Yet another Hacker News

214 points robinpie 1 hour ago 51 comments

fred_is_fred 47 minutes ago | parent

I'd report this to AWS instead since Tesla doesn't seem aware. It's AWS IPs as the source.

nullpoint420 37 minutes ago | parent

Yeah it looks like someone thinks they're "hacking" Tesla when really it's hitting volunteer IPs.

ameliaquining 15 minutes ago | parent

I might try Searchlight Cyber first (it's their service doing this, presumably without their knowledge), and then if that doesn't work go to AWS.

richwater 47 minutes ago | parent

I would assume the fastest way to actually make this stop would be to setup a bunch of honeypot exploits, trigger their detection and someone will figure out what they did wrong.

Other than not, with these huge companies you have 0 recourse.

robinpie 46 minutes ago | parent

(OOP here). I wonder if switching my replies from 299 to 200 OK would be enough for some of them.

adzm 43 minutes ago | parent

I came here to suggest the same thing. It should light up on the dashboards iirc.

Joel_Mckay 10 minutes ago | parent

Unlikely, but the lazy wonks could enable stratum 1 time services with the cars GPS/cellular receiver and RTC. Having done that for equipment in the past, we all know it is literary only $8.43/unit in parts. Also, setting ntp time as the tertiary fall back has been around for over a decade. =3

slau 42 minutes ago | parent

I actually think this is brilliant. Let the scanner IP get access to the most unpatched Wordpress, maybe even generate some garbage ERP numbers.

Once the asset scanner detects the vulns, everyone will kick into high gear to patch this.

robotmay 19 minutes ago | parent

I did something like this a few weeks ago on my photography site: https://robertmay.photography/journal/meta-has-tried-to-scra...

Meta not only hasn't noticed, but is currently sending about 11 requests per second to my site. I've also seemingly trapped one of those TV proxy scraper nets as I'm getting absolutely hammered by requests from all over the place now. I get maybe 10 legit visitors per day, and I'm currently blocking 406,787 IPs from things that have fallen into my honeypot.

I've tweaked my site to return empty status responses a configurable amount of time but the traffic has been so intense that Traefik is now struggling, so I'm going to have to figure out something else. I was returning over-capacity errors and I think that was a mistake, I've swapped to 400 range status codes now. I don't want to use Cloudflare so I'm not sure what to do after this.

The people at these companies are either incompetent or malicious.

Joel_Mckay 15 minutes ago | parent

Often, the folks you want to ban are not the hosts running the scans.

One's best bet is to play possum, and use your clients last login IPs falling in your service area geo-IP ranges for a firewall white-list. Then redirect the other traffic for a black hole route.

If the nuisance hosts assume they have driven the host offline, they will eventually give up and move on. =3

tekla 46 minutes ago | parent

In case of the very likely title only reader posting:

> Speculation: Assetnote pulled in everything it could find under tesla.com, including pool-ntp.tesla.com, which CNAMEs to pool.ntp.org, which can resolve to my machine — 67.215.249.229. The asset inventory saves this as a Tesla asset, and starts throwing exploits at me, a stranger.

> Not a vuln in Tesla, and I'm not asking for anything, but I just wanted to let you know that you may unintentionally be being a nuisance.

walrus01 45 minutes ago | parent

Remember in 2003 when netgear hardcoded a university's NTP server into a ton of their products? Well....

https://www.google.com/search?&q=university+ntp+server+netge...

https://pages.cs.wisc.edu/~plonka/netgear-sntp/

VladVladikoff 45 minutes ago | parent

> rg -zFI pool-ntp.tesla.com access.log*

Neat! Didn’t know about this command that’s very helpful

londons_explore 43 minutes ago | parent

> it has received ~8,000 requests from two of your scanning hosts

If it were 8000 requests per second, this might be worthy of some investigation.

But 8000 ntp requests alone consume far less than 1 us cent of compute + bandwidth. This isn't worth lifting a finger over.

walrus01 41 minutes ago | parent

Please read the article, it's not the volume of the NTP requests, they're actively sending exploit/attempt to compromise payloads. They're probing things in a way that you would ordinarily only do to your own internal infrastructure.

"They tried all kinds of exploits against me: path traversal, webshell uploads, probing software internals, probing WordPress and other CMS management endpoints, SSRF, Log4Shell, and a lot more."

hackernudes 35 minutes ago | parent

If you host a webserver on the internet it is normal to receive that kind of traffic all the time. Source: I host a server on my Comcast connection.

robinpie 33 minutes ago | parent

Oh absolutely, I just think the specific nature of this (legitimate commercial vuln scanner thinks I'm Tesla) is funny

walrus01 25 minutes ago | parent

I don't disagree with you, I have tons of things that have public interfaces (as mundane as a fully patched wordpress where the wp-admin login is accessible to external blog writers), we get tens of thousands of random shit anything per day. But the problem here is that Tesla is treating NTP pool operators like they are their internal infrastructure. Also because the attribution of the 'attacks' is fairly well known.

I don't go complaining on the internet about the absolute shitflood of compromised routers on broadband ISPs in Indonesia probing my stuff 24x7x365 because I know it would be futile. But if I found one specific american company that was repeatedly probing my stuff all the time? Maybe I'd escalate it.

lukan 25 minutes ago | parent

But it shouldn't be normal, that a car company tries to automatically hack private servers.

robinpie 39 minutes ago | parent

It's HTTP requests, not NTP requests, and the volume isn't the problem, it's that Assetnote is sending live exploit payloads /at all/ to a stranger on Tesla's behalf

SadTrombone 39 minutes ago | parent

It's not 8000 requests. It's 8000 attempts to exploit various software on OP's server.

iamjackg 15 minutes ago | parent

Isn't this technically a crime, since they're actively attempting to access a computer system they don't own?

iAMkenough 10 minutes ago | parent

In today’s world, a crime is only a crime if you get charged. Tesla has enough power to not get charged.

