smoking gun, no?