I accidentally logged hundreds of thousands of phone calls to military bases

source: lina.sh/blog/hijacking-e164-ar…

In 2026, a security researcher discovered a serious weakness in the old phone-routing system ENUM (e164.arpa). The system connects phone numbers with internet call services, but it had become outdated and poorly maintained. The researcher found that three territory phone zones were controlled by expired nameservers. By buying the forgotten domain for only €5, he could technically control where phone-routing requests were sent.

At first, no traffic appeared, so he assumed nobody used the system. Months later, logs showed around 400,000 ENUM requests, mainly connected to Diego Garcia and Ascension Island, including military-related phone numbers. A malicious attacker could have used this weakness to redirect or spy on calls.

The researcher deleted the logs and reported the issue. Eventually, the UK’s National Cyber Security Center took control of the domain to prevent future abuse. The incident shows how forgotten internet infrastructure can create unexpected security risks.

#security #phonecall #military #spy #surveillance #dns #DiegoGarcia #cybersecurity #research #internet #routing #logging #log #enum #domain