I accidentally logged hundreds of thousands of phone calls to military bases

我意外记录了数十万通拨往军事基地的电话

DNS hijacking is silly. I already took over different .gov and .edu domains in the past, but I just immediately reported that and moved on. This one is a little different though, it’s about how I took over phone-network infrastructure domains (e164.arpa) of entire territories, and accidentally logged hundreds of thousands of phone calls to military bases. But let’s start at the beginning. DNS 劫持是很荒谬的。我过去曾接管过不同的 .gov 和 .edu 域名，但我当时都立即上报并处理了。但这次的情况有所不同，我接管了整个地区的电话网络基础设施域名（e164.arpa），并意外记录了数十万通拨往军事基地的电话。但让我们从头说起。

What is e164.arpa anyway? ENUM (e164.arpa) was an idea from the early 2000s: take a phone number, reverse the digits, put dots between them, and add .e164.arpa at the end, so +49 30 123456 becomes something like 6.5.4.3.2.1.0.3.9.4.e164.arpa. You can see that every German number will end up under .9.4.e164.arpa, which is the zone for all +49 numbers, and that zone is controlled by DENIC (the same organization that runs .de). This means the DENIC decides which carrier or person gets which number ranges under that zone, just like they hand out .de domains (which makes it decentralized, making every country decide on delegation themselves). e164.arpa 到底是什么？ENUM (e164.arpa) 是 21 世纪初的一个构想：取一个电话号码，将数字反转，中间加上点，最后加上 .e164.arpa。例如，+49 30 123456 会变成 6.5.4.3.2.1.0.3.9.4.e164.arpa。你可以看到，每个德国号码最终都会归入 .9.4.e164.arpa 下，这是所有 +49 号码的区域，该区域由 DENIC（运营 .de 的同一组织）控制。这意味着 DENIC 决定了该区域内哪些运营商或个人获得哪些号码段，就像他们分发 .de 域名一样（这使其去中心化，让每个国家自行决定授权）。

The idea was that carriers could then look these domains up and get back a record saying “hey, this number can be reached over SIP/VoIP under this address”, skipping the expensive phone network and re-routing calls over the cheap internet instead. It never really took off though, and even back in its early days it saw barely any use. Over the years it just deteriorated further, and today it’s basically completely dead. I do actually own 5.8.7.1.7.1.3.2.6.1.9.4.e164.arpa and point it at this website, although technically I’m not supposed to do that (you can figure out my secondary number from that!). 这个构想是让运营商查询这些域名，并获得一条记录，显示“嘿，这个号码可以通过 SIP/VoIP 在此地址访问”，从而跳过昂贵的电话网络，改用廉价的互联网重新路由通话。然而，它从未真正流行起来，即使在早期也几乎无人使用。多年来，它进一步衰落，如今基本上已经完全死亡。我确实拥有 5.8.7.1.7.1.3.2.6.1.9.4.e164.arpa 并将其指向我的网站，尽管从技术上讲我不应该这样做（你可以从中学到我的备用号码！）。

Germany is actually one of the last countries that still technically allows registering an e164.arpa domain, although I was the first person since 2019 to register one. The RFC says you should only set NAPTR records on these domains, which are the records that tell carriers where to route a call. It states that you absolutely shouldn’t be using .arpa domains as normal “domains” and host stuff like websites on them, they are meant to be “infrastructure” domains (you might know in-addr.arpa for reverse DNS lookups for example). But there’s nobody who can actually stop you from doing it, it’s still just DNS at the end of the day, and nothing prevents you from slapping an A record on there and hosting a website. Some people actually really dislike that, and try to get Certificate Authorities to no longer issue certificates for .arpa domains. 德国实际上是最后一个在技术上仍允许注册 e164.arpa 域名的国家之一，尽管我是自 2019 年以来第一个注册的人。RFC 规定，你只能在这些域名上设置 NAPTR 记录，这些记录告诉运营商将呼叫路由到哪里。它明确指出，你不应该将 .arpa 域名用作普通的“域名”并托管网站等内容，它们应该是“基础设施”域名（例如，你可能知道用于反向 DNS 查询的 in-addr.arpa）。但实际上没有人能阻止你这样做，归根结底它仍然只是 DNS，没有什么能阻止你添加一条 A 记录并托管一个网站。有些人确实非常反感这一点，并试图让证书颁发机构不再为 .arpa 域名颁发证书。

Hijacking a territory’s phone network

劫持地区的电话网络

I was scanning e164.arpa to see if any of the delegated zones were hijackable, mostly out of curiosity about how neglected this whole system really was. I found three country-code zones, 0.9.2.e164.arpa, 6.4.2.e164.arpa, and 7.4.2.e164.arpa, all delegated to the same two nameservers: ns6.icb.co.uk and ns.enum.org.uk. Quick explainer for anyone who isn’t a DNS person: when a domain is delegated to a nameserver, it basically means “for any question about this domain, go ask this server, it has the answers”, and if I control the nameserver a domain points to, I control every DNS response for that domain. 我扫描了 e164.arpa，看看是否有任何已授权的区域可以被劫持，主要是出于好奇，想看看整个系统到底被忽视到了什么程度。我发现了三个国家代码区域：0.9.2.e164.arpa、6.4.2.e164.arpa 和 7.4.2.e164.arpa，它们都授权给了相同的两个名称服务器：ns6.icb.co.uk 和 ns.enum.org.uk。对于非 DNS 领域的人做一个简要解释：当一个域名被授权给一个名称服务器时，基本上意味着“关于这个域名的任何问题，去问这台服务器，它有答案”。如果我控制了域名指向的名称服务器，我就控制了该域名的每一个 DNS 响应。

