FYI - my Backlight site is hammered by bots, now publishing problem

Backlight 4, 5 & 6 Support
1

I just tried to add a couple pictures to a page using TTG Publisher and I get an error “Can’t update this collection. Unable to perform action GetSetupforTemplate. The page sent an action that was not available.” Any ideas? I’m concerned because…

FYI the last few months my little static photography site has been getting hammered by bots. First major episode was last summer - I started getting nasty emails from my hosting provider about my site “using too many resources” which seemed nonsense to me since literally it’s a bunch of galleries built with Backlight and nothing else. When I went and looked at site and server info, what I saw were a whole lot of versions of ClaudeBot crawling over and over again. (small SEO consultants all seem to use the opensource Claudebot code base.) I tried a lot of things, ended up signing up for the free Cloudflare service - set up a bunch of rules, and things settled down.

Two weeks ago, I started getting nasty emails again from my hosting provider. This time it looked very different, and L2 support got on the phone with me and we figured out that the site was being repeatedly crawled by malicious bots looking for vulnerabilities. Every time they hit a block from Cloudflare or from rules I’d set up on the host, they spawned a new one. I blocked a bunch of the IP addresses with WAF rules and then watched the volume of activity stay the same - new IP addresses. (When I ran IT Ops for a major US federal agency, we battled this problem of smart bots in many different forms from foreign bad actors who periodically tried to take us down, but there’s crawler code out there for 12 year olds to download that does pretty sophisticated tricks.) Most of the malicious crawlers were coming from Microsoft Cloud hosts in Brazil, Italy, and the US; a call to a friend at MSFT Cloud Services with some info and suddenly that all stopped. I can still see (at Cloudflare) a lot of attempts to get into my site (bizarrely Brazil tops the list), but for the moment all the work has successfully stopped the madness.

Something about my little static photography site makes bad dudes think there’s an opportunity of some sort if they can just find the vulnerability, and I wonder if it’s something related to how Backlight is coded and created. The good news is, they’ve found no vulnerabilities because the site hasn’t been taken over.

I wonder if all the CloudFlare and WAF stuff is blocking TTG Publisher.

2

That sounds like a real pain. If you have good controls over your WAF could you try blocking entire countries that the traffic is coming from, assuming you’re not interested in legitimate traffic from those countries?

CDNs don’t seem to play nicely with Backlight. Some requests get cached or don’t actually reach our server when they should.

Is your original server still available over the Internet via its IP address? One solution could be to add an entry in your computer’s hosts file so that your publishing talks directly to your server without passing though Cloudflare.

1 Like
3

Thanks, Ben. I tried a country block on Brazil. Traffic level dropped and then within a few minutes the traffic was back to the same level. The bots are very bursty, there’ll be days with nothing and then there’ll be three or four hits in a single day, so experimentation is painfully slow. When I was running ops I had a couple wizards who found joy in these battles but now it’s just me.

I have noted that they seem to concentrate in a single (or two) hosting provider - when I had MSFT shut down all of the ones on their cloud, a day or two later they were coming from a German and a French cloud provider. I’ve gotten accepted into a malicious reporting organization and will be reporting them there, which feeds into the automated security services large corporations use.

I will try direct publishing, good idea; also trying whitelisting but I’ve seen notes that CloudFlare’s BotFight seems to ignore whitelists. What a pain just to be able to share my photos with friends (without putting them in the hands of Big Cloud which will use them to train AI…)