I'm being cyberattacked by Tesla, Inc
447 points
• 1 day ago
• Article
Link
一位业余服务器管理员最近报告，其基础设施持续遭遇大量自动化扫描流量。该服务器作为志愿者运营的 NTP Pool 的一部分，开始收到数千条携带利用载荷的请求，包含路径遍历、 webshell 注入，以及对 Log4Shell 等常见漏洞的探测。这些流量来自与 Assetnote 关联的 Amazon Web Services IP 地址。
事件的根本原因似乎是 Tesla, Inc. 的 DNS 配置错误。 Tesla 在其域下维护了子域 pool-ntp.tesla.com，并将其设置为指向公共 NTP Pool 的 CNAME 记录。由于 NTP Pool 通过轮询将请求分发到大量志愿者服务器，Tesla 的自动安全扫描工具错误地将通过该域名解析出的每个服务器 IP 识别为其内部资产，从而对包括作者在内的随机志愿者服务器实施密集的漏洞探测。
流量规模相当可观：作者记录到在数周内来自 Assetnote 关联主机的请求超过 50,000 次。尽管扫描持续不断，作者报告称其系统并未被成功入侵。作者曾联系 Tesla 提醒此无意的骚扰，但自动扫描在一段时间内仍未停止，因此作者在服务器上发布了自动说明，以便任何查看日志的安全团队了解情况。
对日志的进一步分析显示，NTP Pool 社区中其他运营者也遭遇了类似流量，说明这并非孤立事件。扫描日志中还出现了许多异常痕迹，包括与 Tesla 无关的第三方域名，甚至内部私有 IP 地址，表明该工具的自动资产发现可能从多种、且可能无关的来源汇聚数据。
问题最终在 Assetnote 的一位代表与作者联系后得到解决。此事凸显了自动化攻击面管理在缺乏严格资产归属校验时的风险：仅依赖广泛的 DNS 解析而不验证某个 IP 是否确属客户，可能会无意间将安全扫描变成对无关互联网基础设施和无辜第三方的骚扰。
A hobbyist server administrator recently reported experiencing a continuous stream of aggressive automated scanning traffic targeting their infrastructure. The server, which functions as part of the volunteer NTP Pool, began receiving thousands of requests laden with exploit payloads, including attempts at path traversal, webshell injections, and probes for various common vulnerabilities like Log4Shell. The traffic originated from Amazon Web Services IP addresses associated with Assetnote, an attack surface management tool used by companies to monitor their digital footprints.
The root cause of this incident appears to be a DNS misconfiguration on the part of Tesla, Inc. Specifically, Tesla maintains a subdomain, pool-ntp.tesla.com, which is set up as a CNAME record pointing to the public NTP Pool. Because the NTP Pool utilizes a round-robin system to distribute requests across a vast network of volunteer-operated servers, Tesla's automated security scanning tools mistakenly identified every server IP address that resolved through this domain as being part of Tesla's internal infrastructure. Consequently, the scanner began subjecting random volunteer servers, including the author's, to intensive vulnerability testing.
The scale of the traffic was substantial, with the author recording over 50,000 requests from Assetnote-affiliated hosts over several weeks. Despite the persistence of the scanners, the author reported that none of the attempts were successful in compromising their system. While the author reached out to Tesla to alert them to the unintended nuisance, the automated scanning continued for some time, prompting the author to post an automated notice on their server to explain the situation to any security teams monitoring the logs.
Further investigation into the logs revealed that other operators within the NTP Pool community were experiencing similar traffic, suggesting the issue was widespread rather than an isolated incident. The scanners' logs contained a variety of curious artifacts, including references to third-party domains unrelated to Tesla and even internal private IP addresses, indicating that the tool's automated asset discovery process was likely pulling in data from diverse and potentially unrelated sources.
The situation concluded successfully when a representative from Assetnote reached out to the author to address the issue. The resolution highlighted the risks of automated attack surface management when tools lack strict validation of asset ownership. By relying on broad DNS resolution without verifying whether a specific IP actually belongs to the client, organizations can inadvertently turn their security scanning operations into a source of nuisance traffic for unrelated internet infrastructure and innocent third parties.
