50,000 requests in the span of ... 21 days? It might be interesting if it were 50 million in those 21 days (even then, 27 RPS is ... nothing). Drop a report to AWS T&S, block, drop, reject, and move on. This is like less than background noise at this point.

Edit: tamping down a bit of my prickliness because it looks like this individual is a relative newcomer to running internet-facing services. This is actually a pretty good intro to that: the place as a whole is a cesspool and any conceivable “attack”, scan, probe, pentest is, has, or will be happening at all times. Some you can mitigate yourself, others you’ll need to bring in a specialist service (see DDoS sinks and mitigation services, for example) or contact someone’s abuse address, others you just have to ignore because it’s just not directed at you personally, or just not worth more than three seconds’ thought beyond a firewall rule. This is the latter. Maybe interesting if this is the first time you’re seeing something like this, but for more grizzled operators like myself, it doesn’t even register as notable anymore.

In case of the very likely title only reader posting:

> Speculation: Assetnote pulled in everything it could find under tesla.com, including pool-ntp.tesla.com, which CNAMEs to pool.ntp.org, which can resolve to my machine — 67.215.249.229. The asset inventory saves this as a Tesla asset, and starts throwing exploits at me, a stranger.

> Not a vuln in Tesla, and I'm not asking for anything, but I just wanted to let you know that you may unintentionally be being a nuisance.

Huh, are we sure this is just NTP shenanigans and not some super duper dangerous AI agents "escaping" the "containment"?

This seems like a gross exaggeration.

This happens EVERY day to EVERY web server out there. I have a personal site that gets thousands of requests per day from bots.

Running a public server (like NTP) means you will get tons of strange requests. Moreso if you run a web server on the same IP because bots will scrape certificate transparency logs. The entire IPv4 space is scanned continuously.

This may sound harsh, but you cannot stop it. It is whack-a-mole. Filter it and move on, go outside and touch grass, seriously. This is not worth being upset over.

I treat these as an opportunity to tune my filters and firewall rules.

To OP robinpie:

I understand that Tesla is treating your NTP server, a volunteer server and part of the greater volunteer pool of NTP servers, as their own infrastructure.

However, I can't tell from the article if the scans originate with:

A.) IT staff at Tesla that are scanning exposed services on what they perceive, or claim wrongly, as their own network for vulnerabilities.

B.) Somehow a rogue operator (read botnet)

C.) A rogue operator who is using the cars themselves to run exploit scans?

C would be the most alarming and concerning.

> it has received ~8,000 requests from two of your scanning hosts

If it were 8000 requests per second, this might be worthy of some investigation.

But 8000 ntp requests alone consume far less than 1 us cent of compute + bandwidth. This isn't worth lifting a finger over.

> Are you asking if I think Elon had this person's website on an 80" screen in a conference room whilst they collude how to send traffic to their site?

i cannot fathom how you could possibly arrive at this reading of the gp's comment, what are you talking about

This is HN plenty of us host servers at home and understand the obviously true fact that you can't really stop it forever.

But that obviously isn't what we're talking about here. We're talking about a massive multibillion dollar corporation breaking the rules of a community project they joined by committing a Jr Sysadmin grade fuck up and ghosting the people who's infrastructure they have now placed in the crosshairs of serious, enterprise grade automated vulnerability testing from a company who might now inadvertently be committing a felony.

That's a bit different than getting a few dozen lazy hits a day because some botnet got to your IP in the Shodan and saw the Plex port open.

But it shouldn't be normal, that a car company tries to automatically hack private servers.

I don't disagree with you, I have tons of things that have public interfaces (as mundane as a fully patched wordpress where the wp-admin login is accessible to external blog writers), we get tens of thousands of random shit anything per day. But the problem here is that Tesla is treating NTP pool operators like they are their internal infrastructure. Also because the attribution of the 'attacks' is fairly well known.

