I'm being cyberattacked by Tesla, Inc
summary
Tesla's use of a CNAME for its NTP pool subdomain caused an automated security scanner from Assetnote to misidentify volunteer NTP servers as Tesla assets. This resulted in thousands of exploit attempts against innocent third-party servers. The issue stemmed from the scanner treating any IP resolved from the CNAME as being within Tesla's ownership.
key points
- The author discovered thousands of requests containing exploit payloads targeting a wide range of vulnerabilities, including Log4Shell and SSRF, originating from Assetnote scanners.
- Tesla's configuration of pool-ntp.tesla.com as a CNAME to pool.ntp.org caused the scanner to incorrectly include all round-robin volunteer NTP servers in its target list.
- Other NTP pool operators reported similar traffic, suggesting the automated tool was indiscriminately hammering a variety of stranger's IPs based on the DNS configuration.
who should read it
Network administrators and security professionals interested in DNS configuration errors and the risks of automated attack surface management tools.
discussion positive
consensus
Commenters generally agree that Tesla's use of a CNAME for its NTP pool is a poor configuration choice that violates NTP pool guidelines and creates security risks. They highlight that vendors should use dedicated vendor zones to avoid delegating control of their high-value domains to unknown third parties. There is a strong consensus that this practice can lead to unintended consequences, such as bug bounty researchers accidentally scanning third-party servers.
top insight
A bug bounty researcher argues that automated scanning of all subdomains in scope is the industry standard and that the onus of protecting servers from low-volume traffic is on the operator. This sparks a debate on the ethics of 'spray and pray' security testing versus the necessity of human-in-the-loop validation to ensure researchers do not accidentally attack infrastructure they do not control.
Generated by an LLM from the article and thread. Check the sources before relying on it.