The funniest thing about this (they also did this to my company) is that the name masking applies absolutely everywhere. So, for example, if they send you important mail about needing to take some regulatory action, the mail arrives addressed to 'NAME AVAILABLE ON REQUEST FROM COMPANIES HOUSE]' on the outside of the envelope, and inside it has a letter with a bunch of warnings about whatever is going to happen to the company, except it doesn't tell you the name of the company.

In what cases do they do this? What was your company called?

(Person who registered the company above here)

I suspect the actual reason for it coming up in law was because of the XSS company somebody registered some time after my meme went around. That one actually did work*, and as I understand it, there was no recourse available to companies house - they are legally obliged to accurately record company names, and the law specifies which characters can be in company names, meaning you could always serve XSS there, which they're not a fan of.

That said, they forced my company name to show as 'name available on request' now (even on letters they send me, which is kind of funny), so apparently they did find a workaround.

* On third party systems consuming the data*

for my next trick, i shall use brainfuck instead

No comment

I didn't know this, and have made the same snarky joke in dumb interviews about the company registration etc. - that's very cool and I will eat my words.

⇡ This is the founder of Drop Table

You’re sure it wasn’t just comment on the original thread? Looks like it was submitted by someone else?: https://news.ycombinator.com/item?id=13280494

He wrote a blogpost about it https://pizzey.me/posts/no-i-didnt-try-to-break-companies-ho...

Wait until you're using it on your chest in bed and accidentally poke your lips with the corner! It's a surprisingly good zap for an allowed amount of stray

Not that I've ever done that

Interesting to see this story here, I didn't know enough of that info was public to even end up here. (You have to be someone I know/know of, right?)

Basically true, though:

- Aryan wasn't the first clientmod, not even the first to deob - probably the first to go fairly 'mainstream' and end up being well known outside the circle of people using it, though (being free probably helped here)

- No legal action, tbh. Well, the same amount of legal action that all of the cheating scene got (some C&D's, domain takedown attempt type stuff at various times, but not the scary kind of legal action in the way other bots got)

- The banwave backdoor did happen, and basically as you say (iirc it was the actual UID but negative, rather than -1) but was more of a conscious decision, there wasn't an 'agreement' beforehand - it was proactively taken. Jagex were informed about it in order to detect it though, as far as I'm aware.

> (You have to be someone I know/know of, right?)

Doubtful. I was just a kid at the time who lurked on forums. Were you involved in the scene? If yes, do you mind if I ask what you ended up doing professionally? RS cheat developers were my role models growing up. I’ve often wondered what members of that community are up to now.

Yep, I used the nick 'Mopman' then, if you remember that name at all. Kind of appropriately for the name, I was mostly a janitor :D Admin @ Moparscape and the public Aryan channels, there's a few commits of mine in the bot but I definitely can't take credit for most of the bot itself, that was other peoples work. I did make few releases of it after the banwave incident you mention, though quickly passed that torch on (it was a lot of hassle, tbh).

Professionally nowadays I'm a pen tester/security consultant.

That's so cool. I'm star struck. I haven't thought about RuneScape in a very long time, but this thread has made me overcome with a bitter sweet sense of nostalgia. I knew so little about programming back then, so people who could manipulate this game I loved with their own code were like gods to me. The whole experience made a very strong impression on me. Thank you!

Or no exploits at all, ie. post exploitation frameworks, control channels etc. only.

EDIT: Nevermind they added something to the countermeasures repo that goes against that.

Try making it an XSS payload - that one often works ;)

It was online so no 'looks' but I did end up having a very odd phone call at one point.

In all seriousness, doesn't this cause problems for you when registering for bank accounts, or trying to do any business activity with your company name? I think the whole thing is hilarious, I just can't believe it seems like you're actually using the company!

Haha! Yes, that reaction happens a lot - a friend tried to discourage me from doing it actually for that reason, but I told him I'd just rename it if it became burdensome. So far it has only been a little bit burdensome.

Bank account was actually incredibly easy, that is the one I expected to be difficult, too. I had no problems at all, I made an account with the usual process. Should note I'm using one of those new-fangled 'challenger banks' so they're probably quite tech savvy/their systems aren't 50 years old, that probably helped.

The worst one has been the domain name, oddly. I wanted to get the .ltd.uk domain name (only available to registered companies in the UK) to basically complete/highlight the joke. But, I have been waiting for over a year or something now for it to actually be registered, it keeps being rejected by the registrar (there is a weird validation process to make sure you're a real company, etc). I could have sped it up by trying with a better registrar who are more aggressive at getting things done, probably, I had a few offers from smaller registrars - but I just went for the .co.uk in the end instead.