Hacking my way Options

[Serbitar]

This is the first post in a series, where I want to present my interpretation of hacking runs.
With several posts (all int his thread) I want to cover several situations, and my interpretation of how the matrix rules can be used and balanced.

(might not be the order of final posting)
Hacking a host and performing a data steal
Hacking through a relay of linked nodes
Hacking a security camera and performing overwatch
Hacking someone's wireless equipment
Hacking into a drone network

TODAY: Hacking a host and performing a data steal
Note that this is only my interpretation and not final. I might edit this post a lot during the next days, depending on comments and other considerations, but I will note changes by using different colours and maintaining a changelist.

General comments:

Deleted subscriber house rule

1.) When you successfully hack in, you have a valid user/security/admin account for this session only. When you leave the node, your account has gone. Legal actions (actions covered by the permissions of the account) can be performed by a simple computer+skill test (if needed at all). Illegal actions (actions not covered by the permissions of the account) must be perfomred by an opposed hacking+skill test vs. system+firewall of the node. The GM may call for an extended oppesed test if a certain treshold has to be achieved. Net hits of the node determine that the node notices that something is being tempered with. The GM decides what happens with which number of net hits.

2.) IC/agents have to successfully detect a stealthed hacker to engage in actions (including analyzing hack attempts) against him.


(H) Hacker:
Hacking: 5 (specialization stealth)
Computer: 5

Hot-SIM: +2 dice

Firewall: 5
Response: 5
Firewall: 5
Signal: 5

Loaded programmes:

- Exploit 5
- Analyze 5
- Browse 5
- Stealth 5

Not loaded programmes:

- Edit 5



(N) Node:
Firewall: 4
System: 4
Signal: 4
Response: 4

Loaded programmes:

-Analyze 4

(IC1) IC: Patrol-1
Pilot 4
-Analyze 4
-Attack 4
-Armor 4

(IC2) IC: Patrol-2
Pilot 4
-Analyze 4
-Attack 4
-Armor 4


Steps:
(bold steps denote the minimal version of this example)

(H) Hacking In
(N) Noticing the Hack
(H) Matrix Perception
(IC1) Matrix Perception
(H) Stealth roll
(IC2) Matrix Perception
(H) Stealth roll
(H) Unload Exploit
(H) Load Edit
(H) Browsing for Data
(H) Browsing for Data
(N) Noticing the Hack
(IC2) Noticing the Hack
(H) Stealth roll
(H) Downloading the Data
(N) Noticing the Hack
(IC2) Noticing the Hack
(H) Stealth roll
(H) Logging off

Explained:

(H) Hacking In
Hacking+Exploit(Firewall, 1 Turn): 5+5+2 = 4 hits (porb. to fail hacking in in 1 turn: 39%)

The hacker is trying to hack into the node. He is going for a user account. The rules say he has to engage in a Hacking+Exploit (firewall, 1 turn) test, to do so. With his first roll he is beating the treshold and is in.


(N) Noticing the Hack
Firewall+Analyze(Stealth): 4+4 = 4 hits (prob. to notice the hacker in 1 turn: 9%)

The node is trying to notice that somebody is hacking in. He rolls, per RAW, Firewall+Analyze versus a treshold of the hackers Stealth programme. As this is a "hack on the fly" attempt, the node may roll everytime, the hacker is rolling to hack in. In our example, the hacker needed only one try, so the host may only roll once, too.
As the node scores only 4 hits, and the stealth programme of the hacker is 5, he is not noticed. The GM may note down the 4 hits, as they may act as a treshold for the hacker to clear the system logs of his hack attempt.


(H) Matrix Perception
Computer+Analyze vs Firewall+Stealth

The hacker is setting his analyze programme to constantly analyze his sourroundings. He is rolling Computer+Analyze vs. Firewall+Stealth to find stealthed IC or backdoors. For ease of gameplay, the GM is only rolling this test for stealthed objects. If the hacker wants to further examine something he has already detected to gain further information he must explicitly say so.
As the two patrolling IC are not stealthed, the hacker sees them without performing any test. The GM does not have to roll for stealthed objects, as neither the IC, nor the node, are running any stealth programmes.


(IC1) Matrix Perception
Pilot+Analyze vs Computer+Stealth: 4+4 = 3 hits

The patrolling IC Patrol-1 is set to constantly analyze the node for intruders. As the hacker has a valid user account for this session, he is no intruder, but the IC will have to detect the presence of the hacker to note any hacking actions he might undertake. As the hacker is running a stealth programme, the IC must undertake an opposed test to detect him. For ease of gameplay, this test should be rolled by the GM.


(H) Stealth roll
Computer+Stealth vs Pilot+Analyze: 5+5+2+2 = 3 hits (prob. for the hacker to get noticed: 13%)

The GM rolls 3 hits for the hacker. The IC does not detect the presence of the hacker. Unless something happens, the IC will not attempt again to detect the hacker. If the IC tryies again, it will have a -2 dice penalty for trying again.


