TECH Signal 392
Expired €5 domain gave researcher control of ENUM DNS for three territories, logging hundreds of thousands of military calls
↗
A researcher purchased an expired domain for €5 that served as the authoritative nameserver for three countries' e164.arpa ENUM zones, inadvertently gaining the ability to intercept phone call routing for Saint Helena, Diego Garcia, and Ascension Island.
The e164.arpa ENUM system is nearly dead but still partially operational, and its neglected infrastructure created a trivially exploitable attack surface. The affected territories include Diego Garcia, home to a major military base, and the researcher logged hundreds of thousands of calls before reporting the issue. The British government did not respond to multiple reports through several channels.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Three country-code ENUM zones (+290, +246, +247) were delegated to nameservers including ns.enum.org.uk, whose domain had expired and was purchasable for €5
Control of these zones meant the ability to intercept, redirect, or man-in-the-middle phone calls routed through ENUM lookups for those territories
The researcher reported the takeover to the British government through multiple channels and received no response
THE CLUSTER