Obviously this was a huge mistake on Mastercards part, but does anyone else think it's a mistake to even /have/ domains that are literally one letter away from the original TLD's? For instance .com and .co, .net and .ne. It just seems to be asking for trouble. If those didn't exist, they couldn't be registered and the erroneous DNS request would just go nowhere.
Not exactly, since typos can occur anywhere in the name, not just the TLD. Hell, even without typos, you can bitsquat [1] on domains one bit away from popular site names (usually CDNs) and get some traffic because of various computer glitches. Here's a random paper I found (and skimmed) with some examples [2]
I'd expect big companies to use Markmonitor to handle this problem -- basically, they _also_ register all of the one-edit-distance away typos that they can.
According to Wikipedia, Akamai is one of Markmonitor's customers, so it is surprising that this wasn't already registered by them.
I've found that Markmonitor is generally signed up for "public" address like akamai.com but rarely signed up for service domains since "who is going to screw up the service domain?"
.int is a fun one, some orgs squat on it to use as an internal TLD.
It used to be easy to trawl through certificate transparency logs and find certificate mis-issuance on the .int TLD because there are very few organizations allowed to be registered in this zone legitimately.
I had a friend whose phone number was 591-1XXX and if I picked up the phone and dialed too fast, the 5 might not get recognized by the switch and I'd end up on 911, where I had to say "sorry, wrong number"
Modern cell phones don't even dial the number. They just record that you dialed an emergency number, and route an emergency call.
Tried dialing 112 once just to see what would happen, and it immediately connected me to 911. Interesting conversation with the dispatcher when I told them that I had not, in fact, dialed 911.
Also of note (most people know this, but might be worth sharing anyways) I believe emergency calls get special handling by the network, and can go over any tower, not just your carriers'. So if you're somewhere with no reception and you have an emergency, try making the call anyways - it might still go through. This is presumably why cellphones differentiate "Emergency Calls Only" from having no service entirely.
112 is an emergency number "by specification", it will always work (on GSM/UMTS/Vo LTE networks, NOT on landlines)), no matter what country you're in. I think this also applies to 911, although I'm not 100% sure about this.
Numbers like 000 are a different matter, there are scenarios in which they might not work even if you're in Australia (when you have a non-australian SIM or no SIM at all, for example).
AFAIR, 112 is defined by some ITU or 3GPP standard, which is honored in at least Europe/Russia region. In other places different numbers might as well be routed to it or (even better) redefined inside terminal software (SIM). But I no longer work in that area, so can't be 100% sure.
Apropos of nothing in particular... that brings back a memory (I used to dispatch for a 911 center in the 910 area code). You get some weird stuff in 911 centers sometimes (go figure, right?). In this case, the thing that sticks in my mind is this payphone that used to be on Bald Head Island by the gazebo. It apparently developed some sort of intermittent fault (possibly due to exposure to salt air, but who really knows?) where it would occasionally call 911 on its own. Or at least that seemed to be the case. We'd occasionally get a call from it, with no one speaking on the other end, and we'd send BHI public safety out there and they wouldn't find anybody around it.
Now you might speculate that it was kids playing or something, but based on the time(s) of the calls, the demographics of the island, etc. we always believed it was just some sort of phone malfunction.
Wild! I wonder if the line was shorting out and pulse-dialing random numbers, and it just happened to be 911 sometimes, but that's a total shot in the dark. (I vaguely thought payphones had some kind of special connection to the CO, not like a normal phone line you can just DTMF or pulse dial on, but maybe that's made up.)
That was my first thought. In NZ, 911 has redirected to our emergency number 111 for about 25 years now, but before that, 911 led to a recorded message telling you to hang up and dial 111. I found this out by getting there by accident by pressing the hang-up button a lot of times quickly (for curiosity reasons). In NZ pulse coding for 911 is 1 pulse, then 9 pulses, then 9 again (our rotary dials going the other way is why we use an emergency number starting with 1). I probably pressed the hang-up button once, then decided to press it a bunch more times.
(I vaguely thought payphones had some kind of special connection to the CO, not like a normal phone line you can just DTMF or pulse dial on, but maybe that's made up.)
FWIW, at one time (relative to here in the US at least) there were at least two different major "kinds" of payphones. COCOTS (Customer Owned Coin Operated Telephones)[1] and what I call (for lack of a better term) "telephone company payphones". The latter being owned and controlled by the local telco. Part of the difference is how signaling works. For a COCOT, it is the case that the line is a plain jane line, that you could - ahemcough theoretically cough - beige box onto and dial calls using DTMF or pulse dialing. For those phones, the "magic" that made it a "pay" phone was inside the phone itself. For the "telephone company payphones" the line was configured differently and tones were sent in-band over the line to tell the switch that the coins had been deposited. This is the idea behind the old "red box" notion of recording the coin tones and playing them back to get free calls.
