Drop Table “Companies”;– LTD (2016)

Unfortunately, the Companies House doesn't seem to allow a quote character at the beginning. Gotta terminate that string literal before you start injecting your own statements!

superluserdo• 3 years ago

THAT COMPANY WHOSE NAME USED TO CONTAIN HTML SCRIPT TAGS LTD
Previous company names
[NAME AVAILABLE ON REQUEST FROM COMPANIES HOUSE]

https://forum.aws.chdev.org/t/cross-site-scripting-xss-softw...

rendx• 3 years ago

For a moment I thought the previous company name was "[NAME AVAILABLE ON REQUEST FROM COMPANIES HOUSE]".

SilasX• 3 years ago

I think the whole problem is that, based on conventions for communicating this stuff, you can't always rule that out.

benlivengood• 3 years ago

I wonder what happened to it; maybe there's another company named "; UPDATE COMPANIES SET STATUS='DISSOLVED' WHERE ID=10542519;-- LTD"

politelemon• 3 years ago

A company used to have an xss attack in its name. https://www.theregister.com/2020/10/30/companies_house_xss_s...

They changed it and you can only see the old name upon request

https://find-and-update.company-information.service.gov.uk/c...

jeroenhd2• 3 years ago

The old name was in this tweet: https://x.com/zofrex/status/1319286955314614275

Looks like the XSS tried to load this script that has since been banned: https://mjt.xss.ht/

Edit: huh, looks like HN translate 𝕏 into xn--971h.com, but the link still works. So much for my dumb twitter link.

wcedmisten• 3 years ago

I believe that's called punycode, and it's a common way to encode Unicode as ASCII. It also means you can use emojis in your domain.

https://en.m.wikipedia.org/wiki/Punycode

https://xn--i-7iq.ws

TazeTSchnitzel• 3 years ago

To stop this happening again, the Economic Crime and Corporate Transparency Bill (which hasn't finished going through Parliament yet) adds the following text to the Companies Act 2006:

A company must not be registered under this Act by a name that, in the opinion of the Secretary of State, consists of or includes computer code.

bspammer• 3 years ago

I remember this - the companies house website actually wasn’t vulnerable to the attack. They removed it because someone else who downloaded and hosted the data might be.

popcalc• 3 years ago

Relevant: https://news.ycombinator.com/item?id=36094691

krylon• 3 years ago

That must be in the top five, possibly even top three of the coolest company names of all time.

gumballindie• 3 years ago

From what I've seen, gov contractors don't really know what an SQL injection is, but they use frameworks so its all good. Bad thing is that some of these frameworks sanitise rather than escape data and the injection may slip through. I wouldn't be surprised if a system somewhere that reads this company name will just crash one day out of the blue.

ta1243• 3 years ago

GDS are great - and at the time this company was registered they were even better, hence this doesn't cause any problems.

However that doesn't mean downstream users of the data treat data sources correctly

abulman• 3 years ago

I can assure you that as someone that has done a couple Gov-related public-sites, some developers do think about it, and use suitable tools to ensure there's no issues.

Before the last-and-stolen-passports site went live (that I spent most of 2014 getting live - not writing - but mostly trying to get deployed), we did have a conversation, and easily proved that people called Mr or Mrs Null and/or O'Brien would have no problems. That conversation was also somewhat prompted by the Dartford Crossing site that went live a little before us - which had 'some issues'.

highwaylights• 3 years ago

Bobby Tables Incorporated

rickreynoldssf• 3 years ago

It would have been better if Bobby Tables was listed as an officer.

seabass-labrax• 3 years ago

A missed opportunity, even, as you can trade under any name in Britain as long as it's not deceptive.

dang• 3 years ago

; DROP TABLE "COMPANIES";-- LTD - https://news.ycombinator.com/item?id=27815396 - July 2021 (30 comments)

Drop Table “Companies”;-- LTD - https://news.ycombinator.com/item?id=21534156 - Nov 2019 (7 comments)

Drop Table “Companies”;– LTD - https://news.ycombinator.com/item?id=20583540 - Aug 2019 (2 comments)

Drop Table Companies Ltd - https://news.ycombinator.com/item?id=17003588 - May 2018 (27 comments)

Drop Table Companies Ltd - https://news.ycombinator.com/item?id=13280494 - Dec 2016 (23 comments)

amelius• 3 years ago

Don't give your tables reasonable names.

LegitShady2• 3 years ago

tbl_dims_cstmr

freitzkriesler2• 3 years ago

My heros

qingcharles2• 3 years ago

Back in 2000 Coca-Cola had an auction site. I put a HTML comment tag in my username and the words "AUCTION ENDED". The result of which was that whenever I bid on anything it would erase the bid submit button after my name -- therefore no-one else could bid on anything.

https://web.archive.org/web/20010223090106/http://cokeauctio...

This worked for a short time. Then my account disappeared with all my (very hard earned) credits in it. Then I received a letter from the MD of Coke UK telling me I was a very naughty boy.

smcleod2• 3 years ago

Bidding on a “cokeauction” is a very different thing in 2023.

nchase• 3 years ago

What is a cokeauction in 2023?

sdflhasjd2• 3 years ago

Then I received a letter from the MD of Coke UK telling me I was a very naughty boy.

