News: 1713180608

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

Feline firewall woke developer to declaw DDoS disaster

(2024/04/15)


A developer named Danny Guo has shared a story of the time his cat alerted him to a DDoS attack.

In a [1]post on his personal site, Guo revealed that he once worked at a startup that was yet to develop a formal on-call rotation.

He also revealed that his cat would occasionally groom his hair. "She did it occasionally, and I optimistically took it as a sign that she actually liked me and didn't just tolerate me."

[2]

But the cat didn't usually do this sort of thing at 3am. Which it did on the day of the DDoS.

[3]

[4]

"In nine years, that was the only time she did it while I was sleeping."

The grooming woke Guo, who rolled over and picked up his phone to check the time – and found "an AWS CloudWatch alert had gone off a couple minutes ago because of unhealthy targets for our load balancer."

[5]

Guo tried to visit his company's website and found it did not load.

"I groaned and went to log onto my work laptop," he wrote, and found "a massive number of requests coming from many IP addresses that were associated with different countries."

This was odd because his then-employer only made its products available in the United States.

[6]

All that traffic from elsewhere was a DDoS.

Guo tried to fix it.

"My first and not great thought was to block IP addresses at the server level, which would have been tedious and possibly ineffective if the attacker had significantly more source IP addresses to use," Guo wrote. "But then I remembered that we had already set up AWS Web Application Firewall."

He created a rule to block requests from countries other than the US, and an hour later the DDoS traffic had all been deflected, the website he worked on became available, and the foreign traffic tailed off.

[7]'Chemical cat' on the loose in Japanese city

[8]NASA makes purrrr-fect deep space transmission of cat vid

[9]US nuke reactor lab hit by 'gay furry hackers' demanding cat-human mutants

[10]Cat accused of wiping US Veteran Affairs server info after jumping on keyboard

Guo thinks he found the source of the attack – an email sent to a customer support inbox that landed at about the same time as the DDoS started.

"With horrible grammar, the sender claimed to have found a vulnerability with our website that crashed Apache, which we didn't even use," Guo wrote. "They said they stopped all traffic to our website and could keep it that way for months" – for the very reasonable price of $5,000 in Bitcoin.

"We didn't reply, though in retrospect, it could have been fun to try to troll them," he wrote.

To this day, Guo isn't sure why his cat decided to wake him on that night.

"You might guess that the AWS alert caused my phone to vibrate or make a sound, waking my cat up first," he wrote.

If that's your guess, you're wrong. Guo keeps his phone in do not disturb mode during the night.

"I just like to think that somehow, she sensed something was wrong that couldn't wait until the morning. It was certainly a more pleasant way to be woken up than by a blaring PagerDuty alarm." ®

Get our [11]Tech Resources



[1] https://www.dannyguo.com/blog/my-cat-alerted-me-to-a-ddos-attack

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Zh1PGx@phGuNz-et-5bq7AAAANg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zh1PGx@phGuNz-et-5bq7AAAANg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Zh1PGx@phGuNz-et-5bq7AAAANg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zh1PGx@phGuNz-et-5bq7AAAANg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Zh1PGx@phGuNz-et-5bq7AAAANg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[7] https://www.theregister.com/2024/03/13/cat_chemical_vat_japan/

[8] https://www.theregister.com/2023/12/20/nasa_psyche_cat_video/

[9] https://www.theregister.com/2023/11/22/nuclear_lab_hacked/

[10] https://www.theregister.com/2023/10/05/hospital_cat_incident/

[11] https://whitepapers.theregister.com/



But pager duty has great tones

John Robson

"The server's on fire...."

"It's your fault, it's your fault, are you gonna fix it, are you gonna fix it...."

Inventor of the Marmite Laser

I felt a disturbance in the Force, as if thousands of souls cried out in terror.

Martin Summers

It was obviously feline a disturbance in the force.

Cat's mind

John Miles

Magic box that slave seems to think of even above me has made a noise, probably set to remind him to feed me and he's missed it - try waking him gently so he remembers to feed me.

Alternative - drat magic box woke him from my mind control experiments, though I'm losing faith there is a mind to control.

