pizzeys

'Download Github and look at the code'?

The funniest thing about this (they also did this to my company) is that the name masking applies absolutely everywhere. So, for example, if they send you important mail about needing to take some regulatory action, the mail arrives addressed to 'NAME AVAILABLE ON REQUEST FROM COMPANIES HOUSE]' on the outside of the envelope, and inside it has a letter with a bunch of warnings about whatever is going to happen to the company, except it doesn't tell you the name of the company.

(Person who registered the company above here)

I suspect the actual reason for it coming up in law was because of the XSS company somebody registered some time after my meme went around. That one actually did work*, and as I understand it, there was no recourse available to companies house - they are legally obliged to accurately record company names, and the law specifies which characters can be in company names, meaning you could always serve XSS there, which they're not a fan of.

That said, they forced my company name to show as 'name available on request' now (even on letters they send me, which is kind of funny), so apparently they did find a workaround.

* On third party systems consuming the data*

for my next trick, i shall use brainfuck instead

No comment

I didn't know this, and have made the same snarky joke in dumb interviews about the company registration etc. - that's very cool and I will eat my words.

Wait until you're using it on your chest in bed and accidentally poke your lips with the corner! It's a surprisingly good zap for an allowed amount of stray

Not that I've ever done that

Yep, I used the nick 'Mopman' then, if you remember that name at all. Kind of appropriately for the name, I was mostly a janitor :D Admin @ Moparscape and the public Aryan channels, there's a few commits of mine in the bot but I definitely can't take credit for most of the bot itself, that was other peoples work. I did make few releases of it after the banwave incident you mention, though quickly passed that torch on (it was a lot of hassle, tbh).

Professionally nowadays I'm a pen tester/security consultant.

Interesting to see this story here, I didn't know enough of that info was public to even end up here. (You have to be someone I know/know of, right?)

Basically true, though:

- Aryan wasn't the first clientmod, not even the first to deob - probably the first to go fairly 'mainstream' and end up being well known outside the circle of people using it, though (being free probably helped here)

- No legal action, tbh. Well, the same amount of legal action that all of the cheating scene got (some C&D's, domain takedown attempt type stuff at various times, but not the scary kind of legal action in the way other bots got)

- The banwave backdoor did happen, and basically as you say (iirc it was the actual UID but negative, rather than -1) but was more of a conscious decision, there wasn't an 'agreement' beforehand - it was proactively taken. Jagex were informed about it in order to detect it though, as far as I'm aware.

Or no exploits at all, ie. post exploitation frameworks, control channels etc. only.

EDIT: Nevermind they added something to the countermeasures repo that goes against that.

Try making it an XSS payload - that one often works ;)

Haha! Yes, that reaction happens a lot - a friend tried to discourage me from doing it actually for that reason, but I told him I'd just rename it if it became burdensome. So far it has only been a little bit burdensome.

Bank account was actually incredibly easy, that is the one I expected to be difficult, too. I had no problems at all, I made an account with the usual process. Should note I'm using one of those new-fangled 'challenger banks' so they're probably quite tech savvy/their systems aren't 50 years old, that probably helped.

The worst one has been the domain name, oddly. I wanted to get the .ltd.uk domain name (only available to registered companies in the UK) to basically complete/highlight the joke. But, I have been waiting for over a year or something now for it to actually be registered, it keeps being rejected by the registrar (there is a weird validation process to make sure you're a real company, etc). I could have sped it up by trying with a better registrar who are more aggressive at getting things done, probably, I had a few offers from smaller registrars - but I just went for the .co.uk in the end instead.

It was online so no 'looks' but I did end up having a very odd phone call at one point.

Nah - brokenness is intentional. I'm sure Companies House application is secure, but I don't know if all the applications scraping it/using its feeds are, so I couldn't be /too/ real.

:)

Not that risky though - it looks more like an SQL injection than it actually is. I actually didn't think it would get this much attention - I went to bed!