3 ms·
A company used to have an xss attack in its name. https://www.theregister.com/2020/10/30/companies_house_xss_silliness/ https://www.theregister.com/2020/10/30/c
by politelemon 3y ago
A company used to have an xss attack in its name. https://www.theregister.com/2020/10/30/companies_house_xss_silliness/ https://www.theregister.com/2020/10/30/companies_house_xss_s...
They changed it and you can only see the old name upon request
https://find-and-update.company-information.service.gov.uk/company/12956509 https://find-and-update.company-information.service.gov.uk/c...
- jeroenhd 3y agoThe old name was in this tweet: https://x.com/zofrex/status/1319286955314614275 https://x.com/zofrex/status/1319286955314614275 Looks like the XSS tried to load this script that has since been banned: https://mjt.xss.ht/ https://mjt.xss.ht/ Edit: huh, looks like HN translate 𝕏 into xn--971h.com, but the link still works. So much for my dumb twitter link.
- wcedmisten 3y agoI believe that's called punycode, and it's a common way to encode Unicode as ASCII. It also means you can use emojis in your domain. https://en.m.wikipedia.org/wiki/Punycode https://en.m.wikipedia.org/wiki/Punycode https://xn--i-7iq.ws https://xn--i-7iq.ws
- jeroenhd 3y agoYup! I was just surprised that HN translates unicode into punycode rather than letting the browser do it. I suppose it's an anti phishing system?
- TazeTSchnitzel 3y agoTo stop this happening again, the Economic Crime and Corporate Transparency Bill (which hasn't finished going through Parliament yet) adds the following text to the Companies Act 2006: > A company must not be registered under this Act by a name that, in the opinion of the Secretary of State, consists of or includes computer code.
- bspammer 3y agoI remember this - the companies house website actually wasn’t vulnerable to the attack. They removed it because someone else who downloaded and hosted the data might be.