I'm being cyberattacked by Tesla, Inc
dreamstation.systems
dreamstation.systems
https://www.google.com/search?&q=university+ntp+server+netge...
> We learned that these packets appeared to be legitimate, well-formed Simple Network Time Protocol (SNTP) version 1 queries, albeit at an inexplicably high rate from each client host. For instance, during one trace, many clients produced about one query per second. This would be highly unusual for a properly constructed SNTP client, since an application which uses SNTP is merely interested in setting its own clock relatively accurately so that its host has some reasonable notion of the current time. One query per second is ridiculous, and is far from best practice for NTP client behavior.
I love articles like that.
The way a vendor embedding NTP is _meant_ to do so is documented here: https://www.ntppool.org/en/vendors.html
On another note, back when I ran a web hosting business we hosted a few NTP servers in the pool. It’s such a simple thing to give back, and worth anyone who can make a stable contribution doing so.
If you see high packet rate from a specific IP address or prefix, it's very likely not them abusing your service, but rather you attacking them by responding to spoofed requests.
Note that in the past I've had companies writing embedded linux based firmware using ntppool for time sync request their own vendor zones, however a lot of those requests were ignored so it's unclear if that's still expected. In the end they ended up just using the default ntppool domains since they never got their own vendor zones.
When was this page last updated? I would expect that number to be in the hundreds of millions these days, perhaps even billions.
> Do not use the standard pool.ntp.org names as a default configuration in your system
Apple's default is time.apple.com, ubuntu has their own pool, android as well, same for windows.
All the big linux distros also run their own ntp servers.
The ntppool.org stats show about 100k queries per second https://status.ntppool.org/
100k/s is consistent with on the order of lower 10s of millions of devices, with most checking every 10 or so minutes, and a few misconfigured ones hammering the server at a high frequency.
It certainly isn't billions of devices.
Having a vendor zone in the pool is not about selecting a set of servers to use, its for mitigating the hard coded server issue.
The standard NTP pool gets used (usually).
Amazon Linux uses their own NTP server for EC2 instances (and a large number of distros on AWS use it too).
Android, the most popular linux distro in the world, uses Google's NTP servers rather than NTP.
ChromeOS, another quite popular linux distro, also uses Google's NTP servers.
Akamai, APNIC Foundation, Arctic Security, AusCERT, Avast, Backblaze, Canadian Center for Cyber Security, CERT.AT, CERT.br, CERT.LV, CIRA, CIRCL, Craig Newmark Philanthropies, CSIRT.LI, CSIS Security Group, DFN‑CSIRT, Digital Trust Center, EURid, HelseCERT, ICANN, Identity Digital, KPN, Mastercard, NASK (CERT.pl), NCSC Ireland, NICS, Nihon Cyber Defence, Nucleus Security, Orange Polska, Precursor Security, Protect.ngo, Public Interest Registry (PIR), Red Hat, SURFcert, SWITCH, Team Cymru, Trend Micro, Trivest AG, Tucows, Verisign, VulnCheck,
I don't care what they say they're doing, I hate how corporations can act with impunity with these types of things while everyone else would get a felony for it.
Because that is exactly what all of these vulnerability scanning companies are doing, and all of us sort of just… let them.
I have personally done this before, the correct sequence of moves is:
1. Call your neighbor, ask for permission. 2. Check the door 3. Lock the door
If you don’t have their phone number, you are not on good enough terms to touch their lock.
Having one person with poor computer security negatively impacts everyone. Hacked sites turn into phishing landing pages, exploit kit hosting, stolen data dumps, and launching off points for attacks on everyone else. The vuln scanning ShadowServer is doing is meant to be a public good, which is why they share the info with ISPs and governments.
Security is too intertwined to stand by and say other people's vulnerabilities aren't your problem.
And even if you remove the analogy, ShadowServer means good, but good intentions doesn’t necessarily make their action moral or legal.
Yes, compromised servers can be used by hackers as means to commit crimes. But when these groups scan the entire internet, they do cause harm as well, as shown in the original linked article. Much less harm than a black hat, but they still waste time and resources from innocent third parties.
It’s fair to ask if the harm they cause is worth the good they do.
Researcher disclosures, even with POCs, have moved the industry to action incumbents would have rather buried. I’m thinking of CPU and memory exploits, and stuff like log4j, as examples.
Frontier AI is enabling the cyber arms race more than anything past, and certainly more than some bot slowly crawling web servers for old vulnerabilities.
If we’re talking harm, it should be in the broader context of internet history, imo.
The first is a lot more legal and ethical than the second.
Fear & the danger aren't the same. anyway, I'll let it go.
It’s a fact that these scanners send unauthorized requests to servers whose owners did not consent to scanning.
