6 ms·
Drop Table “Companies”;– LTD (2016)
- nidnogg 3y agoAppears on Linkedin [1] as well, albeit automatically generated [1] https://www.linkedin.com/company/-drop-table-companies----ltd/about/ https://www.linkedin.com/company/-drop-table-companies----lt...
- aduffy 3y agoI believe in their culture this is called a “total mad lad move”
- xenophonf 3y agoNow I want to register a company named "Pure Big Mad Computer Man" (with apologies to Iain Banks).
- pertymcpert 3y agoYou're almost there. Just s/total/totes
- oaktowner 3y agoCEO: Bobby Tables.
- bitwize 3y agoBetter him than Kotick.
- nathell 3y agoSimilarly-named Polish company: https://aplikacja.ceidg.gov.pl/ceidg/ceidg.public.ui/searchdetails.aspx?id=e82735cd-bc2b-4ac0-8bac-a1dc54d8c013 https://aplikacja.ceidg.gov.pl/ceidg/ceidg.public.ui/searchd... Also relevant: https://www.theguardian.com/uk-news/2020/nov/06/companies-house-forces-business-name-change-to-prevent-security-risk https://www.theguardian.com/uk-news/2020/nov/06/companies-ho...
- notahacker 3y agoBlog on it by the company founder: https://pizzey.me/posts/no-i-didnt-try-to-break-companies-house/ https://pizzey.me/posts/no-i-didnt-try-to-break-companies-ho...
- seydor 3y agoNow we know, Samuel Pizzey is Bobby Tables
- retrocryptid 3y agoI believe he's Bobby's brother... Sammy Tables.
- _the_inflator 3y agoSomeone has to do it: https://xkcd.com/327/ https://xkcd.com/327/
- Dwedit 3y agoThat's the joke.
- kijin 3y agoUnfortunately, the Companies House doesn't seem to allow a quote character at the beginning. Gotta terminate that string literal before you start injecting your own statements!
- superluserdo 3y agoSee also https://find-and-update.company-information.service.gov.uk/company/12956509 https://find-and-update.company-information.service.gov.uk/c... >THAT COMPANY WHOSE NAME USED TO CONTAIN HTML SCRIPT TAGS LTD >Previous company names >[NAME AVAILABLE ON REQUEST FROM COMPANIES HOUSE] https://forum.aws.chdev.org/t/cross-site-scripting-xss-software-attack/3355 https://forum.aws.chdev.org/t/cross-site-scripting-xss-softw...
- benlivengood 3y agoI wonder what happened to it; maybe there's another company named "; UPDATE COMPANIES SET STATUS='DISSOLVED' WHERE ID=10542519;-- LTD"
- politelemon 3y agoA company used to have an xss attack in its name. https://www.theregister.com/2020/10/30/companies_house_xss_silliness/ https://www.theregister.com/2020/10/30/companies_house_xss_s... They changed it and you can only see the old name upon request https://find-and-update.company-information.service.gov.uk/company/12956509 https://find-and-update.company-information.service.gov.uk/c...
- jeroenhd 3y agoThe old name was in this tweet: https://x.com/zofrex/status/1319286955314614275 https://x.com/zofrex/status/1319286955314614275 Looks like the XSS tried to load this script that has since been banned: https://mjt.xss.ht/ https://mjt.xss.ht/ Edit: huh, looks like HN translate 𝕏 into xn--971h.com, but the link still works. So much for my dumb twitter link.
- wcedmisten 3y agoI believe that's called punycode, and it's a common way to encode Unicode as ASCII. It also means you can use emojis in your domain. https://en.m.wikipedia.org/wiki/Punycode https://en.m.wikipedia.org/wiki/Punycode https://xn--i-7iq.ws https://xn--i-7iq.ws
- jeroenhd 3y agoYup! I was just surprised that HN translates unicode into punycode rather than letting the browser do it. I suppose it's an anti phishing system?
