Web Site Security - Bot Traps

by Scott Allen

Web site security becomes a bigger issue every day. One of my good friends and colleagues runs a web hosting company. The other day, one of his main servers got hacked, and a lot of sites went down. It was a tremendous nuisance, and took a lot of work to fix. These hackers were pretty good. Unfortunately, hackers, data miners, and spammers also use what we call Malicious Bots - a growing problem on the internet. To increase the security of my web sites, I routinely put Bot Traps on my sites. (For detailed info see earlier post.)

If you’re not familiar with a Bot Trap (also known as a spider trap or honeypot), I’ll give you a quick rundown. Web programs that autonomously cruise through web sites are called ‘Bots‘ - short for ‘Robots’ because they behave according to pre-programmed algorithms like mechanical robots and ‘Robots’ sounds cooler than ‘Programs’. The most common type are Search Engine Spiders which gather information about your site in order to decide what it’s rankings should be in that Search Engine. There are malicious bots (and botnets) that you want to block, of the following types: 1) spambots that harvest email addresses from your contact forms or guestbook pages; 2) downloader programs that suck your bandwidth by downloading your entire site; 3) programs that are out on the web looking for copyright infringements so they can sue people; 4) viruses & worms; 5) data mining programs; 6) hackers; 7) DDOS attacks, etc. My bot traps catch several bots a day, and ban their IP address.

If you’ve never built a bot trap before, I highly recommend you start here:

If you’re really serious about stopping spammers and spambots, join project honeypot.

For more info, read these blogs by other bot-fighters:

IncrediBILL — IncrediBILL is the master bot-fighter. You’ll find a lot of info here, plus some entertaining rants. (He’s invented a super-secret bot-fighting weapon….but shhhh, we can’t talk about that yet.)
A Daily Rant — Will documents his daily battle against bots. You can find some great info here.
SpamHuntress — She’s on a mission to end spam. Watch out, spammers!

Tags:
web site security | bot traps | webgeek