Researcher logs phone calls to military bases via e164.arpa DNS hijacking

DNS Hijacking of Phone Infrastructure

A researcher successfully hijacked e164.arpa domains, which are part of the infrastructure for phone networks. This allowed them to intercept and log data related to phone calls, including those directed to military bases. The researcher previously reported similar takeovers of .gov and .edu domains.

Understanding e164.arpa

e164.arpa, also known as ENUM, was conceived in the early 2000s as a method to route phone calls over the internet using DNS. It translates phone numbers into domain names (e.g., +49 30 123456 becomes 6.5.4.3.2.1.0.3.9.4.e164.arpa). The intention was for carriers to use these domains to find SIP/VoIP addresses, bypassing traditional, more expensive phone networks.

System Deterioration and Vulnerability

The ENUM system never gained widespread adoption and has largely deteriorated over the years, with minimal current use. Despite its obsolescence, some countries, like Germany, still technically allow the registration of e164.arpa domains. The researcher noted that while RFCs specify only NAPTR records for call routing, nothing prevents hosting websites or other services on these domains, creating a potential for misuse.

Impact and Implications

The successful hijacking and logging of calls, including those to military bases, demonstrates a vulnerability in this neglected part of the internet's infrastructure. Although the system is largely defunct, its continued existence and the ability to register and control these domains present a security risk, as they can be exploited for data interception or other malicious activities.