Matthew1471's ASP BlogX

I just had an e-mail which was far too good to fail to make any comments and poke holes at.

"FRESHERS CARNAGE IS HERE!" it exclaims the second paragraph in.

We're killing freshers now?! Second and third year revolt!?

"What else do we need to say? THE biggest bar crawl ever to hit university life just arrived for its autumn term installment!!" now this being from a company formally known as "StudentNightTickets" is to be expected.. but what is this carnage they are refering to?

Plus, do we really hate freshers that much that we wish to excercise "The savage and excessive killing of many people" on first years?

For those of you who dont know what Carnage is (i.e. me) "read here" the e-mail states :

"Carnage is probably the most well known event that carnival holds, it involves quite simply dressing up in the theme we give you, or any theme for that matter, we all meet in the guild for pre - drinks and picture taking whilst we are sober enough to look semi decent, and everyone still has the majority of their costumes intact!! Next on a bus to town, the bus journey should never be missed you will learn many new drinking games and the sports teams like to teach you songs with absurd lyrics!!! Pile off the bus and do a bar crawl through town; harass many people by completing the dares on your t-shirt which always involve pulling as many stewards as poss!!! We end up at Oceana, if you make it that far, u are truly a hardcore carnival groupie!!!!"

Go on, preach to me that Birmingham University supports a "Safe and mature drinking" policy... Go on.. lie to me... Whilst they're learning their myriad of drinking games, absurd lyrics and looking anything beyond semi decent you can just imagine this now "Hi, i'm Dave, founder of "Freshers Carnage" and I have an important announcement to make..firstly you're all going to get completely and totally wrecked on this boose up.. and secondly, The University of Birmingham PR department has advised us to inform you that the UoB has a safe drinking policy.." now, on to the drinks!

This is part 2 of the step by step in-order documentation of the NatWest Card Reader and my findings and review of it.

Introduction :
On the 16th of August 2007 I receive a letter from my bank.. "Oh not ANOTHER terms and conditions change? It's not like I read the last 7.. Right, fire up the shredder!" but no, this one had a rather exciting heading so we went for it..

You can catch up on how that went here because we're not going through all that again.. why? Well this isn't "Part 1" anymore, no, it's Part 2.. We get it out!

Packaging :
Firstly it's packaged in a plastic wrap, inside bubble wrap inside a box inside a box on a tray... No expenses, plastic or environment spared..

When you get the device out it just looks like a calculator.. fairly unimpressive and in fact I got rather bored of this "2 Part Special" after opening the box.. but anyway.. on to the detail.

Interesting Details :
- It is completely stand alone and does not connect with your computer in any way.. other than requiring you to enter in a number you see on screen and for you to read the number off it and type it back in on your keyboard.

- The device is capable of barring/blocking your card.. With "Chip and pin" the pin is ACTUALLY stored on the chip (I didn't know this.. I assumed the chip was just some serial number but in actual fact they are WRITING the new pin to the card when you change your PIN)

Get your PIN wrong 3 times on this device and you're looking at speaking to the jolly good people at your bank.

Are there security implications? I think there are..

"something tells me that some clever clogs will modify this device to not lock the card after 3 incorrect guesses and thus make a PIN cracking tool out of it." (http://blog.jazzle.co.uk/why-i-might-leave-my-bank-the-natwest-card-reader)

Though also on that page they dictate it is actually the chip that does all the processing including locking itself out.. I'm no chip and pin expert so I'll have to leave that to the experts.

- At the moment only certain high-risk transactions (paying people) initiate a "You need a reader" session.. though I imagine the number of card-reader required tasks will increase.

- On another environment related note.. It's cheaper for NatWest to send you a new card reader than batteries for an existing one (http://blog.jazzle.co.uk/why-i-might-leave-my-bank-the-natwest-card-reader)

- The basic idea for the device is that it runs some clever number crunching on your card, incorporates the number the website gives you and returns back a code.. the NatWest server validates this code and the job is done..

- The increased security idea is that someone would also need this device (or at the very least the numbers off your card and the algorithm) to emulate such a response even if they know your password/PIN. Also, you are not typing your password or PIN numbers in to perform certain requests, so whereas before a key logger could be installed on people's computers (especially the non computer wizardry folk's) and this would mean the password/PIN was a free for all.. This is the second level of security the card reader will add... Though this will make little difference to my security as I would like to think I would notice a key logger installed.

- This card reader will only work with newer cards with small chips, the fatter chips are close but no cigar for this little reader.

- As for NatWest rolling them out, changing a card or an old card expiring seems to force you to receive one of these cards... After all the card reader won't read "old school" cards.. so it'd be pointless them giving you one in advance.

- Apparently this card reader will work with other banks too.. the algorithm is in principle the same. Though I cannot confirm this.

Photos & Screenshots :

I couldn't find anywhere on the internet that already offered this so I had to make a makeshift solution myself using network sniffing software and a bit of research.

Do you want to use VBScript to ask a UPnP capable router what its current external IP address is?

Open up notepad and save this as "WhatIsMyIP.vbs"



Notes :

• I haven't actually set this script to properly interpret the response


• This code is based on the Linksys WRT54GS (I imagine the WRT54G and WRT54GL will handle it just as well).


• It should work on all Linksys routers but I haven't any other Linksys equipment to hand to test this...


• I am assuming your router's IP address is 192.168.1.1 (The default)

Either way this is a pretty neat script that you can go on to use in other Visual Basic or VBScript.. I for instance originally had my server e-mail me of any IP address changes of the main network adapater.. but since installing the router this somewhat messed it up.. thankfully this little script now provides a suitable work around.

I'm sure others will have a use for this too.

Keywords : UPnP, IP Address, Visual Basic, VBScript, SOAP, External, Address, Router, Linksys, WRT54, WRT54GS, WRT54GL