Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I'm being cyberattacked by Tesla, Inc

dreamstation.systems

Post reply on HN
Print view View original

101–110 of 127 posts

Re: I'm being cyberattacked by Tesla, Inc

#101

Post by consensus1 »

philipwhiuk wrote: post #90
consensus1 wrote: post #35

Is this basically a free pen test, or am I misunderstanding the setup?

People are trying to compromise Tesla and because this guy provides NTP services, and Tesla set their NTP up wrong, it appears to other people like his machine is part of Tesla.

Got it. The way it was phrased it made it sound like Assetnote was the party actually sending the exploits (which made me assume it was intentional testing going to the wrong target), not that they were coming in from unknown senders in the outside world.

Re: I'm being cyberattacked by Tesla, Inc

#102

Post by xmodem »

iancarroll wrote: post #83
xmodem wrote: post #79

Earlier quoted context omitted.

One solution is to not set up and run a computer program that relies on bad information to perform automated cyber-attacks on third parties.

How do you suggest I determine the information is bad, if the domain is hosted on tesla.com, and Tesla says I am authorized to test it? Should I inspect all 1,368 subdomains on tesla.com by hand, and then do the same for 400+ bug bounty programs?

Maybe i'm old fashioned, but personally I think the onus should be on the person sending out unauthorized malicious requests to figure out how to not do that.

Any responsible bug bounty researcher reviewing the DNS zone by hand would spot the CNAME and remove it from the target list. You don't get to wash your hands of that because your chatbot did it.

Re: I'm being cyberattacked by Tesla, Inc

#103

Post by saghm »

iancarroll wrote: post #100
saghm wrote: post #98

Earlier quoted context omitted.

Okay, so you're just confident in exactly how many requests everyone else in the world will be making if you try to pentest resources unbeknownst to their owners.

Are you confident you are not viewing too many pages on HN? What if many other people are also trying to read this thread? I think this line of reasoning doesn't make any sense. The internet is not an inherently safe network regardless of what we wish for; we can't wish away the bad activity, and it's only going to increase. The activity that helps prevent the bad activity from working is a net positive.

> Are you confident you are not viewing too many pages on HN? What if many other people are also trying to read this thread?

I think it's pretty disingenuous to compare viewing a couple of pages once a day with running scripting tools against over 400 websites.

> I think this line of reasoning doesn't make any sense. The internet is not an inherently safe network regardless of what we wish for; we can't wish away the bad activity, and it's only going to increase. The activity that helps prevent the bad activity from working is a net positive.

Oh good, no one has ever claimed "it's for your own good" when doing something selfish without consent.

Re: I'm being cyberattacked by Tesla, Inc

#104

Post by robinpie »

consensus1 wrote: post #101
philipwhiuk wrote: post #90

Earlier quoted context omitted.

People are trying to compromise Tesla and because this guy provides NTP services, and Tesla set their NTP up wrong, it appears to other people like his machine is part of Tesla.

Got it. The way it was phrased it made it sound like Assetnote was the party actually sending the exploits (which made me assume it was intentional testing going to the wrong target), not that they were coming in from unknown senders in the outside world.

nope, it really is assetnote's intentional testing going to the wrong target

Re: I'm being cyberattacked by Tesla, Inc

#105

Post by toomuchtodo »

iancarroll wrote: post #83
xmodem wrote: post #79

Earlier quoted context omitted.

One solution is to not set up and run a computer program that relies on bad information to perform automated cyber-attacks on third parties.

How do you suggest I determine the information is bad, if the domain is hosted on tesla.com, and Tesla says I am authorized to test it? Should I inspect all 1,368 subdomains on tesla.com by hand, and then do the same for 400+ bug bounty programs?

When I engage a security assessor on behalf of a client, I am required to provide detailed scope and attest to in scope assets (including IP blocks and public hostnames), as well as that I have legal authority for them to be tested. This is validated by my executive sponsor.

It is your responsibility to do your due diligence as a security researcher versus “spray and pray” to ensure you are not exceeding the scope beyond your intended target.

Dump the subdomains, resolve them, and review where they resolve to in order to understand the footprint and attack surface boundaries before engaging scanning or agentic red team harnesses. Automate as much as possible for building the state graph of the target, but a human must remain in the loop to sanity check. To not do this means you could be attacking hyperscaler object storage, a CDN, a partner SaaS frontend, ticketing systems, mail systems, etc (ie anything someone may CNAME off the root domain but that is outside of their organization’s control).