Vardøgr

Bebu

《"You might guess that the AWS alert caused my phone to vibrate or make a sound, waking my cat up first," he wrote.

If that's your guess, you're wrong. Guo keeps his phone in do not disturb mode during the night.》

Years ago when used to have a FM radio/wireless on my desk and cell phone next to it, I noticed that a good 10 to 15 seconds before the phone actually rang (same for sms/text) the radio would experience a distinct sort of background static or interference (even if it was on silent or vibrate.) Same static could be heard on the POTS landline if I was using it at the time.

I never could work out what was actually happening there. Was pre 4G so possiblly 3G or GSM/2G and I also subsequently upgraded to a DAB+ digital radio which never exhibited this effect.

More than once I have had some bemused users in my office when I have reached for the phone well before it rang. :)

A BOFH with apparent omniscience inspires best behaviour all round. :)

So I wonder if the cat heard this vardøgr signal from some high (audio) frequency from the phone or from a nearby clock radio etc. I also notice the screen normally activates even when on silent. Of course moggies are evil buggers on their own account at the best of times...

Re: Vardøgr

heyrick

" when I have reached for the phone well before it rang. :) "

That's the old GSM/GPRS signal interfering with things. Like "duuuh duh-duh duh-duh duh-duh duuuuh", yes?

I've done the same thing, by hearing that and knowing somebody was in the process of trying to call me.

I think you were hearing this on older phones because 2G uses amplitude modulation for low bandwidth data, like text messages and "are you there?" requests, and that coupled with the frequencies in use would induce interference in unshielded cabling (like to speakers); but this is a dim and distant memory so take with a heft of salt.

Re: Vardøgr

Arthur the cat

"when I have reached for the phone well before it rang. :)"

That's the old GSM/GPRS signal interfering with things. Like "duuuh duh-duh duh-duh duh-duh duuuuh", yes?

BT,DT. I also used to use a Psion 3 as an alarm clock, and that would make the radio sound like an arcade game laser firing as the Psion woke up for the alarm.

Re: Vardøgr

My other car WAS an IAV Stryker

That noise... from the conference room Polycom phones circa 2005-2007 during teleconferences (especially when calling into WebEx) when I first started my "career" job back at Styker/Abrams HQ. Everyone was told to turn their cell phones OFF -- not just "silent" -- for meetings. (As cell phones evolved and old models were retired, it got better. The older Polycoms were eventually replaced also.)

Re: Vardøgr

I could be a dog really

Yes, when digital mobile came along, the signals caused a lot of interference on inadequately screened electronics - like pretty well anything not built to "if you have to ask, you can't afford it" standards.

You could hear this as an occasional chirp as the phone and network would check in to keep the connection up to date. But as described, once a call is being made, there's an exchange of information between network and phone before the phone alerts the user to the call - and this mass of data causes the described interference.

Re: Vardøgr

John Miles

What you were hearing from FM radio was the pulses of signal the phone uses for talking to the tower, these will be picked up by the audio circuits and amplified - giving the noise you expect. Phone signal strength has reduced as technology improves and new radios are better designed to reject the noise

Cat's hear frequencies well above humans - it is likely when screen switches on it will make noise the cat hears we don't or may just be the light flashing

Re: Vardøgr

Spazturtle

If you put your phone next to a microphone and then run something demanding on it the microphone will pick up the high pitched noise the CPU makes at higher clock speeds. Cat might have heard the noise from the phone clocking up when it received the push notification.

Re: Vardøgr

GlenP

In my occasional forays into managing presentations and talks there was always one absolute rule - turn phones off in the vicinity of audio equipment, especially if they're Nokias! I don't now if Nokia were worse than others or were just fairly ubiquitous at the time but the sound was distinctive. I can well believe a feline would pick up signals from a mobile even in DnD mode.

On the other hand I once woke up because a monitoring email did not come through! There are a couple of system email overnight from processing systems and on one occasion the batch process failed so the email wasn't sent. I woke up at around 2am and was able to sort the problem before anyone noticed.

A formal parsing algorithm should not always be used.
-- D. Gries