Tesla's Security Scanner Is Hurling Exploits at a Stranger's Server
I'm being cyberattacked by Tesla, Inc
A hobbyist NTP pool operator noticed thousands of exploit requests from AWS IPs using Tesla's pool-ntp.tesla.com hostname. The traffic, likely from Assetnote scanners, includes Log4Shell and SSRF payloads. Despite emailing Tesla, the attacks continue, raising concerns that other pool members are also being targeted.
You have not caused me any harm, but you are throwing exploits at strangers' IPs.
- walrus01
Remember in 2003 when netgear hardcoded a university's NTP server into a ton of their products? Well....
https://www.google.com/search?&q=university+ntp+server+netge...
- simonjgreen
I’m pretty sure this way they’ve hardcoded the NTPs is actually against the ToS for use of the NTP pool too.
The way a vendor embedding NTP is _meant_ to do so is documented here:
https://www.ntppool.org/en/vendors.html
On another note, back when I ran a web hosting business we hosted a few NTP servers in the pool. It’s such a simple thing to give back, and worth anyone who can make a stable contribution doing so.
- darwinlee
“You must absolutely not use the default pool.ntp.org zone names as the default configuration in your application or appliance.”
- buzer
CNAME'ing pool-ntp.tesla.com to something they do not control is already quite risky as it would allow someone to e.g. request pool-ntp.tesla.com certificate though it might take quite a few tries.
- graypegg
Thankfully it doesn't seem to be much traffic, but still... weird. You'd hope at somepoint the weird responses would get looked at in some log, but I won't hold my breath for that haha.
Tangential, but I love the design of your blog. That's so freakishly accurate to old GNOME 2 Ubuntu, amazing work.
- kjs3
I'd try to contact Assetnote. Most (sadly not all) managed vuln scan companies are pretty sensitive to scanning stuff that doesn't belong to their client and could expose them to liabilities because they don't have permission.
- motbus3
Do a Tesla move and say that's a new service and they need to pay 10000 a month to keep using the service otherwise you reserve the right to mess up with the responses. :P of course, just a joke, but that's what they do
- andai
I really like this website's theme. I noticed this yesterday when using a very old iOS version: Shiny UI is morale-boosting.