Re: I'm being cyberattacked by Tesla, Inc

#106

Post by SahAssar »

sippingabonedry wrote: post #44
Polizeiposaune wrote: post #38

Earlier quoted context omitted.

a .tesla.com certificate might well enable more shenanigans than a .pool.ntp.org cert.

That points to a glaring hole in the modern-day automated web PKI, not Tesla's dangling DNS record. Hell, they issue certificates to IP addresses now. For cloud systems, ownership of an IP could be a few hours. This has almost certainly been deemed an acceptable risk.

> That points to a glaring hole in the modern-day automated web PKI, not Tesla's dangling DNS record.

It's not. They control a long-term high-value asset (the domain tesla.com). They decided to delegate part of that asset to a large number of "random" people that they do not have a contract or agreement with.

Being able to issue certs for cloud IPs has nothing to do with this since it is not a long term asset, and if it is you probably don't delegate it to random people to control unless you do not value that asset.

Re: I'm being cyberattacked by Tesla, Inc

#108

Post by 12_throw_away »

sippingabonedry wrote: post #46
MBCook wrote: post #39

Earlier quoted context omitted.

You don’t think there’s a difference between “hackers try to attack everything“ and “Tesla decided that I personally need to be tested as one of their systems due to a lazy misconfiguration“ are different?

Are you asking if I think Elon had this person's website on an 80" screen in a conference room whilst they collude how to send traffic to their site? No, I do not. I get thousands of these "security scanner" requests on a low-traffic site weekly, if not daily. Not a day goes by where someone doesn't try to kick in my door. Are you prepared to waste valuable time in your life to separate the white hat from the black h…

> Are you asking if I think Elon had this person's website on an 80" screen in a conference room whilst they collude how to send traffic to their site?

i cannot fathom how you could possibly arrive at this reading of the gp's comment, what are you talking about

Re: I'm being cyberattacked by Tesla, Inc

#109

Post by iancarroll »

xmodem wrote: post #102
iancarroll wrote: post #83

Earlier quoted context omitted.

How do you suggest I determine the information is bad, if the domain is hosted on tesla.com, and Tesla says I am authorized to test it? Should I inspect all 1,368 subdomains on tesla.com by hand, and then do the same for 400+ bug bounty programs?

Maybe i'm old fashioned, but personally I think the onus should be on the person sending out unauthorized malicious requests to figure out how to not do that. Any responsible bug bounty researcher reviewing the DNS zone by hand would spot the CNAME and remove it from the target list. You don't get to wash your hands of that because your chatbot did it.

Even before AI, I can't imagine a single bug bounty researcher doing that. Pre-AI, everyone ran a tool like subfinder to enumerate subdomains, httpx to resolve them, nuclei to scan them, etc. There's no human review involved there at the subdomain level.

And I don't know anyone that would really look at the intermediary of a CNAME even during a manual test. Maybe if it was obviously a third party service.

Re: I'm being cyberattacked by Tesla, Inc

#110

Post by iancarroll »

saghm wrote: post #103
iancarroll wrote: post #100

Earlier quoted context omitted.

Are you confident you are not viewing too many pages on HN? What if many other people are also trying to read this thread? I think this line of reasoning doesn't make any sense. The internet is not an inherently safe network regardless of what we wish for; we can't wish away the bad activity, and it's only going to increase. The activity that helps prevent the bad activity from working is a net positive.

> Are you confident you are not viewing too many pages on HN? What if many other people are also trying to read this thread? I think it's pretty disingenuous to compare viewing a couple of pages once a day with running scripting tools against over 400 websites. > I think this line of reasoning doesn't make any sense. The internet is not an inherently safe network regardless of what we wish for; we can't wish away the…

We can quantify the impact of the scripting tools pretty easily - 1.5k requests per day! I just went on Reddit and viewed a few posts, and it caused about 500 HTTP requests in DevTools. Luckily HN is not that bloated, but I just don't see the number of requests as meaningful even if it was orders of magnitude higher.

As the OP said, they don't do anything when the server isn't vulnerable, and serving a 404 page is incredibly cheap.

Post reply on HN