NotWhatUThink 41 minutes ago | parent

> They tried all kinds of exploits against me ... probing WordPress and other CMS management endpoints

This is standard bot crawler traffic. Anyone who runs a home server sees attempts to load wp paths all the time

robinpie 33 minutes ago | parent

Oh absolutely, I just think the specific nature of this (legitimate commercial vuln scanner thinks I'm Tesla) is funny

simonjgreen 40 minutes ago | parent

I’m pretty sure this way they’ve hardcoded the NTPs is actually against the ToS for use of the NTP pool too.

The way a vendor embedding NTP is _meant_ to do so is documented here: https://www.ntppool.org/en/vendors.html

On another note, back when I ran a web hosting business we hosted a few NTP servers in the pool. It’s such a simple thing to give back, and worth anyone who can make a stable contribution doing so.

robinpie 39 minutes ago | parent

Yes, they should absolutely be using a vendor zone instead of a CNAME under tesla.com.

jameshilliard 32 minutes ago | parent

> The way a vendor embedding NTP is _meant_ to do so is documented here: https://www.ntppool.org/en/vendors.html

Note that in the past I've had companies writing embedded linux based firmware using ntppool for time sync request their own vendor zones, however a lot of those requests were ignored so it's unclear if that's still expected. In the end they ended up just using the default ntppool domains since they never got their own vendor zones.

Aurornis 8 minutes ago | parent

I remember going through the same thing. No response. This was a long time ago, though.

buzer 38 minutes ago | parent

CNAME'ing pool-ntp.tesla.com to something they do not control is already quite risky as it would allow someone to e.g. request pool-ntp.tesla.com certificate though it might take quite a few tries.

robinpie 34 minutes ago | parent

I thought about trying this, but MPIC makes it very very very difficult (the round-robin has some geolocation magic baked in regarding what server it connects you to).

ratorx 26 minutes ago | parent

Out of curiosity, how is MPIC relevant? Not that familiar with it, but CNAME would resolve to your server regardless no?

robinpie 24 minutes ago | parent

pool-ntp.tesla.com --CNAME--> pool.ntp.org --GeoDNS--> thousands of possible servers, biased heavily by user location

ratorx 22 minutes ago | parent

Oops should have RTFA before commenting, I thought the CNAME was only to your servers.

sippingabonedry 23 minutes ago | parent

Wouldn't the same apply to pool.ntp.org then?

Maybe running a web server on the same IP as an NTP server is a bad idea.

Polizeiposaune 19 minutes ago | parent

a .tesla.com certificate might well enable more shenanigans than a .pool.ntp.org cert.

sippingabonedry 14 minutes ago | parent

That seems to be a glaring hole in the modern-day automated web PKI, not Tesla's dangling DNS record.

Hell, they issue certificates to IP addresses now. For cloud systems, ownership of an IP could be a few hours.

This has almost certainly been deemed an acceptable risk.

graypegg 38 minutes ago | parent

Thankfully it doesn't seem to be much traffic, but still... weird. You'd hope at somepoint the weird responses would get looked at in some log, but I won't hold my breath for that haha.

Tangential, but I love the design of your blog. That's so freakishly accurate to old GNOME 2 Ubuntu, amazing work.

andai 36 minutes ago | parent

I really like this website's theme. I noticed this yesterday when using a very old iOS version: Shiny UI is morale-boosting.

sippingabonedry 31 minutes ago | parent

This seems like a gross exaggeration.

This happens EVERY day to EVERY web server out there. I have a personal site that gets thousands of requests per day from bots.

Running a public server (like NTP) means you will get tons of strange requests. Moreso if you run a web server on the same IP because bots will scrape certificate transparency logs. The entire IPv4 space is scanned continuously.

This may sound harsh, but you cannot stop it. It is whack-a-mole. Filter it and move on, go outside and touch grass, seriously. This is not worth being upset over.

I treat these as an opportunity to tune my filters and firewall rules.

robinpie 23 minutes ago | parent

I'm aware how much crap there is on the Internet, I just think the specific nature of this (legitimate commercial vuln scanner thinks I'm Tesla) is funny

sippingabonedry 18 minutes ago | parent

It does bring attention to: how many other organizations are doing this?

Tesla is a large enterprise.

They almost certainly subscribe to some overpriced SaaS garbage which is manned by offshore drones who by definition do not care because they're not paid enough to care.

Unfortunately this isn't the 80s anymore where you can ring up a system administrator at a university and get a human on the other end.

That said: cool looking website btw.

MBCook 18 minutes ago | parent

You don’t think there’s a difference between “hackers try to attack everything“ and “Tesla decided that I personally need to be tested as one of their systems due to a lazy misconfiguration“ are different?

sippingabonedry 10 minutes ago | parent

Are you asking if I think Elon had this person's website on an 80" screen in a conference room whilst they collude how to send traffic to their site?

No, I do not.

I get thousands of these "security scanner" requests on a low-traffic site weekly if not daily.

I would have added the IP addresses to my firewall's Io blacklist and forgotten about it the next day. It's really all you can do.

consensus1 20 minutes ago | parent

Is this basically a free pen test, or am I misunderstanding the setup?

darwinlee 19 minutes ago | parent

“You must absolutely not use the default pool.ntp.org zone names as the default configuration in your application or appliance.”

ref: https://www.ntppool.org/en/vendors.html

caaqil 13 minutes ago | parent

Huh, are we sure this is just NTP shenanigans and not some super duper dangerous AI agents "escaping" the "containment"?