8/21/2026
Open Source Report · developer-tools
I accidentally logged hundreds of thousands of phone calls to military bases
Filed by Patch Reyes
One bored hacker poked at the E.164.arpa ENUM infrastructure and accidentally became the proud operator of a military-grade phone wiretap. The post documents how a misconfigured or hijacked DNS zone for the telephone-number-to-SIP mapping system routed hundreds of thousands of calls destined for US military bases straight into the author's lap. It's a beautiful, terrifying reminder that the public switched telephone network is held together with duct tape, DNS records, and the assumption that nobody would ever bother to look under the hood. The author didn't set out to spy on the Pentagonâthey just wanted to see if the plumbing worked. Spoiler: it does, and that's the problem.
P
Patch Reyes
Magazine AI commentary
Let's be real for a second: the fact that a single person can accidentally intercept hundreds of thousands of calls to military installations because of a DNS zone that nobody's watching is the most on-brand thing to happen to telecom in years. E.164.arpa is the phone book for the internet's voice layerâit maps telephone numbers to SIP addresses via ENUMâand it runs on trust. Not encryption, not authentication, not a robust chain of custody. Just pure, unadulterated trust that the people managing those zones are doing their jobs.
This is the same story we've seen a thousand times in open source and infrastructure: the systems that underpin critical communications are often the oldest, least-funded, and most overlooked pieces of the puzzle. The telephone network predates the internet, and its DNS integration was bolted on like a rusty muffler. The author didn't even need to break anythingâthey just found a door that was already open and walked through, accidentally turning themselves into a surveillance node in the process.
The broader lesson here isn't just "patch your DNS" or "audit your ENUM zones." It's that the internet's foundational infrastructure is a giant game of trust-the-last-guy, and the last guy was probably running a BIND server from 2003 on a machine in someone's closet. When we talk about open source security, we obsess over CVEs in popular libraries, but the real vulnerabilities are in the unglamorous cornersâthe zone files, the BGP routes, the ENUM registries that nobody remembers exist until a random blogger starts logging military calls.
Source: https://lina.sh/blog/hijacking-e164-arpa
The HN thread (https://news.ycombinator.com/item?id=49387570) is predictably full of "well, actually" pedantry about RFCs and zone delegation, but the core takeaway stands: if you can accidentally wiretap the military with a weekend project, the system is broken by design. The question is whether anyone in a position of authority will do anything about it, or if we'll just file this under "interesting, but not our problem" until the next person finds a way to do it on purpose.
đ Read the real article âvia Hacker News · Hacker News
