Tesla's Assetnote Scanners Mistakenly Target NTP Pool Server

Unexpected Scan Traffic

An operator of a volunteer NTP Pool server observed persistent attack traffic originating from three specific IP addresses. These requests included Host or Referer headers from pool-ntp.tesla.com, carried Assetnote user agents, and attempted Server-Side Request Forgery (SSRF) to Assetnote callback URLs. The traffic came from AWS IP addresses: 54.165.75.96, 35.168.63.24, and 52.44.200.251.

Assetnote Misidentification

Assetnote, an attack surface management tool, uses continuous threat exposure scanners for automated checks on customer assets. The operator speculates that Assetnote, when scanning Tesla's assets, included pool-ntp.tesla.com. Since this domain is a CNAME to pool.ntp.org, which resolves to the operator's machine, Assetnote likely added the NTP server to Tesla's asset inventory and began scanning it for vulnerabilities.

Root Cause: DNS Configuration

The core of the issue lies in Tesla's DNS configuration. Tesla publishes pool-ntp.tesla.com as a CNAME to pool.ntp.org. The NTP Pool is a round-robin system of volunteer NTP servers, which includes the affected server. This configuration led to the security scanner mistaking an external, volunteer-run server for an internal Tesla asset.

Communication with Tesla

The server operator has contacted Tesla to inform them of the unintentional nuisance. The email clarified that no vulnerability in Tesla's systems was being reported, but rather an issue of misdirected scanning activity. As of the report, no response from Tesla had been received.