The Boston Diaries

The ongoing saga of a programmer who doesn't live in Boston, nor does he even like Boston, but yet named his weblog/journal “The Boston Diaries.”

Go figure.

Sunday, May 12, 2019

I wonder what they think they're attacking?

In addition to a self written gopher server I also have a QOTD server accepting requests via TCP and UDP. I never mentioned it as I just put it out there to really see what would happen. I will occasionally see a request go by, but over the past two weeks, some people have really been hitting it hard via UDP:

Requests to the UDP QOTD server (over 1000 requests)
host address requests
host address requests 252628 18547 11529 11400 9917 9373 8689 8261 8098 7575 5745 5566 5520 5278 5084 5067 5066 5024 4449 4325 4200 4137 3638 3440 3402 3219 3167 3166 3161 3154 3139 3137 3090 2971 2944 2758 2756 2492 2290 2258 2226 2183 2090 2047 2037 1997 1985 1950 1915 1781 1118 1095

There doesn't see to be much I can find about this, other than a potential link to XBox Live, but that doesn't seem right. It's hard to say. So to see what might be happening, I modified the QOTD program to record anything it receives via UDP. That way, I should be able to figure out if is trying to attack something, or if it really just wants an up-to-date quotes file.

Experimental headers are no longer experimental

On the Lua Users email list the topic of custom email headers came up. Back in the early days, RFC-822 stated that:

Any field which is defined in a document published as a formal extension to this specification; none will have names beginning with the string "X-" …


This also applies to headers starting with “x-” as Internet based text headers are case-insensitive.

Now given that RFC-822 has been obsoleted by RFC-2822 and RFC-5233 I thought I would check those out as well:

Fields may appear in messages that are otherwise unspecified in this document. They MUST conform to the syntax of an optional- field. This is a field name, made up of the printable US-ASCII characters except SP and colon, followed by a colon, followed by any text that conforms to the unstructured syntax.

The field names of any optional field MUST NOT be identical to any field name specified elsewhere in this document.

RFC-5322: Internet Message Format

Hmm … nothing about “X-”. I replied that starting a non-standard header with “X-” was still a safe way to go, only for Cu nningham's Law to kick into effect:

Lua mailing list <>
Re: Adding another way to point to "levels" to debug.getinfo and friends
Mon, 13 May 2019 11:55:07 +1000

On Mon, 13 May 2019 at 09:03, Sean Conner <> wrote:

In other RFC documents (too many to mention) private or experimental fields are usually labeled with "X-" (or "x-") so your best bet is to create a header name starting with "X-" to be safe.

Please stop using the X- prefix! See RFC 6648:

This document generalizes from the experience of the email and SIP communities by doing the following:

1. Deprecates the "X-" convention for newly defined parameters in application protocols, including new parameters for established protocols. This change applies even where the "X-" convention was only implicit, and not explicitly provided, such as was done for email in [RFC822].

Interesting. The “X-” standard for non-standard headers was to allow for experimentation without fear of conflicting with other headers, but the process of converting such headers to a standard header prove problematic. But RFC-6648 does cover the case when one doesn't want to standardize a header (or parameter):

… In rare cases, truly experimental parameters could be given meaningless names such as nonsense words, the output of a hash function, or Universally Unique Identifiers (UUIDs) [RFC4122].

RFC-6648: Deprecating the "X-" Prefix and Similar Constructs in Application Protocols

What a wild idea!

Monday, May 13, 2019

They aren't attacking, they're being attacked

So that list of IP addresses I listed yesterday … it turns out they weren't the attackers, but the victims! And I was unwittingly helping to facilitate a DDoS amplification attack.


When we left off yesterday, I had modified my QOTD server to log the IP address, port number, and the incoming UDP packet to help figure out what the heck was going on. So pretty much off the bat, I'm seeing this (which goes on for nearly 4,000 entries):      "\001"      "\001"     "\001"      "\001"      "\001"     "\001"      "\001"      "\001"     "\001"

What had me puzzled are the ports—I wasn't familar with them. It may be that port 6951 deals with online transaction processing, port 7333 seems to have something to do with the Swiss Exchange, and nothing at all about port 37152. It's not exactly looking good, but the ports being attacked are rather all over the place (I'm only going to list two of the attacked IP addresses—there are more though):

Ports being attacked
host address port number requests
host address port number requests 10947 1508 11860 1425 14485 1420 65033 1418 4625 1409 4808 1401 37152 1400 65277 1394 27683 1389 17615 1389 48235 1388 27227 1386 14503 1386 43174 1385 43069 1377 47040 1372 6991 1370 18235 1369 57696 1360 7333 1233 6951 1204 36965 1171 16306 1139 47673 145 39606 144 48309 142 46769 142 59669 142 35763 142 22100 141 4302 140 53336 140 35758 138 44529 138 26878 138 52337 138

A lot of the ports are high values, which tend not to have defined services and are typically used for outbound requests to a service, like making a request to a QOTD service.

