Was re reading Unwired and came across something that has me confused.

Page 79 Security in action. Describes a hacker hacking himself an admin account on a node then shutting down a piece of Ice. It then mentions this. "Since Jin is watching the Node she makes a matrix perception teset to see if she notices the program being shut down, and suceeds...."


so the question is what is this ? according to how i understood how the rules worked the times when a hacker might be noticed are when logging on. When using a hacking/exploit program, when the access list updates and when the node ice or spider randomly scans the node using analyze.

I can understand the abstract of a security spider noticing Ice suddenly winking out or icons for peripheral connected objects going on off. But i have never seen any rule dealing with this, is this just a mistake in the text or were is the game mechanics behind a hacker noticing another stealthed hackers actions. is it an opposed stealth vs analyze roll or is it a treshold roll or what.

It is a simple Matrix Perception Roll to notice that your IC was just shut down, assuming you are not alerted on such an occurence automatically (You are the Spider after all, and you know what SHOULD be running). You may not know that a HACKER did that (he is probably stealthed, but I bet you start looking for that too), but it is odd, and you will likely start to investigate such an occurence. You will surely reactivate the IC at a minimum.

Of course if the Hacker is good enough he has already spoofed/edited the IC whitelist such that the IC will ignore him.

(IMG:style_emoticons/default/rotate.gif)

Assuming that you have access to that information ON THE NODE YOU ARE ON. Why make that assumption?

If I'm hacking the node and I know there is a Spider active, then that would be the first thing I would try to do after I shut down the IC. Make the changes while it is offline and when the Spider restarts it the IC reads its whitelist and goes about its business. Changing the list while the IC is active is fraught with peril.

Except that the IC may not be on the Node you are on when it is reactivated. It may be on a different node, and thransfer there from activation. Which was my point, of course. (IMG:style_emoticons/default/smile.gif)

Well then, yeah. Will have to find another way to hamper the IC from finding you. :/

So what would be the game mechanic behind this ?

matrix perception vs treshold
computer + analyze vs a treshold defined by the gm

or a test vs stealth to notice the change in the system ?
computer + analyze vs hacking + stealth

The change is not a stealth one. If you have a program list active, and one of the programs goes inactive, it is pretty obvious.

I would likely use just a Matrix Perception Test. Success means you notice the change. For something like changing data in a file, that would be different. You would need to audit the file. But, once you have done so, you likely catch the change. Even if you do not know what WAS removed, you will see the "blank" spot. If you are looking for altered Data, then you will need to audit it more specifically. Maybe with a Threshold equal to the Edit Successes. Cannot remember right off the top of my head, though.

Obviously said hacker in this scenario doesn't have a Disarm program. If the IC is armed with Analyze, disarm it. If the IC is also armed with Attack, maybe disarm it too. Might slow you down a bit, but substantially less obvious than switching a program off on a node that's being watched from the outside.

Indeed, this is one way to go about it, and is indeed my preferred method. Well, that and not being detected in the first place. I don't mess with IC generally, unless I have to do so. (IMG:style_emoticons/default/smile.gif)

Since there is no "official" way to hide it (that I'm aware of), it should be a standard Perception thing. Unloading IC is not a big explosion but also not exactly difficult to detect, so threshold 2 seems appropriate.

Moral of the story: Disarm programs when you got the time

Which is why you always get mute for your Exploit program. Perhaps you raise an alert in a turn, but with no analyze program, they can't do matrix perception to get through your stealth and actually find you.

No threshold, just a standard matrix perception test. If stealth is running, then it's opposed. See the sidebar in the core book about net hits being used to see bits of information.

Also be aware that Analyze programs have an Automatic Mode that does all this for you automatically. You have to turn it on, tho.

The examples given for things one hit detects are "neon sign, running crowd, yelling, gunfire". I think unloading the IC is a bit more subtle (IMG:style_emoticons/default/wink.gif)