- TazeTSchnitzel 3y agoTo stop this happening again, the Economic Crime and Corporate Transparency Bill (which hasn't finished going through Parliament yet) adds the following text to the Companies Act 2006: > A company must not be registered under this Act by a name that, in the opinion of the Secretary of State, consists of or includes computer code.
- bspammer 3y ago
- popcalc 3y agoRelevant: https://news.ycombinator.com/item?id=36094691 https://news.ycombinator.com/item?id=36094691
- krylon 3y agoThat must be in the top five, possibly even top three of the coolest company names of all time.
- gumballindie 3y agoFrom what I've seen, gov contractors don't really know what an SQL injection is, but they use frameworks so its all good. Bad thing is that some of these frameworks sanitise rather than escape data and the injection may slip through. I wouldn't be surprised if a system somewhere that reads this company name will just crash one day out of the blue.
- ta1243 3y agoGDS are great - and at the time this company was registered they were even better, hence this doesn't cause any problems. However that doesn't mean downstream users of the data treat data sources correctly
- abulman 3y agoI can assure you that as someone that has done a couple Gov-related public-sites, some developers do think about it, and use suitable tools to ensure there's no issues. Before the last-and-stolen-passports site went live (that I spent most of 2014 getting live - not writing - but mostly trying to get deployed), we did have a conversation, and easily proved that people called Mr or Mrs Null and/or O'Brien would have no problems. That conversation was also somewhat prompted by the Dartford Crossing site that went live a little before us - which had 'some issues'.
- highwaylights 3y agoBobby Tables Incorporated
- rickreynoldssf 3y agoIt would have been better if Bobby Tables was listed as an officer.
- seabass-labrax 3y agoA missed opportunity, even, as you can trade under any name in Britain as long as it's not deceptive.
- dang 3y agoRelated: ; DROP TABLE "COMPANIES";-- LTD - https://news.ycombinator.com/item?id=27815396 https://news.ycombinator.com/item?id=27815396 - July 2021 (30 comments) Drop Table “Companies”;-- LTD - https://news.ycombinator.com/item?id=21534156 https://news.ycombinator.com/item?id=21534156 - Nov 2019 (7 comments) Drop Table “Companies”;– LTD - https://news.ycombinator.com/item?id=20583540 https://news.ycombinator.com/item?id=20583540 - Aug 2019 (2 comments) Drop Table Companies Ltd - https://news.ycombinator.com/item?id=17003588 https://news.ycombinator.com/item?id=17003588 - May 2018 (27 comments) Drop Table Companies Ltd - https://news.ycombinator.com/item?id=13280494 https://news.ycombinator.com/item?id=13280494 - Dec 2016 (23 comments)
- lifeisstillgood 3y agoOf course the CEO is "little Bobby Tables" I love this - great idea :-)
- amelius 3y agoDon't give your tables reasonable names.
- LegitShady 3y agotbl_dims_cstmr
- freitzkriesler2 3y agoMy heros
- qingcharles 3y agoBack in 2000 Coca-Cola had an auction site. I put a HTML comment tag in my username and the words "AUCTION ENDED". The result of which was that whenever I bid on anything it would erase the bid submit button after my name -- therefore no-one else could bid on anything. https://web.archive.org/web/20010223090106/http://cokeauction.co.uk/ https://web.archive.org/web/20010223090106/http://cokeauctio... This worked for a short time. Then my account disappeared with all my (very hard earned) credits in it. Then I received a letter from the MD of Coke UK telling me I was a very naughty boy.
- smcleod 3y agoBidding on a “cokeauction” is a very different thing in 2023.
- nchase 3y agoWhat is a cokeauction in 2023?
- smcleod 3y agoI assume it would be something folks would do on the dark web.
- LegitShady 3y agoA white house activity
- sdflhasjd 3y ago> Then I received a letter from the MD of Coke UK telling me I was a very naughty boy. Truly better than any prize. I got a similar letter from my school's headteacher after some extracurricular IT shenanigans. I'm still proud of that one.
