Botnets, ...Help? Options Track this topic Email this topic Print this topic Download this topic Subscribe to this forum Display Modes Switch to: Outline Standard Switch to: Linear+

[Zarek]

Greetings,

I'm a new GM (for Shadowrun, not in general), and am struggling with some of the finer points of the matrix. Particuarly botnets. Conceptually I understand them. Mechanically, not so much.

While I would prefer not to be grinding through the finer points of botnets with only three sessions under my belt, unfortunately I have taken over a much more experienced party with an incredibly ambitious AI as one of the characters. In short: He is walking all over me.

I've looked it over enough to know he cant do anything exceptionally complex, and it isnt impossible for someone to start hacking away bits and pieces of it. But based on the understanding of it i have been given, he just has hundreds of these things roaming around giving him near limitless chances and dice to do whatever he wants. I don't think this is how it is supposed to work. Now that I have a few weeks off I'm hoping to get this under control.

So, can someone guide me through the exact mechanical process of creating, using, and defending against or defeating a botnet? (as thorough as you are willing including duplicating agents, subscriptions, hierarchy if applicable, access IDs, etc).



Thanks!

[suoq]

giving him near limitless chances and dice to do whatever he wants

Have him show you in the rules where the botnet helps him do anything other than mass probes (and even there it's capped by skill) and DOS attacks.

Everything there is to find about Botnets is in Unwired around page 88 and 100.

[Zarek]

Have him show you in the rules where the botnet helps him do anything other than mass probes (and even there it's capped by skill) and DOS attacks.

Everything there is to find about Botnets is in Unwired around page 88 and 100.

I'd already read the section repeatedly before posting. It is still unclear. I realize this is largely becuase my grip on the matrix itself is still weak.

A few quotes from unwired:

Brute force methods—sending a group of agents to force their
way through a node in cybercombat—are rarely effective.

Sometimes when you can’t pull off a big hack, you can use a botnet
to pull off a lot of little hacks that add up to the same thing.
Perfect example: traffic control. Hacking the individual lights and
using bots to control them can be a hell of a lot easier than hacking
the central traffic node.

This indicates they can be used to perform other tasks - just shouldnt be effective in many cases or very sohpisticated. Becuase I don't really have a grip on them, they are not only effective but pretty much dominating.

Combine this with a very loose transition between his botnet and his normal agents suporting him, its become this ambiguous monster. Especially becuase he just makes new copies every time he does anything.

[suoq]

Becuase I don't really have a grip on them, they are not only effective but pretty much dominating.

The problem, as I see it, is that he's saying he has X for a dice pool. He's not explaining to you HOW he has X for a dice pool. Therefore you can't explain to us how he has X for a dice pool. And since we don't even know what X is, we don't know if it's actually a lot or if you're expecting SR4A defense to work against Unwired's (and other books) dice pool escalation.

Get a copy of the character sheet, post it, and tell us what dice pools he's using and how. It will make things much easier for you and us.

[Zarek]

The problem, as I see it, is that he's saying he has X for a dice pool. He's not explaining to you HOW he has X for a dice pool. Therefore you can't explain to us how he has X for a dice pool. And since we don't even know what X is, we don't know if it's actually a lot or if you're expecting SR4A defense to work against Unwired's (and other books) dice pool escalation.

Get a copy of the character sheet, post it, and tell us what dice pools he's using and how. It will make things much easier for you and us.

Thats harder than you might think, We game over skype becuase we all moved in ten different directions.

His Dice pool isnt the problem. I beleive its mid teens. My problem is he has (last number i heard was 120 but that was a few copy cycles ago) bots making that same test in the same round becuase of the botnet. He just says - "Im gonna task my botnet to data searching for A, B, C, and D and aiding one another to best efficiency possible. (IE, each one aiding the skill to provide its exact maximum bonus on the task)." Or more dangerousy "Im gonna task my botnet to hacking this group of yakuzas comms".

Even if ten fail, the next 30 don't. Thats what I mean by literally infinite dice and infinite simultanesou tries. I dont care if he has a dice pool of 10, 20, or 30. He gets a crack at it for every bot is the way hes trying to play it.

That is why I want to know step by painful step how a botnet is created. From the first original purchased agent onward. For purpose of this example assume all programs/hardware/stats/skills are 4 on the character sheet.

[Kirk]

This, I think, is the relevant passage for dealing with his botnet:

Hacker bookkeeping
One issue with botnets and mass probes is
that player characters can quickly accumulate
a lot of compromised nodes and a lot of bots—
more than a gamemaster can be expected to
fully detail at the table. The key to avoiding unnecessary
bookkeeping and holding up the game
is for the gamemaster to plan ahead and let the
player worry about the bulk of the bookkeeping.
Make up a list of five (or ten or fifteen) nodes that
would be of particular interest to the hacker, are
specifically relevant to the campaign, or are particularly
amusing false leads; the majority of the
rest of the nodes compromised by mass probing
will be home terminals, student commlinks, and
other nodes only useful as a place to store a bot
or rip an access ID from.

His biggest problem if he's got hundreds of these things is that some have been caught in honeypots by some serious counter-techs. Remember that these are weak agents sent out not to targeted systems but to random systems that have only their vulnerability in common. Most are of no use due to what they've occupied, and even those that are in the right place are weak.

Also, don't forget that his bots are getting flushed as well as created. For guidance look at the mass probe rules (UN 100). They can also be compromised and used against him, both as tracing startpoints due to the access IDs but also as tripwires. (Hey, Joe, bot 2275A is asking if we're connected to the security system in the Burbank facility. Better give security a heads up.)