I don't go complaining on the internet about the absolute shitflood of compromised routers on broadband ISPs in Indonesia probing my stuff 24x7x365 because I know it would be futile. But if I found one specific american company that was repeatedly probing my stuff all the time? Maybe I'd escalate it.

Oh absolutely, I just think the specific nature of this (legitimate commercial vuln scanner thinks I'm Tesla) is funny

Tesla isn’t doing the scanning though, instead somebody thinks they are scanning Tesla, but Tesla points them to someone else.

The scanner is likely illegal.

The pointing is… so stupid nobody thought to make a law about it.

Oh, and be sure to include "you're scanning a pool address so you're probably scanning a lot of other sites that don't belong to your customer". They should know it's potentially not one little web site.

nope, it really is assetnote's intentional testing going to the wrong target

Haha I did debate going much worse with the junk images but wanted to err on the side of caution in case I subject possible clients to something like goatse.

Most distributed bots won't follow a 301. If 404/400 don't work, just 444 them, they're not worth giving back a response, especially on a personal website.

pool-ntp.tesla.com --CNAME--> pool.ntp.org --GeoDNS--> thousands of possible servers, biased heavily by user location

Hope there are no sensitive *.tesla.com cookies out there...

That points to a glaring hole in the modern-day automated web PKI, not Tesla's dangling DNS record.

Hell, they issue certificates to IP addresses now. For cloud systems, ownership of an IP could be a few hours.

This has almost certainly been deemed an acceptable risk.

If the neighborhood was constantly being canvased by criminals checking doorknobs, so your concerned neighbor went over to your house to check your doorknob, and then let you know if you accidentally left it open, would you also accuse your neighbor of being a criminal trying to break in?

It is a good analogy because thieves stealing from one house successfully gives them resources and incentivizes them stealing from the same area again.

And even if you remove the analogy, ShadowServer means good, but good intentions doesn’t necessarily make their action moral or legal.

Yes, compromised servers can be used by hackers as means to commit crimes. But when these groups scan the entire internet, they do cause harm as well, as shown in the original linked article. Much less harm than a black hat, but they still waste time and resources from innocent third parties.

It’s fair to ask if the harm they cause is worth the good they do.

Maybe i'm old fashioned, but personally I think the onus should be on the person sending out unauthorized malicious requests to figure out how to not do that.

Any responsible bug bounty researcher reviewing the DNS zone by hand would spot the CNAME and remove it from the target list. You don't get to wash your hands of that because your chatbot did it.

Yes, unless you think that trying to do a bug bounty is a good excuse to participate in DoS.

When I engage a security assessor on behalf of a client, I am required to provide detailed scope and attest to in scope assets (including IP blocks and public hostnames), as well as that I have legal authority for them to be tested. This is validated by my executive sponsor.

It is your responsibility to do your due diligence as a security researcher versus “spray and pray” to ensure you are not exceeding the scope beyond your intended target.

Dump the subdomains, resolve them, and review where they resolve to in order to understand the footprint and attack surface boundaries before engaging scanning or agentic red team harnesses. Automate as much as possible for building the state graph of the target, but a human must remain in the loop to sanity check. To not do this means you could be attacking hyperscaler object storage, a CDN, a partner SaaS frontend, ticketing systems, mail systems, etc (ie anything someone may CNAME off the root domain but that is outside of their organization’s control).

I feel confident that no system exposed to the internet should have a problem with 50,000 requests per month! If they do, they probably shouldn't run a public NTP server, or have a public IP address at all.

> Are you confident you are not viewing too many pages on HN? What if many other people are also trying to read this thread?

I think it's pretty disingenuous to compare viewing a couple of pages once a day with running scripting tools against over 400 websites.

> I think this line of reasoning doesn't make any sense. The internet is not an inherently safe network regardless of what we wish for; we can't wish away the bad activity, and it's only going to increase. The activity that helps prevent the bad activity from working is a net positive.

Oh good, no one has ever claimed "it's for your own good" when doing something selfish without consent.