So yeah, a COCOT line could almost certainly be subject to something like random shorts being interpreted as pulse dialing and could possibly call 911. For a telephone company payphone I'm less sure if those supported pulse dialing or not. The lack of coin tones shouldn't matter since calls to 911 are always free, but I'm not sure if the line was different in other ways as well, or not.
Which one the BHI phone was, I never knew. But this was in the late 90's and by then a lot of the old skool telephone company payphones had disappeared in favor of COCOT's so if I had to guess, I'd guess it was a COCOT.
I do IT support for a 911 center. We get about one of these per month coming from landlines on the ILEC's old copper cable plant.
On one serendipitous occasion the fault came from a school district I also support. The fault came from a contingency landline kept around in case the VoIP phone system lost digital PSTN connectivity. I was able to plug-in to the line w/ a butt set and hear clicky, buzzy, nightmarishly bad PSTN sounds thru it.
We turned it over to the ILEC and they "fixed" it. Given the number of "roadkill" splice pedestals I see in my area I feel pretty confident the ILEC isn't doing any maintenance of the copper cable plant at all. (It makes me pretty irritated, considering the favorable tax subsidies they received to build it.)
Given the number of "roadkill" splice pedestals I see in my area I feel pretty confident the ILEC isn't doing any maintenance of the copper cable plant at all.
Yep. In a number of places the old ILEC's have publicly declared their intention to deprecate the old copper based PSTN. In other areas, they seem to be practicing a sort of "malicious neglect" and just letting it decay on the vine, to avoid spending money on maintenance.
It's unrelated (as far as I know) but in an interesting bit of synchronicity, a BHI public safety officer died under somewhat mysterious/controversial circumstances somewhere in that area. It was a few years after I moved out of the area and I'm not familiar with all of the details.
And yet, almost every private PBX uses "9" as the magic "get an outside line" number. Which then if one is calling a "long distance" number, one's next digit is "1", and "9" followed by "1" is only one mis-dialed digit away from becoming a "911" call.
I.e., New York's original area code is 212, someone in CA, dialing "long distance" to New York needs to dial 9 1 212 xxx xxxx. One button off on the first "2" and they just made a call to 911.
You seem to have no clue what numbers are sensitive? Bank or government phone number could be used to impersonate and steal people's identities, among a whole host of other numbers. Not everything is a life and death matter (and neither was the Mastercard incident).
The North American Numbering Plan specifically reserves numbers to forbid that (to the extent that the DTMF for 1 is actually handled differently by the line discipline, or at least was 20 years ago)
I mean, the ISO 3166-1 alpha-2 TLDs are clearly useful, but given the address space, there's lots of one away typos there. It's not a big difference when the non contry code domains are also one dropped letter away from an ccTLD.
On the other hand, this sort of misconfiguration would show up in any sort of good DNS checking tool. One of your registered nameservers doesn't resolve and/or one of your name servers doesn't return the same zone serial (likely) or actual response if you check a name.
In .is, they wouldn't let me register a domain unless I provided two known good nameservers, but .com isn't picky anymore.
I would think you'd get client query errors from time to time as well if one of the auth NS names doesn't even route/not registered. Even a big cacher like Google or CF might have noticed query errors and I'd actually be surprised if there wasn't communication from one of those entities to MC about the issue.
I think most recursive servers will try more than one of the authoritatives before giving up. And it's common to keep stats on which servers work, and send traffic to those.
So if you get the glue that says mastercard has 5 servers, and you already know 4 of them are good, probably send your query to one and don't even bother trying to find the address of the .ne server.
I'd be surprised if it bubbles up in logging unless all/ maybe most of the authoritative servers for a popular hostname/domain name are unresponsive.
Sometimes physical addresses are even 0 letters from each other!
In my (distant) family, there was a guy who married a woman whose name was the same as his sister's, and she changed her family name to his. They all lived together for a short while.
Letters addressed to his wife and his sister would have the exact same address and exact same name on them, with no way to distinguish who the letter was for.
One more edge case to add to the "falsehoods programmers believe about names" list.
My brother and I have the same initial letter, same problem, but it was possible to use the first two letters as initial with some services. But in practice my mom would open letters to see who it was for, lol.
