Researcher accidentally logs thousands of phone calls to US military bases through misconfigured internet routing

In a detailed technical blog post published earlier this week, researcher Lina Sh describes how a configuration error in her personal server allowed her to intercept a vast number of telephone calls meant for other organizations. The incident, which has drawn significant attention on tech forums like Hacker News and Lobsters, centers on the E.164 number mapping (ENUM) system, which translates phone numbers into internet addresses and routes calls over IP networks.

Sh explains that she was experimenting with the .e164.arpa zone—a special domain used to map telephone numbers to internet services—when she mistakenly claimed responsibility for a large block of numbers. Due to a lack of proper validation by upstream providers, her server began receiving call routing queries for thousands of numbers, many of which were associated with U.S. military installations.

"I basically set up a DNS server for a range I shouldn't have, and the phone system just started sending me all these requests," Sh wrote. "I didn't intend to spy, but I ended up with logs of calls to military bases, recruiting offices, and other sensitive numbers." The logs contained metadata such as timestamps and caller IDs, but not the content of the calls themselves.

The researcher has since taken the server offline and notified relevant authorities, but the incident has sparked a broader discussion about the security of the global telecommunications infrastructure. Experts note that while this was an accidental breach, a malicious actor could exploit similar misconfigurations to eavesdrop on communications or launch targeted attacks.

The U.S. Department of Defense has not publicly commented, but security analysts suggest that the incident highlights a pressing need for stricter controls on ENUM delegation and better monitoring of phone number routing. The researcher did not disclose how long the misconfiguration persisted or whether any classified information was inadvertently accessed.

Why This Matters

Privacy and National Security Risks: The incident shows that even an accidental misconfiguration can expose call metadata for sensitive numbers, potentially enabling surveillance or intelligence gathering.
Infrastructure Fragility: The ENUM system relies on trust and proper delegation, but lacks robust authentication mechanisms, making it vulnerable to both accidental and intentional abuse.
Policy Implications: This could prompt calls for reform in telecom routing standards and closer cooperation between ISPs and defense agencies to secure phone number resolution.

Background

The E.164 number mapping (ENUM) system was developed to bridge the traditional telephone network (PSTN) with the internet. It uses DNS (Domain Name System) to map full international phone numbers (E.164 format) to URIs or IP addresses, enabling VoIP calls and unified communications. The .e164.arpa zone is managed by national telecom authorities and delegated to carriers and service providers. However, the delegation process is not always tightly controlled, and misconfigurations can lead to routing leaks. Past incidents include accidental ENUM hijacking by small ISPs and researchers probing system weaknesses.

Key Perspectives

Researcher (Lina Sh): The researcher discovered the vulnerability by chance, and after realizing the extent of the data exposure, she promptly shut down her server and reported the issue. Her blog post is intended to raise awareness, not to cause harm. Telecommunications Industry (ISPs and VoIP Providers): They may downplay the risk, arguing that such mishaps are rare and that existing safeguards (e.g., rate limiting, IP whitelisting) are sufficient. However, the incident reveals that many providers do not validate ENUM delegations properly. Critics and Security Experts: They see this as a systemic failure. Critics argue that the phone system’s reliance on unauthenticated DNS queries is outdated and that stronger encryption and authentication (e.g., DNSSEC) should be mandatory for ENUM. They also point out that military numbers should never be publicly routable via ENUM.

What to Watch

Official Responses: Look for statements from the U.S. Department of Defense or FCC regarding any investigation or policy changes.
ENUM Security Improvements: Expect increased discussion about implementing DNSSEC for .e164.arpa and stricter delegation audits by national telecom regulators.
Future Incidents: This may inspire more researchers to probe ENUM delegations, potentially uncovering other misconfigurations that could be exploited maliciously.

ZOTPAPER