If we think this is acceptable, which of the following is also acceptable, and if some is not, where is the difference:
1) Detecting the scan and notifying the ISP of the scanner that they are abusers
2) Notifying law enforcement and filing a formal complaint
3) Implementing passive defense measures and responding with a reverse slow loris attack where you trickle 1 response packet per minute down the pipe to attempt to DoS the scanner. But only to prevent them from accidentally hitting some innocent third party’s homemade wiki system that deletes content on GET requests. Not with any malice, just to help prevent harm to others.
4) Implementing active defense where you return progressively more hostile response starting with zip bombs and ending with whatever sota cyberweapon latest AI can give you. But only to shut down the scanner and not cause any damage what so ever. Simply to check if their security is up to par. You would of course report any detected vulnerabilities to the ISP of the scanner, to prevent criminals from using the same.
5) Actively responding with a scan of your own to any incoming scans.
Maybe running a web server on the same IP as an NTP server is a bad idea.
Hell, they issue certificates to IP addresses now. For cloud systems, ownership of an IP could be a few hours.
This has almost certainly been deemed an acceptable risk.
It's not. They control a long-term high-value asset (the domain tesla.com). They decided to delegate part of that asset to a large number of "random" people that they do not have a contract or agreement with.
Being able to issue certs for cloud IPs has nothing to do with this since it is not a long term asset, and if it is you probably don't delegate it to random people to control unless you do not value that asset.
> IP address certificates allow server operators to authenticate TLS connections to IP addresses rather than domain names. Let’s Encrypt supports both IPv4 and IPv6. IP address certificates must be short-lived certificates, a decision we made because IP addresses are more transient than domain names, so validating more frequently is important.
https://letsencrypt.org/2026/01/15/6day-and-ip-general-avail...
Tangential, but I love the design of your blog. That's so freakishly accurate to old GNOME 2 Ubuntu, amazing work.
Other than not, with these huge companies you have 0 recourse.
Meta not only hasn't noticed, but is currently sending about 11 requests per second to my site. I've also seemingly trapped one of those TV proxy scraper nets as I'm getting absolutely hammered by requests from all over the place now. I get maybe 10 legit visitors per day, and I'm currently blocking 406,787 IPs from things that have fallen into my honeypot.
I've tweaked my site to return empty status responses a configurable amount of time but the traffic has been so intense that Traefik is now struggling, so I'm going to have to figure out something else. I was returning over-capacity errors and I think that was a mistake, I've swapped to 400 range status codes now. I don't want to use Cloudflare so I'm not sure what to do after this.
The people at these companies are either incompetent or malicious.
Might make them scan themselves instead.
Once the asset scanner detects the vulns, everyone will kick into high gear to patch this.
"Hey Texas Model S #345 just left KXYZ, moving at >100mph towards the pad. Everyone get cameras out!"
It'll be gone by lunchtime that day.
One's best bet is to play possum, and use your clients last login IPs falling in your service area geo-IP ranges for a firewall white-list. Then redirect the other traffic for a black hole route.
If the nuisance hosts assume they have driven the host offline, they will eventually give up and move on. =3
Not sure if there is a great solution, but I'm inclined to say that attack traffic like this is the new normal. In fact, the attack volume they got is quite small compared to the volume I have seen on other tech company subdomains - the new normal is probably much worse.
Any responsible bug bounty researcher reviewing the DNS zone by hand would spot the CNAME and remove it from the target list. You don't get to wash your hands of that because your chatbot did it.
And I don't know anyone that would really look at the intermediary of a CNAME even during a manual test. Maybe if it was obviously a third party service.
It is your responsibility to do your due diligence as a security researcher versus “spray and pray” to ensure you are not exceeding the scope beyond your intended target.
Dump the subdomains, resolve them, and review where they resolve to in order to understand the footprint and attack surface boundaries before engaging scanning or agentic red team harnesses. Automate as much as possible for building the state graph of the target, but a human must remain in the loop to sanity check. To not do this means you could be attacking hyperscaler object storage, a CDN, a partner SaaS frontend, ticketing systems, mail systems, etc (ie anything someone may CNAME off the root domain but that is outside of their organization’s control).
% dig www.tesla.com +short
www.tesla.com.edgekey.net.
e1792.dscx.akamaiedge.net.
<akamai IP>
I think this line of reasoning doesn't make any sense. The internet is not an inherently safe network regardless of what we wish for; we can't wish away the bad activity, and it's only going to increase. The activity that helps prevent the bad activity from working is a net positive.
I think it's pretty disingenuous to compare viewing a couple of pages once a day with running scripting tools against over 400 websites.
> I think this line of reasoning doesn't make any sense. The internet is not an inherently safe network regardless of what we wish for; we can't wish away the bad activity, and it's only going to increase. The activity that helps prevent the bad activity from working is a net positive.