icb.co.uk still exists as a domain, but the specific ns6.icb.co.uk subdomain no longer resolves to anything, meaning any request falls back to the second listed nameserver instead: ns.enum.org.uk. And that domain had expired, so I bought it for just 5€, and just like that I controlled the DNS for 0.9.2.e164.arpa, 6.4.2.e164.arpa, and 7.4.2.e164.arpa. Reversed, those are phone codes +290, +246, and +247: Saint Helena, the British Indian Ocean Territory (Diego Garcia), and Ascension Island respectively (funnily enough, those territories also have the popular ccTLDs .sh, .io, and .ac). icb.co.uk 作为一个域名仍然存在，但特定的 ns6.icb.co.uk 子域名不再解析为任何内容，这意味着任何请求都会回退到第二个列出的名称服务器：ns.enum.org.uk。而那个域名已经过期了，所以我只花了 5 欧元就买下了它，就这样我控制了 0.9.2.e164.arpa、6.4.2.e164.arpa 和 7.4.2.e164.arpa 的 DNS。反转过来，这些分别是电话区号 +290、+246 和 +247：圣赫勒拿岛、英属印度洋领地（迪戈加西亚岛）和阿森松岛（有趣的是，这些地区也拥有流行的国家代码顶级域名 .sh、.io 和 .ac）。

To be clear about what this meant: when a carrier does an ENUM lookup for one of these numbers, they’re essentially asking “where do I route this call?”, and I could answer with whatever I wanted. I could point it at my own SIP server, accept the incoming call, and then place an outgoing call to the real destination with a spoofed number. The person being called would see the original number ringing, and after picking up would speak to the person on the other end as if everything was normal, but I’d be sitting silently in the middle of the entire conversation. I would theoretically be able to do this for every single request that I got if I could re-route a number, if anyone was still actually using this system. 明确一下这意味着什么：当运营商对这些号码进行 ENUM 查询时，他们本质上是在问“我该把这个电话路由到哪里？”，而我可以随心所欲地回答。我可以将其指向我自己的 SIP 服务器，接受呼入电话，然后用伪造的号码向真实目的地拨出电话。被呼叫的人会看到原始号码在响铃，接听后会像往常一样与对方交谈，但我会静静地坐在整个对话的中间。如果有人还在使用这个系统，理论上我能够对我收到的每一个请求进行这种操作（如果我能重新路由号码的话）。

I reported it right away to everyone I could think of, through multiple channels into the British government, and got nothing back. My best guess is that someone at the Internet Computer Bureau (who seemingly managed them in the past) set these nameservers up over a decade ago. Then e164.arpa slowly died out, and whoever set it up either moved on or just forgot about it, leaving nobody to renew a domain nobody remembered they depended on. 我立即向我能想到的所有人报告了此事，通过多种渠道联系了英国政府，但没有任何回音。我最好的猜测是，互联网计算机局（Internet Computer Bureau，似乎在过去管理过它们）的某个人在十多年前设置了这些名称服务器。后来 e164.arpa 逐渐消亡，设置它的人要么离开了，要么只是忘记了它，导致没有人去续订一个没人记得自己还依赖着的域名。

Checking if anyone actually uses this

检查是否真的有人在使用它

Q Misell (a researcher of the Max-Planck-Institute for Informatics) had heard about this and reported it to RIPE (who manages e164.arpa) on my behalf, but RIPE also declined to do anything, because e164.arpa delegations are governed by an ITU-T committee at the UN level. And RIPE wasn’t willing to go against a decision made by a UN committee, which would probably be a bureaucratic nightmare. Q also asked if I had any data on how much traffic these zones actually got, which I didn’t know. And because I was very curious about that myself, I set up logging on 0.9.2.e164.arpa (Saint Helena) to find out, and waited a full day. Not a single query came in. Q Misell（马克斯·普朗克信息学研究所的研究员）听说了这件事，并代表我向 RIPE（管理 e164.arpa 的机构）报告了此事，但 RIPE 也拒绝采取任何行动，因为 e164.arpa 的授权由联合国层面的 ITU-T 委员会管理。RIPE 不愿违背联合国委员会的决定，那可能会是一场官僚主义的噩梦。Q 还问我是否有关于这些区域实际流量的数据，我当时不知道。因为我自己也很好奇，我在 0.9.2.e164.arpa（圣赫勒拿岛）上设置了日志记录来一探究竟，并等待了整整一天。结果一个查询都没有收到。

So after trying my best to get anyone to care and getting nowhere, I just kept the domains, since nobody seemed to be relying on them anyway. I hosted my personal site on it, spun up a Fediverse instance, a Matrix homeserver, and handed out subdomains to friends, because why not, it’s a dead system. It’s not like it’s gonna hurt anyone, and no one cares. So it’s time to be whimsical and have fun with it. 所以在尽力寻求关注却无果后，我保留了这些域名，因为反正似乎没人依赖它们。我在上面托管了我的个人网站，启动了一个 Fediverse 实例、一个 Matrix 家庭服务器，并向朋友分发了子域名，因为为什么不呢，这是一个死掉的系统。这又不会伤害任何人，也没人在意。所以，是时候发挥奇思妙想，好好玩玩它了。