Why is the DoD on My APN?
by ThoughtCrimes
I was recently doing some research of cellular networks and how public IP addresses change when moving from tower to tower when I came across an interesting discovery.
It seems that my Android mobile phone was reporting two different public IP addresses.
When I would use third-party tools like free websites to check my WAN IP, the results would always come back as expected and point to my existing carrier's network. However, when I dug through some of the internal menus in Android settings, I discovered a second IP public address which I did not recognize. This seemed odd as it was a completely different network than my carrier. Being a little curious, I ran a WHOIS query against the second IP and the results were astonishing.
It turns out that this second IP was tagged as belonging to a Department of Defense network based in Columbus, Ohio.
At first, I thought this was funny but also a little scary.
Frankly, I wasn't too worried about it as I'm not all that interesting nor was I committing any crimes that would warrant direct surveillance by the most powerful country on Earth. However, I do consider myself to be a privacy conscious individual and use VPN whenever possible, have very little social media presence, use an encrypted email provider, and use encrypted messaging for SMS . Based on this and some of the things I'd read in the Edward Snowden dumps, it wasn't improbable that I was deemed interesting for those reasons.
At any rate, I decided to investigate further to try and determine if this was just a fluke or something targeted at me specifically. To begin, I rebooted my device and then installed a couple of network monitoring apps. Each time I'd reboot the device, the same pattern of behavior occurred.
My external IP showed as belonging to my cellular provider, but a second "Carrier IP" was showing up. I continued by disabling and enabling my cellular connection to refresh the IPs and began recording what addresses I was receiving. I then began looking each of these IP addresses up to determine who owned them.
To my astonishment, four out of five times, this "Carrier IP" was coming back as belonging to the DoD network. In some instances, however, the IPs were showing up as coming from the United Kingdom's Ministry of Defence. That was obviously strange considering that I was in the USA at the time. Another weird fact was, depending on what system I used to look up the IP addresses, some were reporting as not available and others were throwing warnings with detailed legal language stating that I wasn't allowed to query the WHOIS records except for specific purposes.
To investigate further, I looked at the phones of friends and family members that were using the same carrier I was. The weird thing was that none of their devices showed this second IP address the way that mine did.... Now I was getting a little worried, but still thought it was worth digging a little deeper.
So I tethered my phone to my laptop and began sniffing some of the traffic and running traceroute to determine what was happening. Turned out that the DoD/MoD addresses were in fact showing as belonging to my device (only one hop away and only a few milliseconds of latency). An odd thing that occurred whenever I tethered the phone to my laptop, however, was that a third public IP address began showing up in some of the network analysis apps I had installed on my device. This third IP also showed as belonging to a DoD or MoD network. When I disabled my Wi-Fi hotspot, this IP would disappear, and when the hotspot was enabled, it would again reappear.
One thing that stood out about my friends' and family's devices as different than mine was that their devices were all showing an IPv6 address, whereas mine was an IPv4. I then began to compare the APN settings on my device to theirs, and that is when things got really interesting. I was using an Android device with a prepaid Mobile Virtual Network Operator (MVNO) that piggybacks on top of T-Mobile. When I set the phone up for this carrier, I followed their instructions and installed the APN as detailed in their onboarding guide. Some of my friends were using the exact same carrier as I was, but didn't bother setting up the APN that the carrier recommended we use; instead, they were using T-Mobile's default APN that automatically populated when inserting the SIM card. I tried setting up this APN on their devices and discovered that as soon as I did, the DoD IP addresses began showing up.
So at this point, I felt pretty confident that this mysterious APN was likely the culprit.
To investigate further, I began entering several new APNs with slightly different settings in each to see what kind of IP addresses I'd receive. Well, it turned out that T-Mobile would only allow me to connect using IPv6 whereas the prepaid MVNO would allow IPv4 or IPv6 connections. If I connected to the MVNO using an IPv6 connection, everything looked almost identical to what I'd get with the T-Mobile APN. None of the DoD/MoD IP addresses were showing up when I connected over IPv6, however they would always show up when I connected using IPv4. This seemed odd to me, especially since the MVNO's instructions explicitly called out using IPv4.
I then took to the web to search on the APN settings that my carrier was recommending.
It turned out that at least five other prepaid phone carriers were providing instructions to use the exact same APN settings as my carrier. Upon further investigation, it seemed that all of them were using T-Mobile as the underlying network. Another interesting fact was that all of these carriers were providing prepaid SIM cards which didn't require any registration.
Many of them were targeted at people traveling to the USA from abroad who wanted a SIM card to use while on vacation. Others were providing SIMs for use in alarm systems and GPS tracking equipment.
Based on this, it seems probable that this APN may in fact be routing cellular traffic through a DoD network.
I could be wrong, but if others have any possible explanations, I'd love to hear them.
DoD APN?
Carriers That Use this APN
IP Addresses
WHOIS Query - Network 1
WHOIS Query - Network 2
WHOIS Query - Network 3
WHOIS Query - Network 4