Oh good, no one has ever claimed "it's for your own good" when doing something selfish without consent.
As the OP said, they don't do anything when the server isn't vulnerable, and serving a 404 page is incredibly cheap.
They look to all be log4j vuln scanning activity (CVE-2021-44228), and the volume isn't that high (a few a day, and not every day). They just have some overzealous vuln scanning. And yes, they shouldn't have the NTP pool under their DNS name.
I've had all sorts of strange things happen because of my ntp pool membership, this one is pretty far on the benign end of things.
As opposed to intentionally being a nuisance?
I see this in cyber clients that are perpetually short staffed and simply accept the degraded system because the consequences are minimal. If nothing important breaks, nothing changes.
Neat! Didn’t know about this command that’s very helpful
Edit: tamping down a bit of my prickliness because it looks like this individual is a relative newcomer to running internet-facing services. This is actually a pretty good intro to that: the place as a whole is a cesspool and any conceivable “attack”, scan, probe, pentest is, has, or will be happening at all times. Some you can mitigate yourself, others you’ll need to bring in a specialist service (see DDoS sinks and mitigation services, for example) or contact someone’s abuse address, others you just have to ignore because it’s just not directed at you personally, or just not worth more than three seconds’ thought beyond a firewall rule. This is the latter. Maybe interesting if this is the first time you’re seeing something like this, but for more grizzled operators like myself, it doesn’t even register as notable anymore.
This happens EVERY day to EVERY web server out there. I have a personal site that gets thousands of requests per day from bots.
Running a public server (like NTP) means you will get tons of strange requests. Moreso if you run a web server on the same IP because bots will scrape certificate transparency logs. The entire IPv4 space is scanned continuously.
This may sound harsh, but you cannot stop it. It is whack-a-mole. Filter it and move on, go outside and touch grass, seriously. This is not worth being upset over.
I treat these as an opportunity to tune my filters and firewall rules.
No, I do not.
I get thousands of these "security scanner" requests on a low-traffic site weekly, if not daily. Not a day goes by where someone doesn't try to kick in my door. Are you prepared to waste valuable time in your life to separate the white hat from the black hat requests?
I would have added the IP addresses to my firewall's IP blacklist and forgotten about it the next day. It's really all you can do.
i cannot fathom how you could possibly arrive at this reading of the gp's comment, what are you talking about
Tesla is a large enterprise.
They almost certainly subscribe to some overpriced SaaS garbage which is manned by offshore drones who by definition do not care because they're not paid enough to care.
Unfortunately this isn't the 80s anymore where you can ring up a system administrator at a university and get a human on the other end.
That said: cool looking website btw.
I understand that Tesla is treating your NTP server, a volunteer server and part of the greater volunteer pool of NTP servers, as their own infrastructure.
However, I can't tell from the article if the scans originate with:
A.) IT staff at Tesla that are scanning exposed services on what they perceive, or claim wrongly, as their own network for vulnerabilities.
B.) Somehow a rogue operator (read botnet)
C.) A rogue operator who is using the cars themselves to run exploit scans?
C would be the most alarming and concerning.
> Speculation: Assetnote pulled in everything it could find under tesla.com, including pool-ntp.tesla.com, which CNAMEs to pool.ntp.org, which can resolve to my machine — 67.215.249.229. The asset inventory saves this as a Tesla asset, and starts throwing exploits at me, a stranger.
> Not a vuln in Tesla, and I'm not asking for anything, but I just wanted to let you know that you may unintentionally be being a nuisance.
If it were 8000 requests per second, this might be worthy of some investigation.
But 8000 ntp requests alone consume far less than 1 us cent of compute + bandwidth. This isn't worth lifting a finger over.
"They tried all kinds of exploits against me: path traversal, webshell uploads, probing software internals, probing WordPress and other CMS management endpoints, SSRF, Log4Shell, and a lot more."
But that obviously isn't what we're talking about here. We're talking about a massive multibillion dollar corporation breaking the rules of a community project they joined by committing a Jr Sysadmin grade fuck up and ghosting the people who's infrastructure they have now placed in the crosshairs of serious, enterprise grade automated vulnerability testing from a company who might now inadvertently be committing a felony.
That's a bit different than getting a few dozen lazy hits a day because some botnet got to your IP in the Shodan and saw the Plex port open.
I don't go complaining on the internet about the absolute shitflood of compromised routers on broadband ISPs in Indonesia probing my stuff 24x7x365 because I know it would be futile. But if I found one specific american company that was repeatedly probing my stuff all the time? Maybe I'd escalate it.
The scanner is likely illegal.
The pointing is… so stupid nobody thought to make a law about it.