Drop Table Companies Ltd | Hacker News Reader

Drop Table Companies Ltd

beta.companieshouse.gov.uk

The registrant himself: https://pizzey.me/blog/no-i-didnt-try-to-break-companies-hou...

Nice of the author to be careful with the joke. I seriously hope company name x'); DROP TABLE 'Companies';-- wouldn't work either though

Someone also has a "DROP TABLE" license plate, apparently it once worked against a scanner too.

https://hackaday.com/2014/04/04/sql-injection-fools-speed-tr...

The “,0,0” makes me think the person had inside knowledge

Or they started adding parameters until some test procedure started working.

Discussed in 2016: https://news.ycombinator.com/item?id=13280494

Bobby Tables. Founder, CEO.

I always keep multiple bobby table contacts in multiple variations in my address book in case it gets leaked somehow.

Is there any example of SQL injections that worked IRL ? That's so funny.

What do you mean by "IRL" ? SQL injections work every day, I think it's still the number one in the OWASP top 10.

My wifi name is a drop_table NETWORKS injection. Never heard of it affecting anything though.

Try making it an XSS payload - that one often works ;)

There's the stories of people named Null that make various systems crash or reject them, probably because they coerce to strings before checking for a "null" value.

I had a classmate named «Faux» (which means “false” in French) and it caused many bugs with Excels spreadsheets in our school.

Just having those Unicode characters in his name is bad enough!

The Twitter account "Ominous Null" shares real-life examples of systems mishandling null values:

https://twitter.com/ominous_null/

I once read a story on Reddit about a payroll processor with an utterly unholy mess of a system. One day, they get a customer called "Select", and the entire system stopped working.

This isn't SQL, but HP printers' settings protocol uses XML and doesn't escape Wi-Fi SSIDs, so it breaks completely whenever any nearby SSID includes < or >. Which wouldn't be a massive problem, except for that Com Hem (our Comcast) has set their default SSID to COMHEM<(start of router MAC)>.

Not SQL but I once set my Wifi hotspot to "NULL" in the lecture hall and someone started complaining that their phone was crashing constantly.

The sheer number of devices that have these kinds of vulnerabilities is simply insane.

Obligatory xkcd: https://xkcd.com/327/

LITTLE BOBBY TABLES you say? https://beta.companieshouse.gov.uk/company/11244754

Looks like it didn't work!

Is this even real? I can only imagine the look at the chambers of commerce when somebody registered this.

Also, this looks a typical system that would be vulnerable to this. At least where I live the details are always entered by a clerk, the systems are old and were never meant to be used directly by outside parties.

It was online so no 'looks' but I did end up having a very odd phone call at one point.

In all seriousness, doesn't this cause problems for you when registering for bank accounts, or trying to do any business activity with your company name? I think the whole thing is hilarious, I just can't believe it seems like you're actually using the company!

Haha! Yes, that reaction happens a lot - a friend tried to discourage me from doing it actually for that reason, but I told him I'd just rename it if it became burdensome. So far it has only been a little bit burdensome.

Bank account was actually incredibly easy, that is the one I expected to be difficult, too. I had no problems at all, I made an account with the usual process. Should note I'm using one of those new-fangled 'challenger banks' so they're probably quite tech savvy/their systems aren't 50 years old, that probably helped.

The worst one has been the domain name, oddly. I wanted to get the .ltd.uk domain name (only available to registered companies in the UK) to basically complete/highlight the joke. But, I have been waiting for over a year or something now for it to actually be registered, it keeps being rejected by the registrar (there is a weird validation process to make sure you're a real company, etc). I could have sped it up by trying with a better registrar who are more aggressive at getting things done, probably, I had a few offers from smaller registrars - but I just went for the .co.uk in the end instead.

Registered 29th December, 2016. [0]

[0] https://beta.companieshouse.gov.uk/company/10542519/filing-h...

Reply on news.ycombinator.com