Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I'm being cyberattacked by Tesla, Inc

dreamstation.systems

Post reply on HN
Print view View original

121–127 of 127 posts

Re: I'm being cyberattacked by Tesla, Inc

#121

Post by TheDong »

kelnos wrote: post #99
simonjgreen wrote: post #13

I’m pretty sure this way they’ve hardcoded the NTPs is actually against the ToS for use of the NTP pool too. The way a vendor embedding NTP is _meant_ to do so is documented here: https://www.ntppool.org/en/vendors.html On another note, back when I ran a web hosting business we hosted a few NTP servers in the pool. It’s such a simple thing to give back, and worth anyone who can make a stable contribution doing so.

> The pool is currently keeping the time of an estimated 5-15 million systems accurate. When was this page last updated? I would expect that number to be in the hundreds of millions these days, perhaps even billions.

To quote from the page:

> Do not use the standard pool.ntp.org names as a default configuration in your system

Apple's default is time.apple.com, ubuntu has their own pool, android as well, same for windows.

All the big linux distros also run their own ntp servers.

The ntppool.org stats show about 100k queries per second https://status.ntppool.org/

100k/s is consistent with on the order of lower 10s of millions of devices, with most checking every 10 or so minutes, and a few misconfigured ones hammering the server at a high frequency.

It certainly isn't billions of devices.

Re: I'm being cyberattacked by Tesla, Inc

#122

Post by iancarroll »

varenc wrote: post #112
iancarroll wrote: post #55

As a bug bounty researcher, my systems would do the same thing if they ended up georouted to this IP. *.tesla.com is marked as in scope on https://bugcrowd.com/engagements/tesla , and my agents will probe anything under there as it is presumed to have explicit authorization. Not sure if there is a great solution, but I'm inclined to say that attack traffic like this is the new normal. In fact, the attack volume they…

I'm curious about your use of agents for security bug bounties. Do you use self hosted models? GLM 5.2? Do the economics of self-hosting make it worth it? Or if you use 3rd party hosted models, don't you run into safeguards that try to prevent hacking? (unless convincing them it's a genuine ethical bug bounty program works, but it doesn't in my experience)

I think most people are using some variation of Chinese models due to the safeguards. I have some self hosting but the economics are bad - OpenRouter etc are a very competitive marketplace and usually better.

Re: I'm being cyberattacked by Tesla, Inc

#123

Post by wpm »

hackernudes wrote: post #21
walrus01 wrote: post #11

Earlier quoted context omitted.

Please read the article, it's not the volume of the NTP requests, they're actively sending exploit/attempt to compromise payloads. They're probing things in a way that you would ordinarily only do to your own internal infrastructure. "They tried all kinds of exploits against me: path traversal, webshell uploads, probing software internals, probing WordPress and other CMS management endpoints, SSRF, Log4Shell, and a l…

If you host a webserver on the internet it is normal to receive that kind of traffic all the time. Source: I host a server on my Comcast connection.

This is HN plenty of us host servers at home and understand the obviously true fact that you can't really stop it forever.

But that obviously isn't what we're talking about here. We're talking about a massive multibillion dollar corporation breaking the rules of a community project they joined by committing a Jr Sysadmin grade fuck up and ghosting the people who's infrastructure they have now placed in the crosshairs of serious, enterprise grade automated vulnerability testing from a company who might now inadvertently be committing a felony.

That's a bit different than getting a few dozen lazy hits a day because some botnet got to your IP in the Shodan and saw the Plex port open.

Re: I'm being cyberattacked by Tesla, Inc

#124

Post by dxjxjdjsssb »

TheDong wrote: post #121
kelnos wrote: post #99

Earlier quoted context omitted.

> The pool is currently keeping the time of an estimated 5-15 million systems accurate. When was this page last updated? I would expect that number to be in the hundreds of millions these days, perhaps even billions.

To quote from the page: > Do not use the standard pool.ntp.org names as a default configuration in your system Apple's default is time.apple.com, ubuntu has their own pool, android as well, same for windows. All the big linux distros also run their own ntp servers. The ntppool.org stats show about 100k queries per second https://status.ntppool.org/ 100k/s is consistent with on the order of lower 10s of millions of de…

Since when do Linux distros host their own NTP?

Having a vendor zone in the pool is not about selecting a set of servers to use, its for mitigating the hard coded server issue.

The standard NTP pool gets used (usually).

Re: I'm being cyberattacked by Tesla, Inc

#125

Post by TheDong »

dxjxjdjsssb wrote: post #124
TheDong wrote: post #121

Earlier quoted context omitted.

To quote from the page: > Do not use the standard pool.ntp.org names as a default configuration in your system Apple's default is time.apple.com, ubuntu has their own pool, android as well, same for windows. All the big linux distros also run their own ntp servers. The ntppool.org stats show about 100k queries per second https://status.ntppool.org/ 100k/s is consistent with on the order of lower 10s of millions of de…

Since when do Linux distros host their own NTP? Having a vendor zone in the pool is not about selecting a set of servers to use, its for mitigating the hard coded server issue. The standard NTP pool gets used (usually).

> Since when do Linux distros host their own NTP?

Amazon Linux uses their own NTP server for EC2 instances (and a large number of distros on AWS use it too).

Android, the most popular linux distro in the world, uses Google's NTP servers rather than NTP.

ChromeOS, another quite popular linux distro, also uses Google's NTP servers.

Re: I'm being cyberattacked by Tesla, Inc

#126

Post by FabCH »

9x39 wrote: post #114
FabCH wrote: post #93

Earlier quoted context omitted.

It is a good analogy because thieves stealing from one house successfully gives them resources and incentivizes them stealing from the same area again. And even if you remove the analogy, ShadowServer means good, but good intentions doesn’t necessarily make their action moral or legal. Yes, compromised servers can be used by hackers as means to commit crimes. But when these groups scan the entire internet, they do ca…

> It’s fair to ask if the harm they cause is worth the good they do. Researcher disclosures, even with POCs, have moved the industry to action incumbents would have rather buried. I’m thinking of CPU and memory exploits, and stuff like log4j, as examples. Frontier AI is enabling the cyber arms race more than anything past, and certainly more than some bot slowly crawling web servers for old vulnerabilities. If we’re…

Ok, but there is a massive difference between "I hammered my own CPU and found a bug that affects everyone" and "I hammered THE ENTIRE INTERNET and found some poor persons website that is not super secure and then I snitched on them to their ISP".

The first is a lot more legal and ethical than the second.

Re: I'm being cyberattacked by Tesla, Inc

#127

Post by 9x39 »

FabCH wrote: post #126
9x39 wrote: post #114

Earlier quoted context omitted.

> It’s fair to ask if the harm they cause is worth the good they do. Researcher disclosures, even with POCs, have moved the industry to action incumbents would have rather buried. I’m thinking of CPU and memory exploits, and stuff like log4j, as examples. Frontier AI is enabling the cyber arms race more than anything past, and certainly more than some bot slowly crawling web servers for old vulnerabilities. If we’re…

Ok, but there is a massive difference between "I hammered my own CPU and found a bug that affects everyone" and "I hammered THE ENTIRE INTERNET and found some poor persons website that is not super secure and then I snitched on them to their ISP". The first is a lot more legal and ethical than the second.

They didn't hammer the entire internet. That would be like a multi-terabit DDOS. In contrast, the scanner in question sent a trickle of web requests for old vulns, nearly-innocuous at this point.

Fear & the danger aren't the same. anyway, I'll let it go.

Post reply on HN