How Can Company Names Trigger Website Hacks?

TL;DR

Company names can trigger cross-site scripting when websites insert database text into HTML without safely encoding it. A British company registered a name containing script tags, exposing risks in Companies House data feeds, while the separate NULL license plate case showed how special database values can misroute records and create persistent administrative errors.

Transcript

We've all probably heard the story of Bobby Tables. You know this Bobby, the one whose mom named him with a special little string for a middle name. Little uh drop table students as as mom so affectionately calls him, Bobby Tables. Classic. Absolute classic. The joke here, in case you missed it, is since schools and other resources are going to tak... Read More

Key Insights

• Company names are untrusted input when they move from a registry into websites, documents, or data feeds. A legal name containing HTML syntax can become executable code if a receiving system interprets the stored text as markup instead of displaying it safely.
• Cross-site scripting works in this case by placing a script tag inside a company name and relying on unsafe HTML rendering. The chosen script produced a harmless alert, but the successful execution demonstrated that a malicious script could potentially pursue more damaging objectives.
• Safe HTML encoding is the central defense against this company-name attack. The transcript notes that arbitrary strings should be encoded before display and that React performs this protection by default unless a developer deliberately uses its special dangerouslySetInnerHTML capability.
• Companies House explicitly allowed characters such as quotation marks and angle brackets in company names. The director interpreted that policy as a sign that suitable security protections probably existed, then contacted Companies House and the National Cyber Security Center after discovering problems.
• Companies House responded by forcing the business to change its legal name and removing the original value from its data feeds. Documentation that once referenced the original name was changed to say that the company name was available on request.
• The XSS testing service linked by the company name was designed to reveal successful cross-site scripting. When a vulnerable page loaded the injected script, it displayed an alert indicating that the site had been compromised, providing a visible proof of the rendering flaw.
• The NULL license plate case demonstrates a different form of unsafe special-value handling. A security researcher registered NULL as a vanity plate, after which $12,000 in traffic fines from places he had never visited were wrongly directed to him.
• Unusual identifiers expose hidden software assumptions because systems may treat legitimate text as commands, markup, or missing data. The company name became HTML, while the plate NULL collided with a database-like representation for an absent or invalid license plate.

Questions & Answers

Q: How can a company name hack a website?

A company name can trigger a website vulnerability when it contains HTML or script syntax and the website inserts that stored value directly into a page. In the described case, the legal name included script tags pointing to an XSS testing service. An unsafe site could interpret those characters as executable markup instead of ordinary company-name text.

Q: What vulnerability did the Companies House name reveal?

The company name revealed a cross-site scripting risk. Its embedded script could execute when a site failed to handle the name as plain text and instead treated it as HTML. The selected script only displayed a harmless alert, but that result proved the same weakness could potentially be used as a gateway to more damaging behavior.

Q: Why did Companies House force the business to change its name?

Companies House concluded that the registered characters could present a security risk when the name appeared on unprotected external websites used by some customers. It forced a legal name change, removed the original value from data feeds, and replaced references in documentation with a notice saying the company name was available on request.

Q: How should websites safely display unusual company names?

Websites should safely encode arbitrary company-name strings before placing them in HTML. Encoding ensures that quotation marks, angle brackets, and script-like text appear as visible characters instead of becoming executable markup. The transcript also notes that React applies this protection by default unless a developer deliberately uses the special dangerouslySetInnerHTML function.

Q: Did the company director intend to cause damage?

The director said the name was intended to be fun and playful for a software consulting business, not destructive. After discovering minor problems, he contacted Companies House and the National Cyber Security Center immediately and did not disclose the issue elsewhere. The embedded script was configured to show a harmless alert as proof of the vulnerability.

Q: Why did the director think the company name would be safe?

The director believed there probably would not be a problem because Government Digital Services had a good security reputation and similarly playful company names had been registered previously. Characters used in the name, including quotation marks and angle brackets, were also explicitly permitted, which suggested to him that protective handling had already been implemented.

Q: What happened to the person with the NULL license plate?

A security researcher registered the vanity plate NULL and initially had an uneventful first year. Later, the DMV website stopped accepting NULL during renewal, and unrelated citations began arriving from places he had never visited. He ultimately received $12,000 in traffic fines that belonged to other vehicles and faced uncertainty about registration renewal.

Q: What do the company-name and NULL plate cases have in common?

Both cases show valid real-world identifiers colliding with assumptions inside software systems. The company name contained HTML that unsafe websites could interpret as code, while NULL matched a special-looking value associated with missing or invalid plate information. In each case, insufficient handling transformed legitimate text into unintended system behavior.

Summary & Key Takeaways

• A British software engineer registered a consulting company whose legal name contained HTML script tags pointing to an XSS testing service. Companies House permitted the relevant characters, but the name exposed unsafe handling in government data feeds and potentially in external websites that published those records without protection.

• The embedded script was intended to display a harmless alert, proving that code could execute where the company name was interpreted as HTML. Companies House forced a name change, removed the original name from its data feeds, replaced documentation references with a request-only notice, and introduced preventive measures.

• The NULL vanity license plate produced a related database failure. Records representing missing or invalid plates were apparently associated with the real plate value NULL, causing its owner to receive $12,000 in unrelated traffic fines. Both cases demonstrate how unusual but valid identifiers reveal flawed assumptions in software systems.