(IC2) Matrix Perception
Pilot+Analyze vs Computer+Stealth: 4+4 = 5 hits

The second IC (Patrol-2) is trying to detect the hacker, too.


(H) Stealth roll
Computer+Stealth vs Pilot+Analyze: 5+5+2+2 = 3 hits (prob. for the hacker to get noticed: 13%)

The IC has 1 net hit in this opposed test. It has detected the hacker. As the hacker has a valid user account for this session, the IC does nothing else.


(H) Unload Exploit
Simple Action

The hacker is unloading his Exploit utility. He can only have 4 programmes running without a response penalty and wants to load an edit tool.


(H) Load Edit
Complex Action

The hacker is loading his edit tool.


(H) Browsing for Data
Computer+Browse(5, 1 Phase) 5+5+2 = 3 hits, 8 hits = 2 phases

The hacker is using his user account to browse for the file he seeks. The GM knows that the file is not listed in the directories that are accessible for normal users. He decides, that it will need an extended test (5, 1 phase) for the hacker to find, that the file is not listed in the directories. As this is a legitimate action, the ahcker uses his computer skill. After 2 phases the hacker accumulates 8 hits and is informed that the file is not listed. IC2 is constantly analyzing the hacker, but as he is doing nothing wrong, nothing happens. IC1 is not even aware that the hacker is in the node. (Note: Some very high security system might synchronize the detections of their IC, but this triggeres wrong alarms, very often. GMs, do not synchronize your IC unless you want to make your system extremely high security, as sucess probabilites for a hack decline rapidly.)

Note that the hacker is using computer+browse only because he exactly knows which file he is looking for. If he only knew which kind of information he was looking for, he might have to use the data search skill and face a much higher treshold.


(H) Browsing for Data
Hacking+Browse vs System+Firewall (1, 1 Phase) 5+5+2 = 3 hits

The hacker has not found the files in the user acessible indexes. He knows that the file is there, so he tries to hack into the full file index.
This is an illegitimate action, as accessing the full file directory would need security access. The GM decides that finding a simple file in an index is an (1, 1 Phase) extended test.

Note that the hacker would be using hacker+browse even if he only knew which kind of information he was looking for, but he might have to face a much higher treshold.


(N) Noticing the Hack
System+Firewall vs Hacking+Browse (1, 1 Phase) 8+8 = 2 hits (prob. for the hacker to get noticed: 19%)

The node is trying to detect that sombody is hacking into the file system. As the hacker achieves 1 net hit, he is finding the file in 1 phase. he GM may note down the 2 hits, as they may act as a treshold for the hacker to clear the system logs of his hack attempt.


(IC2) Noticing the Hack
Pilot+Analyze vs Hacking+Stealth 4+4 = 1 hit

IC2 is constantly scanning the node for intruders. As the hacker is now trying to o something, that is not covered by his access rights, the IC might notice it. The GM is rolling an opposed Matrix Perception test.


(H) Stealth roll
Computer+Stealth vs Pilot+Analyze: 5+5+2+2 = 3 hits (prob. for the hacker to get noticed: 13%)

The IC does not notice the hacing attempt of the hacker.


(H) Downloading the Data
Hacking+Edit vs Firewall+System (1, 1 Phase) 5+5+2 = 3 hits

The hacker is trying to download the data. As the file can only be read (and downloaded) with security access, he has to perform a hack to do it.
In his first try, he rolls 3 hits.


(N) Noticing the Hack
System+Firewall vs Hacking+Browse (1, 1 Phase) 8+8 = 2 hits (prob. for the hacker to get noticed: 19%)

The node again tries to detect the hack. It rolls 2 hits, which means the hacker achieves 1 net hit and downloads the file.


(IC2) Noticing the Hack
Pilot+Analyze vs Hacking+Stealth 4+4 = 2 hit

As the hacker is again trying to o something, that is not covered by his access rights, the IC might notice it. The GM is rolling an opposed Matrix Perception test.


(H) Stealth roll
Computer+Stealth vs Pilot+Analyze: 5+5+2+2 = 3 hits (prob. for the hacker to get noticed: 13%)

The IC does not notice the hacking attempt of the hacker.


(H) Logging off


The hacker is login off. Note that the node accumulated 8 hits during the hack. This means, the hacker left lots of evidence of his activities in the node.