The data being sent is just a single byte, which is all that's really needed for the QOTD protocol to return a quote via UDP. So this looks like legitimate traffic, except for the volume.

But as I kept searching for “QOTD attacks” I kept coming across UDP amplification attacks (more of the same). It appears that the vast majority of traffic is forged (it's easy enough to forge UDP packets), and because QOTD sends more data than it receives, it's a rather cheap method to attack a target with a ton of traffic regardless of what the attacked machine is being used for (and my UDP based server probably isn't the only one unwittingly facilitating this attack).

A bit more research revealed a few servers that made a request (or a very small number of requests):

Requests to the UDP QOTD server
host address requests first request
host address requests first request 2 May 03 4 May 04 1 May 04 1 May 05 1 May 06 1 May 06 1 May 07 2 May 07 1 May 08 1 May 10 1 May 10

I'm guessing these machines made the query to see if my machine could be used for a UDP DDoS amplification attack, and would periodically check back to see if such attacks could continue from my server, which would explain the periodic nature of the deluge of traffic I saw (they weren't continuous but would happen in very random bursts). I also suspect there may be two different groups doing an attack, given the volume of traffic to certain targets.

It was also amusing to see attempt to spam me with email, and attempt to log in via ssh on the 7TH as well.

I've since disabled the UDP protocol on my QOTD server. Sigh. This is why we can't have nice things on the Intarwebs.

“If you strike me down, I shall become more powerful than you can possibly imagine”

Of all the lightsaber duels in the Star Wars movies, the one in “Star Wars: Episode IV—A New Hope is probably the most sedate. But that's okay, because in 1977 this is the first time we're seeing freaking lightsabers! So cool! And it blew my 8-year old mind at the time.

But this reimagining of that fight? (link via Kirk Israel)

[Do you know just how painful it is to fall into a lava pit?  Do you?]

Had I seen that as an 8-year old, my head would have exploded!

Friday, May 24, 2019

Notes on an overheard conversation at a doctor's office

“Take a seat right over there.”


“Which arm?”

“It doesn't matter—it's hard either way.”

“Other phlebotomists have had problems finding a vein?”

“No, it's hard on me!


“I can't stand needles.”

“Oh, it's not going to hurt.”

“That's what they all say.”

“Now, now …”


“That was just the alcohol wipe!”

“You could have warned me!”

Why me?


“I was just uncapping the syringe.”

“Oh god … ”

“Are we ready?”


“You do realize we've soundproofed the room, so screaming won't help any.”

“How much longer?”


How much longer? Aaa­aaaa­aaa! The horror! The horror!”

“Aaaaand—we're done! That wasn't so bad, was it?”

“The blade is sharp … Lucky … my heart only skips one beat …”

“What are you, twelve?”

“… blacked out … can't afford that …”

“Would you like a lollypop?”


Obligatory Picture

[The future's so bright, I gotta wear shades]

Obligatory Contact Info

Obligatory Feeds

Obligatory Links

Obligatory Miscellaneous

You have my permission to link freely to any entry here. Go ahead, I won't bite. I promise.

The dates are the permanent links to that day's entries (or entry, if there is only one entry). The titles are the permanent links to that entry only. The format for the links are simple: Start with the base link for this site:, then add the date you are interested in, say 2000/08/01, so that would make the final URL:

You can also specify the entire month by leaving off the day portion. You can even select an arbitrary portion of time.

You may also note subtle shading of the links and that's intentional: the “closer” the link is (relative to the page) the “brighter” it appears. It's an experiment in using color shading to denote the distance a link is from here. If you don't notice it, don't worry; it's not all that important.

It is assumed that every brand name, slogan, corporate name, symbol, design element, et cetera mentioned in these pages is a protected and/or trademarked entity, the sole property of its owner(s), and acknowledgement of this status is implied.

Copyright © 1999-2024 by Sean Conner. All Rights Reserved.