- qingcharles 3y agoHa! Within weeks of entering primary school at 11 I had persuaded the son of the IT teacher to give me his Dad's admin password for the school network. I caused untold chaos and was banned from touching the computers for the rest of my school history.
- saulr 3y agoThis ultimately resulted in a new restriction in a bill making its way through Parliament that "a company must not be registered under this Act by a name that, in the opinion of the Secretary of State, consists of or includes computer code". See page 16 of the Economic Crime and Corporate Transparency Bill (https://bills.parliament.uk/publications/49554/documents/2831 https://bills.parliament.uk/publications/49554/documents/283...)
- schoen 3y agoThat's kind of awesome! Although it would be sad if this meant that, for example, one couldn't name a company after a programming language keyword (!?).
- beardyw 3y agoLike https://find-and-update.company-information.service.gov.uk/company/13199971 https://find-and-update.company-information.service.gov.uk/c... https://find-and-update.company-information.service.gov.uk/company/07692623 https://find-and-update.company-information.service.gov.uk/c... https://find-and-update.company-information.service.gov.uk/company/12222289 https://find-and-update.company-information.service.gov.uk/c... ... I could go on.
- cachvico 3y agoThat's why the Secretary of State (very important person) gets to make the call.
- lastangryman 3y agoAmazing. I would absolutely love to sit down with the Secretary of State and test their knowledge of what does of does not consist of of computer.
- omnicognate 3y agoAssuming this means the Secretary of State for Business and Trade (the UK has 17 Secretaries of State), the current one has a degree in computer systems engineering and has worked as a software engineer [1], so she probably has a fairly good idea. [1] https://en.m.wikipedia.org/wiki/Kemi_Badenoch https://en.m.wikipedia.org/wiki/Kemi_Badenoch
- ninkendo 3y agoshouldn't it be: '; DROP TABLE "COMPANIES";-- ? ie. end the single quote first, so that searching by the text would be: SELECT * FROM "COMPANIES" WHERE "NAME" = ''; DROP TABLE "COMPANIES";--'
- pxeger1 3y agoFrom https://pizzey.me/posts/no-i-didnt-try-to-break-companies-house/ https://pizzey.me/posts/no-i-didnt-try-to-break-companies-ho... The company name is a bit of hacker sleight-of-hand… or as some astute people have put it, it’s ‘wrong’. Of course it’s wrong - I’m not a /total/ arsehole. :
- deleted 3y ago[deleted]
- Zuider 3y agoAs the blog post says, most SQL databases won't accept a name given in double quotes as the name of a table.
- hparadiz 3y agoI have a little bobby tables unit test in my framework and I was grinning the entire time I was writing it.
- luispa 3y agoBobby tables, COO
- sdflhasjd 3y agoThere's a piece of software that's used by insurance companies for providing online quotes that (used to) contain some pretty egregious SQL injection vulns. When this was discovered during the development of an integration, their solution wasn't to fix the disgusting spaghetti of SQL functions causing it, their recommendation was to use Javascript to remove any special characters from html inputs. HEAD DESK
- cryptonector 3y agoBobby Tables strikes again!
- throw_a_grenade 3y agohttps://find-and-update.company-information.service.gov.uk/company/13789171 https://find-and-update.company-information.service.gov.uk/c... "Fuck Poverty Ltd.", but in Polish. Over here we're surprised it's still up, after like two years, and no-one did anything.
- mhh__ 3y agoSide note: UK companies are really easy to find & view filings of. Deserves praise especially considering how much of a black hole the UK can be for conniving businesspeople and so on
- ZeroClickOk 3y agoI know that does not solve the problem, but I find amazing that it is so hard to open a "read-only" connection to a sql database. At least in Sql Server we need to create a User with specific rights in order to do it, and even so it is not perfect.