Researcher hijacks phone infrastructure domains, logs military base calls
A security researcher took over DNS zones controlling phone routing for island territories and inadvertently captured records of hundreds of thousands of calls to military installations.
What to know
- A researcher gained control of DNS infrastructure routing phone calls for multiple island territories by purchasing an expired nameserver domain for €5, exploiting years of neglect in the e164.arpa system.
- The hijacking unintentionally logged call metadata for hundreds of thousands of phone calls to military bases due to her web server capturing DNS queries.
- E164.arpa, a system from the early 2000s designed to enable VoIP routing, is largely abandoned and deteriorated, creating security vulnerabilities that went undetected for months.
“The RFC says you should only set NAPTR records on these domains, which are the records that tell carriers where to route a call. It states that you absolutely shouldn't be using .arpa domains as normal 'domains' and host stuff like websites on them, they are meant to be 'infrastructure' domains.”
Lina, Security researcher · Personal blog
Lina Security researcher
The record 3 articles and posts · last 30 days
- summary covers to here · Aug 21, 11:30 AM · 1 piece above arrived after
What people are saying 24 voices from 3 sites · best of 27 · verbatim
- Aug 23
-
It sure would be nice if doing something illegal was a prerequisite to getting arrested in the USA.
- Aug 22
-
> when a carrier does an ENUM lookup for one of these numbers, they're essentially asking "where do I route this call?", and I could answer with whatever I wanted. I could point it at my own SIP server, accept the incoming call, and then place an outgoing call to the real destination with a spoofed numberHow would the “outgoing call to the real…
-
It's a shame that ENUM didn't really go anywhere, but I suppose ultimately many stakeholders consider the phone network being administratively separate from the Internet a feature, not a bug, even though it's now largely an overlay network on top of the Internet itself in its modern form (NGN).As far as I remember, the Austrian telco regulator was…
-
The NCSC does give out challenge coins for particularly good reports. I feel like if you get one of those, that will be 10 euros well spent.
-
They didn't do anything illegal, at least as narrated, by registering a domain that happened to have prior usage and monitoring queries. I think if they used it to cause random chaos or terminated and re-originated calls for eavesdropping it could be a different story.
-
My guess is that this is actually what happened here: Some carrier or VoIP software leaking its DNS queries to the public internet because the service is using is only set up to respond for e.g. NANP (+1) number ranges and the rest is falling through to the public (and largely unused) ENUM.
-
W
“How an expired nameserver let me take over e164.arpa zones for multiple territories, and why I probably should have checked my logs sooner.” # dns # arpa # nameserver https:// lina.sh/blog/hijacking-e164-ar pa
-
Newbie question:A malicious actor could simply have MITM'ed the calls the blog states and obtaining the voice traffic. Is that possible because the author had the certificates( since holding the ownership of the domain)?
-
> skipping the expensive phone network and re-routing calls over the cheap internet instead.I find this such a bad idea, if I want to use the cheap internet for a call I would use an internet based voice call system directly, rather than messing around with telephone numbers and I guess potentially accidentally doing an expensive phone call (same…
- Aug 21
-
Their homepage, https://lina.sh/, reminds me of the early days of the internet. Are webrings back in fashion? Or is this just a group of old school folks keeping the nostalgia alive?
-
It sounds like they are not in the USA/UK or citizens of either, so it's probably more hassle than it's worth. If they happened to be in either of those countries and easily accessible, who knows what could have happened.
-
I enjoyed reading this much more than anything I read here recently. In particular I like how it absolutely shows that somethings just… fall through the cracks!
-
I'm surprised - and delighted! - that they didn't get arrested after reporting this.
-
It is a shame they did not actually set up a SIP server and see if any of those requests turned into actual call terminations.There is another schema called TRIP [1] - telephony routing over ip that uses a number format "1234*1455" designed to be entered on a standard phone keypad. When I registered my ITAD (internet telephony administrative…
-
Man, you really got lucky they didn’t throw you in jail. Anything related to national defense is pretty scary. Do you think you might get some kind of reward for exposing this vulnerability?
-
It's funny how such holes can remain for years, and no one notices until someone stumbles upon them. It's interesting that no serious organization wanted to address the issue until it was discovered that the military was involved.It's a shame the author wasn't rewarded but at least the story can now be told over a beer.
-
Just a silly name, I think? Maybe influenced by an old Saturday Night Live skit about “the phone company” and its approach to customer service. (Possibly worth also noting that there was a period when .int was used for internet infrastructure things like ip6.int, before they realised that .arpa would not be a temporary transitional domain (like…
-
I'm mostly amazed the author didn't land in jail, which is the normally the response to reporting this kind of thing to authorities.
-
Very interesting, do you know why the string "TPC" was chosen? Was there an actual phone company behind it or just a silly name?
-
It's also not uncommon for telecom providers to use it for their own internal routing because enough telecom software did in fact develop support for it despite lack of public implementations.As someone who's been in the VoIP industry for over 20 years it makes me sad to think of what could have been if both ENUM and IPv6 were more widely adopted…
-
> It never really took off though, and even back in its early days it saw barely any use. Over the years it just deteriorated further, and today it's basically completely dead.It's actually not completely dead... It's just (almost) completely non-public.You can subscribe to services to get number porting information where the interface is…
-
S
Fascinating insight into unusual DNS. https:// lina.sh/blog/hijacking-e164-ar pa
-
> ENUM (e164.arpa) was an idea from the early 2000s […] It never really took off though, and even back in its early days it saw barely any use. AIUI ENUM is used within the private VOIP infrastructure of mobile networks, but this widespread usage isn’t visible on the public Internet. There’s a fun prehistory from the early 1990s involving…
-
L
new blog post! https:// lina.sh/blog/hijacking-e164-ar pa i hijacked some telephone infrastructure of a few islands over the span of multiple months; and accidentally logged information of a few hundreds of thousands of phone calls going to military bases in the process.. it's a really really silly story :P