119 comments • Comments Link
• 将 NTP servers 硬编码到 consumer hardware 中是行业长期以来的错误做法，常导致过高且不合规的查询速率，Netgear 的历史案例即为明证。
• 厂商应使用专用的 vendor zones，而不是使用默认的 NTP pool 或通过 CNAME 指向第三方域名，因为这些做法违反 NTP pool 的服务条款并带来不必要的安全风险。
• 将域名通过 CNAME 指向 NTP pool 等共享基础设施可能引发安全漏洞，包括潜在的证书签发问题，因为扫描器可能将这些公共端点视为组织内部攻击面的组成部分。
• 现代互联网的特点是持续且自动化的漏洞扫描，商业安全工具在此过程中往往会错误地把组织 DNS 记录中的私有服务器映射为探测目标。
• 安全研究人员和漏洞扫描器所称的"公共利益"与它们对无辜第三方主机造成的滋扰或潜在法律风险之间存在明显紧张。
• 自动化安全平台通常基于广泛的范围假设运作，误以为自己获得了授权，从而探测并不属于其客户的服务器。
• 即便包含恶意负载，漏洞扫描流量通常也被有经验的运维人员视为"背景噪音"，他们倾向于通过防火墙规则和速率限制来缓解，而不是寻求法律途径。
• 依赖 Tesla 等人手不足的大型企业的通用联系表单通常无果，这凸显了在缺乏与相关技术团队直接沟通渠道时修复错误配置的困难。
• 对整个 IP 段进行扫描是个备受争议的话题；有人认为这是现代安全防护的必要组成，但也有人将其视为消耗资源并增加责任的非自愿探测。
• 对于托管面向公众基础设施的个人来说，面对有针对性但错误的扫描流量，最实际的防御是将其视为强化过滤、改进阻断措施或简单忽略那些处于正常背景噪音范围内流量的机会。
互联网已经演变为一个持续自动探测的常态，合法的漏洞评估与骚扰级别的攻击流量之间的界限愈发模糊。当 Tesla 等大型组织将其 DNS 指向 NTP pool 等共享公共资源时，商业扫描器不可避免地将这些资源作为探测目标，导致志愿者运维人员遭受大量利用尝试。虽然这种情况令个人沮丧并可能带来问题，但有经验的系统运维通常把此类活动视为无法避免的背景噪音，并通过技术过滤而非法律或社交手段来进行管理。最终，这凸显了理论上的互联网安全卫生与大规模自动化企业基础设施管理混乱现实之间的差距。 • Hardcoding NTP servers into consumer hardware is a long-standing industry failure that often results in excessive, non-compliant query rates, as demonstrated by historical examples like Netgear.
• Vendors should use dedicated vendor zones rather than the default NTP pool or CNAMEs to third-party domains, as these practices violate the NTP pool's terms of service and create unnecessary security risks.
• Using a CNAME that points to a shared infrastructure like the NTP pool can lead to security vulnerabilities, including potential certificate issuance issues, as scanners may interpret these public endpoints as part of an organization's internal attack surface.
• The modern internet is characterized by constant, automated vulnerability scanning, where commercial security tools often inadvertently target private servers that are incorrectly mapped to an organization's DNS records.
• There is a clear tension between the "public good" of security researchers and vulnerability scanners, and the nuisance or potential legal harm they cause to innocent third-party hosts who are caught in the crossfire.
• Automated security platforms often operate with an assumption of authorization based on broad scope definitions, leading them to probe servers that do not actually belong to their clients.
• Vulnerability scanning traffic, even when it contains malicious payloads, is often considered "background noise" by experienced operators who mitigate these threats via firewall rules and rate limiting rather than seeking recourse.
• Relying on generic contact forms for large, understaffed corporations like Tesla typically yields no results, highlighting the difficulty of resolving misconfigurations when there is no direct line to the relevant technical teams.
• The practice of scanning entire internet ranges is a debated subject; while some view it as a necessary component of modern security posture, others see it as a form of non-consensual probing that consumes resources and creates liability.
• For individuals hosting public-facing infrastructure, the best practical defense against targeted but erroneous scanning traffic is to treat it as an opportunity to harden filters, implement better blocking, or simply ignore traffic that remains well within the limits of standard background noise.
The internet has evolved into a persistent landscape of automated probing, where the line between legitimate vulnerability assessment and nuisance-level attack traffic is increasingly blurred. When large organizations like Tesla configure their DNS in a way that points to shared public resources like the NTP pool, commercial scanners inevitably treat those resources as targets, subjecting volunteer operators to a barrage of exploit attempts. While this creates a frustrating and potentially problematic experience for the individual, experienced system operators generally view such activity as unavoidable background noise to be managed through technical filtering rather than legal or direct social resolution. Ultimately, this highlights the gap between theoretical internet security hygiene and the messy reality of large-scale, automated corporate infrastructure management.