Truly better than any prize. I got a similar letter from my school's headteacher after some extracurricular IT shenanigans. I'm still proud of that one.

qingcharles2• 3 years ago

Ha! Within weeks of entering primary school at 11 I had persuaded the son of the IT teacher to give me his Dad's admin password for the school network. I caused untold chaos and was banned from touching the computers for the rest of my school history.

henrydark• 3 years ago

Similarly, in 2003, they had some code-under-caps promotion. I wrote a script to submit thousands of random codes to the website, and subsequently someone from Coca-Cola NZ called my home. They calmed down when my dad said I wasn't home, but at school.

Mind you, in 2002 no called, and I got a free shirt and a folding chair.

ben_w• 3 years ago

I wrote a script to submit thousands of random codes to the website, and subsequently someone from Coca-Cola NZ called my home.

I managed to get a phone call and a personal visit from a script.

Much less interesting than it sounds: I was downloading satellite data from NASA, the increased bandwidth use worried the sysadmin in my research lab, and we each had landline phones on our desks because this was the mid-noughties.

Dwedit2• 3 years ago

Around this era, you could make posts on message boards where your subject was all spaces, and make an unclickable post.

justinator• 3 years ago

Somewhat related, in '99 my school gave everyone shell accounts, so they could check their email through pine. But the shell accounts were pretty functional with access to command line tools, such a perl.

It took me a lot of restraint not to harvest everyone's usernames (which was just the name of the home directory easily grokked) and email everyone at username@highered.edu (since sendmail was also available) something silly during winter break- like the fact that flooding had happened in the dorm rooms, and that everyone would have to move out before Spring semester due to needed maintenance and everyone will receive $500 in compensation because everyone's stuff in their dorm was destroyed.

Surely I would have been expelled, but what a story to tell my next employer.

Anyways, looking for a QA job if anyone's hiring. I would like to break your stuff.

skittleson• 3 years ago

Naughty but very informative to their devsec team . I think that should have been a given you a reward for finding that issue.

saulr• 3 years ago

This ultimately resulted in a new restriction in a bill making its way through Parliament that "a company must not be registered under this Act by a name that, in the opinion of the Secretary of State, consists of or includes computer code".

See page 16 of the Economic Crime and Corporate Transparency Bill (https://bills.parliament.uk/publications/49554/documents/283...)

schoen• 3 years ago

That's kind of awesome!

Although it would be sad if this meant that, for example, one couldn't name a company after a programming language keyword (!?).

beardyw• 3 years ago

https://find-and-update.company-information.service.gov.uk/c...

... I could go on.

lastangryman• 3 years ago

Amazing. I would absolutely love to sit down with the Secretary of State and test their knowledge of what does of does not consist of of computer.

omnicognate• 3 years ago

Assuming this means the Secretary of State for Business and Trade (the UK has 17 Secretaries of State), the current one has a degree in computer systems engineering and has worked as a software engineer [1], so she probably has a fairly good idea.

[1] https://en.m.wikipedia.org/wiki/Kemi_Badenoch

zapdrive• 3 years ago

So "SELECT TRAVELS LTD." is prohibited? How about "Class Moving Ltd.", or "Sarah's wedding functions", or "Goto Grocery"?

jwestbury• 3 years ago

in the opinion of the Secretary of State

The Secretary of State gets to decide whether it's "computer code." It's not an objective decision. This is how things are supposed to work.

miquels• 3 years ago

Wait till they learn about Whitespace .. ( https://en.wikipedia.org/wiki/Whitespace_(programming_langua... )

ninkendo• 3 years ago

shouldn't it be:

    '; DROP TABLE "COMPANIES";--

ie. end the single quote first, so that searching by the text would be:

    SELECT * FROM "COMPANIES" WHERE "NAME" = ''; DROP TABLE "COMPANIES";--'

pxeger1• 3 years ago

From https://pizzey.me/posts/no-i-didnt-try-to-break-companies-ho...

    The company name is a bit of hacker sleight-of-hand… or as some astute people have put it, it’s ‘wrong’. Of course it’s wrong - I’m not a /total/ arsehole. :

Zuider• 3 years ago

As the blog post says, most SQL databases won't accept a name given in double quotes as the name of a table.

hparadiz• 3 years ago

I have a little bobby tables unit test in my framework and I was grinning the entire time I was writing it.

luispa• 3 years ago

Bobby tables, COO

lifeisstillgood• 3 years ago

Of course the CEO is "little Bobby Tables"

I love this - great idea :-)

sdflhasjd2• 3 years ago

There's a piece of software that's used by insurance companies for providing online quotes that (used to) contain some pretty egregious SQL injection vulns.

When this was discovered during the development of an integration, their solution wasn't to fix the disgusting spaghetti of SQL functions causing it, their recommendation was to use Javascript to remove any special characters from html inputs.

HEAD DESK

cryptonector• 3 years ago

Bobby Tables strikes again!

throw_a_grenade• 3 years ago

https://find-and-update.company-information.service.gov.uk/c...

"Fuck Poverty Ltd.", but in Polish.

Over here we're surprised it's still up, after like two years, and no-one did anything.

mhh__2• 3 years ago

Side note: UK companies are really easy to find & view filings of.

Deserves praise especially considering how much of a black hole the UK can be for conniving businesspeople and so on

ZeroClickOk• 3 years ago

I know that does not solve the problem, but I find amazing that it is so hard to open a "read-only" connection to a sql database. At least in Sql Server we need to create a User with specific rights in order to do it, and even so it is not perfect.

Drop Table “Companies”;– LTD (2016)

Related Stories