I'm being cyberattacked by Tesla, Inc (dreamstation.systems)

Article summary

The author's server, which is part of the NTP Pool, received over 8,000 requests from Tesla's scanning hosts, attempting to exploit various software vulnerabilities. The traffic came from Amazon Web Services IPs and used Assetnote user agents. The author speculates that Assetnote pulled in everything under tesla.com, including pool-ntp.tesla.com, which CNAMEs to pool.ntp.org, and started throwing exploits at the author's server. The issue has been resolved after the author was contacted by Patrik from Assetnote.

Main themes

• NTP Pool configuration
• Vulnerability scanning
• Assetnote and Tesla
• Server security
• Internet infrastructure
• Cybersecurity regulations

What commenters say

• The volume of requests is not the problem, but rather the fact that Assetnote is sending live exploit payloads to a stranger's server on Tesla's behalf.
• Tesla's use of a CNAME under tesla.com instead of a vendor zone may be against the NTP Pool's terms of service.
• Some commenters believe that reporting the incident to the FBI or sending a cease and desist letter to the scanner may be necessary.
• Others think that the scanner's actions may be technically a crime, but it's unlikely that Tesla would be held accountable.
• It's argued that this type of traffic is normal for anyone hosting a web server on the internet, but the specific nature of this incident is unusual.
• There's disagreement over whether the scanner's actions are illegal, with some believing that they are, while others think that Tesla's role in pointing the scanner to the author's server is more of an issue.
• Some commenters suggest that the author should have just firewalled the IPs or returned a different HTTP status code to stop the traffic.
• The incident highlights the potential consequences of a company's mistake in configuring their NTP setup and the importance of proper attribution and scoping in vulnerability scanning.