Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I'm being cyberattacked by Tesla, Inc

dreamstation.systems

Post reply on HN
Print view View original

21–30 of 127 posts

Re: I'm being cyberattacked by Tesla, Inc

#21

Post by hackernudes »

walrus01 wrote: post #11
londons_explore wrote: post #8

> it has received ~8,000 requests from two of your scanning hosts If it were 8000 requests per second , this might be worthy of some investigation. But 8000 ntp requests alone consume far less than 1 us cent of compute + bandwidth. This isn't worth lifting a finger over.

Please read the article, it's not the volume of the NTP requests, they're actively sending exploit/attempt to compromise payloads. They're probing things in a way that you would ordinarily only do to your own internal infrastructure. "They tried all kinds of exploits against me: path traversal, webshell uploads, probing software internals, probing WordPress and other CMS management endpoints, SSRF, Log4Shell, and a l…

If you host a webserver on the internet it is normal to receive that kind of traffic all the time. Source: I host a server on my Comcast connection.

Re: I'm being cyberattacked by Tesla, Inc

#22

Post by robinpie »

buzer wrote: post #17

CNAME'ing pool-ntp.tesla.com to something they do not control is already quite risky as it would allow someone to e.g. request pool-ntp.tesla.com certificate though it might take quite a few tries.

I thought about trying this, but MPIC makes it very very very difficult (the round-robin has some geolocation magic baked in regarding what server it connects you to).

Re: I'm being cyberattacked by Tesla, Inc

#23

Post by robinpie »

hackernudes wrote: post #21
walrus01 wrote: post #11

Earlier quoted context omitted.

Please read the article, it's not the volume of the NTP requests, they're actively sending exploit/attempt to compromise payloads. They're probing things in a way that you would ordinarily only do to your own internal infrastructure. "They tried all kinds of exploits against me: path traversal, webshell uploads, probing software internals, probing WordPress and other CMS management endpoints, SSRF, Log4Shell, and a l…

If you host a webserver on the internet it is normal to receive that kind of traffic all the time. Source: I host a server on my Comcast connection.

Oh absolutely, I just think the specific nature of this (legitimate commercial vuln scanner thinks I'm Tesla) is funny

Re: I'm being cyberattacked by Tesla, Inc

#24

Post by robinpie »

NotWhatUThink wrote: post #12

> They tried all kinds of exploits against me ... probing WordPress and other CMS management endpoints This is standard bot crawler traffic. Anyone who runs a home server sees attempts to load wp paths all the time

Oh absolutely, I just think the specific nature of this (legitimate commercial vuln scanner thinks I'm Tesla) is funny

Re: I'm being cyberattacked by Tesla, Inc

#25

Post by jameshilliard »

simonjgreen wrote: post #13

I’m pretty sure this way they’ve hardcoded the NTPs is actually against the ToS for use of the NTP pool too. The way a vendor embedding NTP is _meant_ to do so is documented here: https://www.ntppool.org/en/vendors.html On another note, back when I ran a web hosting business we hosted a few NTP servers in the pool. It’s such a simple thing to give back, and worth anyone who can make a stable contribution doing so.

> The way a vendor embedding NTP is _meant_ to do so is documented here: https://www.ntppool.org/en/vendors.html

Note that in the past I've had companies writing embedded linux based firmware using ntppool for time sync request their own vendor zones, however a lot of those requests were ignored so it's unclear if that's still expected. In the end they ended up just using the default ntppool domains since they never got their own vendor zones.

Re: I'm being cyberattacked by Tesla, Inc

#26

Post by sippingabonedry »

This seems like a gross exaggeration.

This happens EVERY day to EVERY web server out there. I have a personal site that gets thousands of requests per day from bots.

Running a public server (like NTP) means you will get tons of strange requests. Moreso if you run a web server on the same IP because bots will scrape certificate transparency logs. The entire IPv4 space is scanned continuously.

This may sound harsh, but you cannot stop it. It is whack-a-mole. Filter it and move on, go outside and touch grass, seriously. This is not worth being upset over.

I treat these as an opportunity to tune my filters and firewall rules.

Re: I'm being cyberattacked by Tesla, Inc

#27

Post by ratorx »

robinpie wrote: post #22
buzer wrote: post #17

CNAME'ing pool-ntp.tesla.com to something they do not control is already quite risky as it would allow someone to e.g. request pool-ntp.tesla.com certificate though it might take quite a few tries.

I thought about trying this, but MPIC makes it very very very difficult (the round-robin has some geolocation magic baked in regarding what server it connects you to).

Out of curiosity, how is MPIC relevant? Not that familiar with it, but CNAME would resolve to your server regardless no?

Re: I'm being cyberattacked by Tesla, Inc

#28

Post by walrus01 »

hackernudes wrote: post #21
walrus01 wrote: post #11

Earlier quoted context omitted.

Please read the article, it's not the volume of the NTP requests, they're actively sending exploit/attempt to compromise payloads. They're probing things in a way that you would ordinarily only do to your own internal infrastructure. "They tried all kinds of exploits against me: path traversal, webshell uploads, probing software internals, probing WordPress and other CMS management endpoints, SSRF, Log4Shell, and a l…

If you host a webserver on the internet it is normal to receive that kind of traffic all the time. Source: I host a server on my Comcast connection.

I don't disagree with you, I have tons of things that have public interfaces (as mundane as a fully patched wordpress where the wp-admin login is accessible to external blog writers), we get tens of thousands of random shit anything per day. But the problem here is that Tesla is treating NTP pool operators like they are their internal infrastructure. Also because the attribution of the 'attacks' is fairly well known.

I don't go complaining on the internet about the absolute shitflood of compromised routers on broadband ISPs in Indonesia probing my stuff 24x7x365 because I know it would be futile. But if I found one specific american company that was repeatedly probing my stuff all the time? Maybe I'd escalate it.

Re: I'm being cyberattacked by Tesla, Inc

#29

Post by lukan »

hackernudes wrote: post #21
walrus01 wrote: post #11

Earlier quoted context omitted.

Please read the article, it's not the volume of the NTP requests, they're actively sending exploit/attempt to compromise payloads. They're probing things in a way that you would ordinarily only do to your own internal infrastructure. "They tried all kinds of exploits against me: path traversal, webshell uploads, probing software internals, probing WordPress and other CMS management endpoints, SSRF, Log4Shell, and a l…

If you host a webserver on the internet it is normal to receive that kind of traffic all the time. Source: I host a server on my Comcast connection.

But it shouldn't be normal, that a car company tries to automatically hack private servers.
Post reply on HN