Discussion:

This was an example of a competent hacker (all ratings 5), hacking into a high traffic database (node 4) with good security (analyze 4, 2 patrolling IC).
To achieve his run unnoticed he had to hack in in 1 turn (giving the node 2 tries to achieve his stealth treshold of 5 would result in a 66% chance of being detected). Hacking in in 1 turn left him with a 9% chance of being detected.
In the node he had to do 2 opposed test with 12 dice vs 8 dice (browsing and downloading). His chance to fail such a test are 19%. His chance to fail at least one of the tests are 35%. Edge can be used here.
Then he had to survive the scanning attempts of the IC. Depending on how many of the IC detected him at the initial test, he had to face 0-4 opposed test with 14 dice vs 8 dice. As mentioned before, the chance to fail one such a test are 13%. As tehre opposed tests are doe by the GM, the GM might as the player beforehand whether he might invest Edge to avoid detection. The GM can then use Edge in such cases.
Note, that Edge-wise it makes a huge difference whether the hacker is rolling ONE stelath test when he enters the node, which every IC has to beat, or whether he (or the GM for him) is rolling a stealth test seperately for each IC. I recommend the second version.

All in all, GMs should be careful. After the hackers Edge has run out he is very likeley to trigger an alarm, which is very bad in most hacking runs.
The rolls in this run were tailored such, that it does not get too long and different situations are explained. The chance (without Edge) for the hacker to get this run through unnoticed are under 40%.

Better figure out the probabilites beforehand (i.e. with a calculator tool like this: http://www.serbitar.de/stuff/probabilities.xls ).


Thanks to comments from:
Dashifen
Aku
Rotbart van Dainig
blakkie

Edit:
- Changed Karma for Edge
- added hot-sim, stealth specialization, changed probabilites
- added hint about data search
- deleted subscriber house rule
- added not loaded programmes
- corrected wrong attributes used in scanning tests for IC

[Kremlin KOA]

serb you may want to factor in that most hackers would go in HOT ASIST and that they just maybe specialized in the most important of hacking tasks in the game the entry
so an Exploit specialization would not be unlikely

[Oracle]

Karma can be used for hacking??

[Kremlin KOA]

he means edge

[Serbitar]

Damn, sorry, I'm still playing SR3, too . . . I'll convert that .. .

[Serbitar]

[Kremlin KOA]

Also how fast does the runner need the file?
If he has overnight he might as well do it the slowway, with packet sniffing

[Serbitar]

Sure, but then he might have gone for admin access anyway (no reason not to), and then he wouldnt have to roll anything at all, as an admin can do anyhting. That would have made my example rather short . . .

[blakkie]

[Serbitar]

I know that you have a different opinion, but I can not model any rule set which

- lets IC analyze things
- is not totally impossible to hack
- does not need an infinite ammount of dice rolling
- gives admin and security access and advantage over normal access

with that assumption.
I would recommend sattelite nodes to prevent easy hacking. The hacker may get admin access to the sattelite, by probing, but then he has to ist there for several hours if he wants to get admin access to the second line "real" node. IC or patroling security personel (security hackers?) could wonder what even an admin is doing there for hours . . . (if they detect him)

[Aaron]

[blakkie]

[Serbitar]

[blakkie]

[Serbitar]

[blakkie]

Apparently your memory is quite short. :P

[Serbitar]

@blakkie

p. 222 Patrolling IC . . . (emphasis by me)

I want to have patrolling IC, because I like the idea, i ilke how it adds to the hacking experience and because it is in the rulebook.

As to tapping the camera: thats a valid thing to do, but this makes subscribing just an additional dice roll to to. Just complicating things without adding anything. I just dont like it. I stated before several times that this is my interpretation of the matrix rules.

[blakkie]

[Serbitar]

You are neither creating problems, nor solutions. In fact you have not contributed constructively to any of the matrix threads arround.
I know your argumentation, I know your view of the situation (even before this thread. I considered it and mentioned you in the credits because of this) and I think, by now, everyone reading this thread does, too. So everybody who is sharing your view can skip this thread and label it "not appropriate" for him.

Everybody who is interested in a workable solution can read on (at least until blakkie is coming up with his own).

[blakkie]

[Kremlin KOA]

Okay
Blakkie: Serbitar has a point in tat using patrolling IC would be a cost effective way to provide a second layer of defence to a host

Serbitar: Blakkie has a point in that IRL hacking is done by packet siffing or finding a OS exploit that allows root (admin) access and abusing thepriveledges given therin, therefore shadowrun modelling it such is quite realistic.

[blakkie]

[Serbitar]

Then tell me how you want to manage player comlinks, where they can install as much IC as the rules allow? (Analyze 6, 3-4 Analyze 6 Agents on a 6 comlink)

Johnsons, runners and people of the same category do what is possible by the given rules.
You have to balance matrix hosts against that. As I said before, you have never tried to fit it all into a consistent picture. I have at least tried to.

[mintcar]

[Serbitar]

Good points. Thats why I am restricting anlayzation rolles to illegal actions. If every action, even those covered by the hacked account, where illegal, I would have to roll much more often.