GoKawiilHow an expired nameserver let me take over e164.arpa zones for multiple territories, and why I probably should have checked my logs sooner.
DNS hijacking is silly. I already took over different .gov and .edu domains in the past, but I just immediately reported that and moved on.
This one is a little different though, it's about how I took over phone-network infrastructure domains ( e164.arpa ) of entire territories, and accidentally logged hundreds of thousands of phone calls to military bases. But let's start at the beginning.
What is e164.arpa anyway?
ENUM ( e164.arpa ) was an idea from the early 2000s: take a phone number, reverse the digits, put dots between them, and add .e164.arpa at the end, so +49 30 123456 becomes something like 6.5.4.3.2.1.0.3.9.4.e164.arpa . You can see that every German number will end up under .9.4.e164.arpa , which is the zone for all +49 numbers, and that zone is controlled by DENIC (the same organization that runs .de ). This means the DENIC decides which carrier or person gets which number ranges under that zone, just like they hand out .de domains (which makes it decentralized, making every country decide on delegation themselves).
The idea was that carriers could then look these domains up and get back a record saying "hey, this number can be reached over SIP/VoIP under this address", skipping the expensive phone network and re-routing calls over the cheap internet instead.
It never really took off though, and even back in its early days it saw barely any use. Over the years it just deteriorated further, and today it's basically completely dead. I do actually own 5.8.7.1.7.1.3.2.6.1.9.4.e164.arpa and point it at this website, although technically I'm not supposed to do that (you can figure out my secondary number from that!). Germany is actually one of the last countries that still technically allows registering an e164.arpa domain, although I was the first person since 2019 to register one.
The RFC says you should only set NAPTR records on these domains, which are the records that tell carriers where to route a call. It states that you absolutely shouldn't be using .arpa domains as normal "domains" and host stuff like websites on them, they are meant to be "infrastructure" domains (you might know in-addr.arpa for reverse DNS lookups for example). But there's nobody who can actually stop you from doing it, it's still just DNS at the end of the day, and nothing prevents you from slapping an A record on there and hosting a website. Some people actually really dislike that, and try to get Certificate Authorities to no longer issue certificates for .arpa domains.
Hijacking a territory's phone network
I was scanning e164.arpa to see if any of the delegated zones were hijackable, mostly out of curiosity about how neglected this whole system really was.
... continue reading