The Open Line

The mechanism is older and duller than the story. ENUM is an early-2000s scheme for asking DNS whether a phone number can be reached over the internet instead of the phone network: reverse the digits, tack on .e164.arpa, ask. It never caught on. Her three zones logged 100,170 queries for Diego Garcia, 99,902 for Ascension Island, and 9,133 for Saint Helena. Her server answered NXDOMAIN every time, so those calls went out over the normal phone network and she never touched a second of audio. The leak was the question, not the call. To ask whether a number is reachable, a switch has to say the number out loud to whoever is standing at that address, and that spot had gone for five euros.

The Hacker News thread took 688 points, and the sharpest thing in it is a question from somebody who clearly runs systems for a living: “Why is a phone call making a DNS query?” That is the whole story. Not a vulnerability, not a breach. A working phone system doing exactly what it was configured to do years ago, asking a question of a machine that no longer belongs to anyone. One commenter pushed back on how hard the writeup leaned on military bases: “That’s quite a jump to conclusion right there.” He is right that a DNS log proves the lookup, not who answered the phone. It rescues nobody, because the lookup was the leak.

It isn’t a phone problem

Change the layer and the shape holds. In 2024, watchTowr Labs noticed the old WHOIS server for the .mobi top-level domain had moved and the original hostname had lapsed. They registered it for $20. Within days more than 135,000 unique systems were asking it questions: government mail servers across a dozen countries, security vendors, registrars including GoDaddy, and, worst of the set, certificate authorities using WHOIS output to decide who got issued a TLS certificate.

The following year the same team went looking for abandoned S3 buckets that software still tried to download from. They found roughly 150, re-registered them for a little over $400, and took eight million requests in two months: software updates, precompiled binaries, virtual machine images, VPN configuration files. Their own note on it is the important part: this is “prolific and not representative of any one organization’s approach to infrastructure or cyber security in isolation.”

Three different layers of the stack. Same story every time. Something was configured correctly by a competent person. That person moved on. The configuration did not.

Name every number your company dialed this hour

Try it. Not the vendors on the AP ledger, the actual outbound requests: every webhook, every DNS lookup, every callback to an API at a company that’s been acquired twice since, every integration a contractor wired up in a sprint nobody documented, every SIP trunk and every update check. Say who owns the far end of each one, by name, today.

You can’t. Neither can we, without going and looking at the traffic. That isn’t sloppiness or a maturity score, it’s what happens to systems that outlive the people who built them.

Call these open lines: a request your systems still place, on a schedule, to something with nobody’s name on it. An open line isn’t broken, which is precisely why it’s still there. Broken things get fixed the same week, because a customer screams. An open line works perfectly, costs nothing, appears on no dashboard and in no budget review, right up until somebody on the other end decides to answer. A five-euro renewal is the entire barrier to entry.

The audit is a photograph of something moving

The reflex here is to commission an inventory. Somebody produces a spreadsheet of every dependency, presents it, and it’s genuinely useful for about a month. Then two engineers ship four integrations, a vendor sunsets an endpoint, and the document becomes a record of what used to be true.

Standing up a new integration used to cost a week of somebody’s attention, and that cost was the only inventory control anybody had. It was never a good one. It was just slow enough to be countable. Now a developer with an agent adds a connector, a key, and a scheduled job before lunch, and an AI voice assistant bolted onto the phone system reaches systems the person who bought it has never heard of. We can’t hand you a measured multiple for that, and we’re not going to invent one. The direction is the part that matters: the cost of opening a line keeps falling, and the cost of enumerating them by hand doesn’t move.

Here’s what the three stories actually have in common, and it isn’t negligence. Every open line is a standing offer, and the market price of accepting it is a domain renewal. Your side of that trade is a real business with a security budget, a compliance posture, and customers. The other side is five euros.

So some of the discipline moves to where the line gets opened, the only place a human is reliably present. A name, an actual person, on every outbound dependency at the moment it’s created, not a ticket and not a wiki page. That alone won’t save you. The domain in this story expired roughly a decade after somebody did a clean job of pointing three zones at it, and no owner recorded at creation time catches that. Somebody has to keep looking on a schedule: what left the building this month, which of those hostnames still belongs to the company you think it does, and which registrations lapse soon.

When you find a line nobody will claim, don’t switch it off and wait for the screaming. That is how a quiet dependency becomes a customer-facing outage with your name on it. Log it first and see who is actually calling, cut it in one environment or one region, keep the rollback ready, and decide in advance what evidence puts it back. And somebody’s last two weeks include handing over their open lines, not just their passwords, because the engineer who set up those nameservers over a decade ago almost certainly did a clean job and then simply left.

One more warning from that thread, from an operator who works with the protocol: ENUM isn’t dead. It moved behind private nameservers and VPNs and became a paid subscription for number-porting data. “We don’t use that protocol anymore” and “our systems stopped asking” are different sentences, and only one of them is checkable.

Stay close enough to see the damage

Our manifesto puts it plainly: stay close to what you own and manage it directly, because the best things are ruined by owners who never see the damage. That reads as advice about equity, and it’s also a literal instruction about infrastructure. Ownership isn’t quite the point, though. Attention is. Nobody files a ticket about the thing that works, and no queue, in-house or outsourced, funds a hunt for a connection that has never once failed. Either somebody’s job includes going to look, or nobody goes.

The engineer who bought that domain reported it and handed it to the NCSC, which is the best ending available to her and changes nothing for anybody else. Those three zones still point at the same nameserver. Every switch that was asking is still asking. Your company has open lines too. The question worth sitting with is who’s holding the other end of them right now, and what it cost them to be there.