~ INDEX ~

WTV &CODES:
The first of these WTV-specific codes were discovered by Idiotic in August '98 as he began to explore the WebTV Viewer: a WebTV simulation for PCs. To the best my knowledge, Idiotic was the first to download the Viewer with the intent of dissecting it. He was also the first to get source codes for WTV pages. Since then additional &codes have been found... and it was eventually discovered what each did.

Since the codes seemed harmless, I consulted with Idiotic and the first batch of these codes were released in early September '98. They were an immediate hit... appearing in sigs everywhere. What a mistake it was. It was soon clear that some of these codes posed a security risk and WTV's FALL '99 Client upgrade has disabled these codes on regular webpages and in mail.

So, what are these &Codes?

If you have ever used the 411 PowerOff code, you know it taks your to your box's TechInfo Screen. That URL is file://rom/htmls/TechInfo.html. It displays information such as your current Client Build version, you Silicon ID #, system configuration, etc. Unlike the WTV-SETUP:/GET codes, this page is NOT generated at WNI but within your box... afterall, if you are using a PO Code you are off-line. These &codes also appear in several other WTV pages like WTV-TRICKS:/INFO. It should be noted that many of these codes are related to the WTV-SETUP code. For more information please visit here or here.

If you were to see the actual TechInfo's page source code you'd only see &codes like &ssid and &vers. These &codes are able to display current information about your Browser's configuration and settings as well as some personal information.

All too many users have been taken aback seeing their personal information... like their zip code or phone number, in someone else's letter or post. They were unaware only they could see this information. The perp had merely included &Codes in his sig or web page.

If that's all these codes could do, they would not be a problem... except for the countless calls WNI got from Users dissatisfied about their modem speed. But, in late November '98 MasterDon figured out a method to use "forms" to grab this information from others... that is if they clicked on a button in a post or web site. Soon, the hacking NGs were filled with posts trying to con readers into pressing one button or another.

Even more insidious, in January of '99 Nonymous found a way to use a web site referrer service to grab these codes... including the potentially private information. All a user had to do was read a post or open a letter. The referrer was sent back to the service which in turn automatically e-mailed perp! The victim was totally unaware anything had happened!

But it gets worse: In February '99 ECWFRK and MirrororriM discovered they could use this referrer service to get both a user's BYOISP phone number and password! It was a haphazard process... and more than likely the BYOISP dialup was a toll call. In all cases above WNI was notified and it's no wonder WNI's fall '99 Client upgrade has disabled these codes! The referrer service was also notified how it could be abused.

Actually, there are hundreds of these &codes used in HTML. The first list here is restricted only to those specifically used to provide technical information about the WTV Browser and it's doubtful they'll work with a PC. Below are the HTML special enity codes.

USING &CODES:To use the &Codes they must be used within an HTML tag and they must end with a semi-colon. For example