Russian cyberwarfare attacks on Ukraine are constantly in the news. While you don’t hear as much about internet-based attacks on Russia, this cyberwar is not a one-sided affair. Important Russian military sites have been subject to Distributed Denial of Service (DDoS) attacks, as have major Russian banks. Defenders of Russian internet infrastructure have taken measures to fend off these attacks, and one of those measures has resulted in some rather odd error messages. First, some background.
What Is a DDoS Attack?
Denial of service is a simple concept and works both in real life and online. A schoolkid might prank the local deli by calling over and over to make weird requests. A smart salami slicer could block the caller’s number, or just ignore calls from that number. And a smart kid could keep the prank rolling by enlisting friends to call, so the phone never stops ringing. That smart kid has just invented the Distributed Denial of Service attack.
In internet terms, a denial of service attack isn’t much different. The attacker hammers a server with requests, typically using message types that require some processing by the server. The server’s logical response is to block the attacker’s IP address. One way around that defense is to get a bot-type malware program installed on thousands of unsuspecting computers. When the bot army is ready, the bot-herder unleashes those infected computers on the target server, bombarding it with data requests from myriad sources. This kind of attack is a lot harder to block.
Defense Against the DDoS Arts
The poor beleaguered delicatessen proprietor could get some relief by setting the phone to only ring for known customers, though that would put a damper on new business. New customers aren’t a problem for Russian internet mavens. They simply configure servers to reject requests coming from outside Russia’s sphere of influence. This technique is sometimes called geofencing, not to be confused with the geofencing in parental control software that warns parents when kids wander.
Geofencing works. DDoS attacks against the important mil.ru website run up against it and simply fail. It’s true that by using a VPN attackers could make themselves seem to be in Russia, but it’s not practical. First, Russia constantly works to block technologies that evade censorship, such as the TOR network and VPNs. And most VPN companies don’t dare maintain servers within Russia. Second, the attackers can’t install and configure a VPN client on all of the PCs infected by their bots.
Does the Bear Have a Sense of Humor?
Presuming that Russian maintains its geofencing defenses, you can see them for yourself by trying to visit mil.ru. You’ll get a warning that “This page isn’t working” with the error code 418.
If you’ve spent much time surfing the web, you’ve probably encountered quite a few errors. The 404 Not Found error is probably the most common, enough so that it has spawned endless memes. 403 Forbidden is less common, but plentiful enough. But whoever heard of error 418?
As it turns out, this error is a joke, an April Fools’ prank from 1998. Its full name is “Error 418–I’m a Teapot.” The error is part of the fictitious Hyper Text Coffee Pot Control Protocol, and is meant to be returned when an internet-aware teapot receives an HTCPCP request to brew coffee. The protocol specifies that “the resulting entity body ‘may be short and stout.’” According to Mozilla’s web documentation, “Some websites use this response for requests they do not wish to handle.”
Who decided to use error 418 instead of the more logical (and less amusing) 403 Forbidden? We’ll probably never know, but I picture a technician somewhere chuckling over a nice glass of чай с желе (tea with jelly). Anonymity is for the best—it’s not entirely clear that the upper echelons of the Russian administration would approve. For now, it’s just one small bit of humor in a totally non-humorous situation.
