I accidentally logged hundreds of thousands of phone calls to military bases

adolph

This is a great story. Almost wish the author had dug a little further in and discovered something like Clifford Stoll in The Cuckoo's Egg, but a nice writeup nontheless. Makes me wonder how many partly implemented but ignored protocols like this exist.

shorsher

The article mentions Ascension Island, a small island in the south atlantic. There's a really great spy novel that takes places there, Ascension by Oliver Harris.

toast0

> It never really took off though, and even back in its early days it saw barely any use. Over the years it just deteriorated further, and today it's basically completely dead. It's actually not completely dead... It's just (almost) completely non-public. You can subscribe to services to get number porting information where the interface is basically e164.arpa/ENUM queries to a private nameserver over a VPN. I don't know the details, the cost was high enough that it didn't make sense for my employer to pursue it.

tosti

> The source IPs were mostly American. > So I had accidentally logged hundreds of thousands of phone numbers and timestamps for calls going to military bases. That's quite a jump to conclusion right there.

joncrane

Now THIS is what hacking is all about. Very cool.

trilogic

R.I.P You remind me of Mitnick, this is incarnation cause you have the same style verbatim. Glad to know your breed is still active.

dmd

I'm mostly amazed the author didn't land in jail, which is the normally the response to reporting this kind of thing to authorities.

cryptolobster

It's funny how such holes can remain for years, and no one notices until someone stumbles upon them. It's interesting that no serious organization wanted to address the issue until it was discovered that the military was involved. It's a shame the author wasn't rewarded but at least the story can now be told over a beer.

MotoriX

Man, you really got lucky they didn’t throw you in jail. Anything related to national defense is pretty scary. Do you think you might get some kind of reward for exposing this vulnerability?

brcmthrowaway

Why is a phone call making a DNS query? Is this related to Softphone / VOIP in any way?

chaz6

It is a shame they did not actually set up a SIP server and see if any of those requests turned into actual call terminations. There is another schema called TRIP [1] - telephony routing over ip that uses a number format "1234*1455" designed to be entered on a standard phone keypad. When I registered my ITAD (internet telephony administrative domain, the RHS of a TRIP number) I was lucky enough to get one that matches my local dialling code! https://tripresurgence.org/trip/history/ [1]

samteeeee

Great story. Gives me nostalgia for the old days of the internet.

dkga

I enjoyed reading this much more than anything I read here recently. In particular I like how it absolutely shows that somethings just… fall through the cracks!

TheFerridge

wow incredible story! Reminds me of phone phreaking stories from decades ago!

bcx

Their homepage, https://lina.sh/ , reminds me of the early days of the internet. Are webrings back in fashion? Or is this just a group of old school folks keeping the nostalgia alive?

bdavbdav

Amazed enum.org.uk hasn’t been scooped by a bot. 4 letters are £££.

dkga

Now a question daunted on me. Assuming away strategies like store-and-decrypt-later-in-a-quantum-future, could a MITM really eavesdrop, as in, aren’t such ARPA-routed phone calls encrypted?

seri4l

So what software could be making these ENUM queries? Any theories?

yellers

!remind me 21-Apr-2027..... I would not at all be surprised seeing that domain being abandoned again at a renewal in the near future.