I'd report this to AWS instead since Tesla doesn't seem aware. It's AWS IPs as the source.
I might try Searchlight Cyber first (it's their service doing this, presumably without their knowledge), and then if that doesn't work go to AWS.
I'm being cyberattacked by Tesla, Inc
41–50 of 127 posts
Re: I'm being cyberattacked by Tesla, Inc
#42I would assume the fastest way to actually make this stop would be to setup a bunch of honeypot exploits, trigger their detection and someone will figure out what they did wrong. Other than not, with these huge companies you have 0 recourse.
Often, the folks you want to ban are not the hosts running the scans.
One's best bet is to play possum, and use your clients last login IPs falling in your service area geo-IP ranges for a firewall white-list. Then redirect the other traffic for a black hole route.
If the nuisance hosts assume they have driven the host offline, they will eventually give up and move on. =3
Re: I'm being cyberattacked by Tesla, Inc
#43> it has received ~8,000 requests from two of your scanning hosts If it were 8000 requests per second , this might be worthy of some investigation. But 8000 ntp requests alone consume far less than 1 us cent of compute + bandwidth. This isn't worth lifting a finger over.
Isn't this technically a crime, since they're actively attempting to access a computer system they don't own?
Re: I'm being cyberattacked by Tesla, Inc
#44Earlier quoted context omitted.
Wouldn't the same apply to pool.ntp.org then? Maybe running a web server on the same IP as an NTP server is a bad idea.
a .tesla.com certificate might well enable more shenanigans than a .pool.ntp.org cert.
That points to a glaring hole in the modern-day automated web PKI, not Tesla's dangling DNS record.
Hell, they issue certificates to IP addresses now. For cloud systems, ownership of an IP could be a few hours.
This has almost certainly been deemed an acceptable risk.
Re: I'm being cyberattacked by Tesla, Inc
#45Huh, are we sure this is just NTP shenanigans and not some super duper dangerous AI agents "escaping" the "containment"?
Re: I'm being cyberattacked by Tesla, Inc
#46This seems like a gross exaggeration. This happens EVERY day to EVERY web server out there. I have a personal site that gets thousands of requests per day from bots. Running a public server (like NTP) means you will get tons of strange requests. Moreso if you run a web server on the same IP because bots will scrape certificate transparency logs. The entire IPv4 space is scanned continuously. This may sound harsh, but…
You don’t think there’s a difference between “hackers try to attack everything“ and “Tesla decided that I personally need to be tested as one of their systems due to a lazy misconfiguration“ are different?
Are you asking if I think Elon had this person's website on an 80" screen in a conference room whilst they collude how to send traffic to their site?
No, I do not.
I get thousands of these "security scanner" requests on a low-traffic site weekly, if not daily. Not a day goes by where someone doesn't try to kick in my door. Are you prepared to waste valuable time in your life to separate the white hat from the black hat requests?
I would have added the IP addresses to my firewall's IP blacklist and forgotten about it the next day. It's really all you can do.
Re: I'm being cyberattacked by Tesla, Inc
#47I would assume the fastest way to actually make this stop would be to setup a bunch of honeypot exploits, trigger their detection and someone will figure out what they did wrong. Other than not, with these huge companies you have 0 recourse.
(OOP here). I wonder if switching my replies from 299 to 200 OK would be enough for some of them.
Unlikely, but the lazy wonks could enable stratum 1 time services with the cars GPS/cellular receiver and RTC. Having done that for equipment in the past, we all know it is literary only $8.43/unit in parts. Also, setting ntp time as the tertiary fall back has been around for over a decade. =3
Re: I'm being cyberattacked by Tesla, Inc
#48> it has received ~8,000 requests from two of your scanning hosts If it were 8000 requests per second , this might be worthy of some investigation. But 8000 ntp requests alone consume far less than 1 us cent of compute + bandwidth. This isn't worth lifting a finger over.
Isn't this technically a crime, since they're actively attempting to access a computer system they don't own?
In today’s world, a crime is only a crime if you get charged. Tesla has enough power to not get charged.
Re: I'm being cyberattacked by Tesla, Inc
#49I’m pretty sure this way they’ve hardcoded the NTPs is actually against the ToS for use of the NTP pool too. The way a vendor embedding NTP is _meant_ to do so is documented here: https://www.ntppool.org/en/vendors.html On another note, back when I ran a web hosting business we hosted a few NTP servers in the pool. It’s such a simple thing to give back, and worth anyone who can make a stable contribution doing so.
> The way a vendor embedding NTP is _meant_ to do so is documented here: https://www.ntppool.org/en/vendors.html Note that in the past I've had companies writing embedded linux based firmware using ntppool for time sync request their own vendor zones, however a lot of those requests were ignored so it's unclear if that's still expected. In the end they ended up just using the default ntppool domains since they never…
I remember going through the same thing. No response. This was a long time ago, though.
Re: I'm being cyberattacked by Tesla, Inc
#50I bet we'll find that its openAI agent benchmarks off on their own again