// HACKER NEWS — CYBERSECURITY
I accidentally logged phone calls to military bases
DNS hijacking is silly. I already took over different .gov and .edu domains in the past, but I just immediately
reported that and moved on.
This one is a little different though, it's about how I took over phone-network infrastructure domains (e164.arpa) of
entire territories, and accidentally logged hundreds of thousands of phone calls to military bases. But let's start at
the beginning.
ENUM (e164.arpa) was an idea from the early 2000s1: take a phone number, reverse the digits, put dots between
them, and add .e164.arpa at the end, so +49 30 123456 becomes something like 6.5.4.3.2.1.0.3.9.4.e164.arpa. You
can see that every German number will end up under .9.4.e164.arpa, which is the zone for all +49 numbers, and that
zone is controlled by DENIC (the same organization that runs .de). This means the DENIC decides which carrier or person
gets which number ranges under that zone, just like they hand out .de domains (which makes it decentralized, making every
country decide on delegation themselves).
The idea was that carriers could then look these domains up and get back a record saying "hey, this number can be
reached over SIP/VoIP under this address", skipping the expensive phone network and re-routing calls over the cheap
internet instead.
It never really took off though, and even back in its early days it saw barely any use. Over the years it just
deteriorated further, and today it's basically completely dead. I do actually own
5.8.7.1.7.1.3.2.6.1.9.4.e164.arpa and
point it at this website, although technically I'm not supposed to do that (you can figure out my secondary number from
that!). Germany is actually one of the last countries that still technically allows registering an e164.arpa domain,
although I was the first person since 2019 to register one2.
The RFC says you should only set NAPTR records on these domains, which are the records that tell carriers where to route a call.
It states that you absolutely shouldn't be using .arpa domains as normal "domains" and host stuff like websites on them,
they are meant to be "infrastructure" domains (you might know in-addr.arpa for reverse DNS lookups for example).
But there's nobody who can actually stop you from doing it, it's still just DNS at the end of the day,
and nothing prevents you from slapping an A record on there and hosting a website. Some people actually really dislike that,
and try to get Certificate Authorities to no longer issue certificates for .arpa domains3.
I was scanning e164.arpa to see if any of the delegated zones were hijackable, mostly out of curiosity about how
neglected this whole system really was.
I found three country-code zones, 0.9.2.e164.arpa, 6.4.2.e164.arpa, and 7.4.2.e164.arpa, all delegated to the same
two nameservers: ns6.icb.co.uk and ns.enum.org.uk.
Quick explainer for anyone who isn't a DNS person: when a domain is delegated to a nameserver, it basically means "for
any question about this domain, go ask this server, it has the answers", and if I control the nameserver a domain points
to, I control every DNS response for that domain.
icb.co.uk still exists as a domain, but the specific ns6.icb.co.uk subdomain no longer resolves to anything, meaning
any request falls back to the second listed nameserver instead: ns.enum.org.uk.
And that domain had expired, so I bought it for just 5€, and just like that I controlled the DNS for 0.9.2.e164.arpa,
6.4.2.e164.arpa, and 7.4.2.e164.arpa. Reversed, those are phone codes +290, +246, and +247: Saint Helena, the
British Indian Ocean Territory (Diego Garcia), and Ascension Island respectively (funnily enough, those
territories also have the popular ccTLDs .sh, .io, and .ac).