[Zarek]

This is a large part of my confusion - My original understanding was he was creating copies of one of his agents, and then essentially chaining them to another one - Like a tree. Agent A tasks AA and AB, AA tasks AAA, AAB etc. and these things were just flitting around the matrix doing his bidding like a normal agent or sprite might. Each loaded down with copies of his top notch programs. Is this entirely incorrect (please tell me it is).

[Kirk]

Or more dangerousy "Im gonna task my botnet to hacking this group of yakuzas comms".

Even if ten fail, the next 30 don't.

Wait. Ten failed hack attempts on yakuza comms?

That means ten traces. And ten alerts to the yakuza's matrix-walkers. Oh, gee, the next 30, 60, or hundred succeeded? So what -- by now the yakuza switched comms (what, only runners get to do that?), put disinfo teams on sending false info through the hacked comms, and have an unwelcoming committee on the way to the hacker's location.

I have this little rule I've learned the hard way: Greed kills. Sounds to me like your hacker's gone greedy.

[Zarek]

All in the same round. Out of those ten each get hit with 10 simultanesous exploits. Thats the way it has been explained to me.

--EDIT--

That is why I am on here. I'm sure this is wrong. I just want to understand how it is supposed to happen so when I come in and say "Hey, you've been misusing this" I have a solid explanation of how it is supposed to work.

[vipox]

The Sniper Rule also applies in this situation. If he is willing to have the rules work this way, you are very able to say that the Yakuza have a massive (much larger than he could ever amass) bot net that will preform the same attack. Now given the fact he is an AI and that they could and would be loaded with Black IC, if I was him I would be very worried.

There is also a problem of being noticed, a massive wave of bots is going to cause a stir, much the same as bringing a Cannon to a Pistol fight.

[InfinityzeN]

Actually after the first few fail, since they are all copies running on a common list of codes, then security will just block all those connections and they all fail after the first few. Plus as Kirk said security is going to trace and tear him up. Plus what is he running them on? You can't just copy it and run it on his hardware, so he will have to be hacking and taking over lots of nodes to load them up on.

Just repeatedly gang rape him with traces/matrix security because the way he is doing it is very weak security. Also, you are the GM not him. He does not tell you how it works, you tell him how it works.

[Kirk]

All in the same round. Out of those ten each get hit with 10 simultanesous exploits. Thats the way it has been explained to me.

No.
Per the part I quoted first (sidebar, UN 100) not all the bots are in a position to hack the Yakuza commnet. How many are in place? That is up to YOU, the GM, not the player. If the player's been hacking places to specifically place bots for effectiveness, you and he need to have a solo session to see how many times he's oopsed his rolls.

Simultaneous on multiple comms? No. He gets to send a command to his bots to "hack this node" not "hack these nodes".

Simultaneous attack on one node? We have one of two situations: DDOS, or probing with a Teamwork test. Since he says it's a teamwork test, the rule (SR4A page 65) applies. Each of the ASSISTING bots rolls as though it's hacking. Each hit adds one to the primary hacker's dice pool. BUT, that dice pool is capped by the primary's skill (in this case I'd use its rating). AND, a critical glitch by any assisting bot raises the threshold by 1 (3 for extended tests).

It isn't infinite.

[Zarek]

In his defense I don't think he's cheating, I just think he doesnt know what hes doing, and I know that I know less. Hes been playing a matrix player since January, I first glanced at matrix rules in about July... I took over from a different GM. This GM didn't have that problem becuase the player didn't read about these until after he had retired.

[suoq]

1) The first few fail, triggering alerts and traces. The remaining fail because there are no more subscription nodes for them to make the attack on.
2) Where does it say he can command all the bots to do one thing at one time in the same round and that what they can do is anything other than a DOS or a mass probe?
3) Don't have him explain the rules. Have him give you book and page numbers.

[Zarek]

From what yall are saying - It seems like they shouldnt be moving node to node based on chain of command orders. That is largely part of what I wasnt understanding.

The detailed description of what happened with the Yakuza is they had a group of about 8 hiding out in an apartment complex waiting for orders and they snuck in for a quick strike (hoping to capture and 'question' one). He wanted to bring his bot net in to help him find, then hack the comms (with the end goal of then commanding them to start targetting cyberware slaved to the comms).


Based on everything you have said, once he copies an agent onto a node and puts it in the botnet - that agent stays there. Is that correct?

Outside of DOS and Mass Probe Turbo Bunny heavily insuinuates there are other uses, though.

[Zarek]

I think I finally got part of it.

The problem as stated above, I was imagining this amorphous blob roaming the matrix that he was saying "Hey blob, go do this". Now I finally (with your help) understand that once a 'bot' is created on a node it ain't moving. If he wants a bot on a neighboring node (like in that apartment complex) he had best hack it and put one on there. Not simply order his botnet to 'travel' the matrix to Node Z and tell them to start hacking all the commlinks linked in to the node.

This clears much confusion. Please confirm if my new understanding is correct.

[Kirk]

That's close enough to work with.

The bot is a fixed agent. Worse for him, it's not a powerful agent with tons of flexibility.

One question you might ask your matrix person is how he's distributing these bots. Is he placing them, or is he allowing them to be hidden in worms or other malware? Each method has strengths and weaknesses, most already noted.

Suoq gave you what is probably the best advice: make him give you details. Remember, YOU are the representative of the universe at large. If you do not grok it, it does not exist.

[hobgoblin]

I am guessing he is working with a Agent running the Replicate autosoft, and with any kind of copy protection filed off.

Thing is that Unwired handles a botnet as something distinct from a bunch of rampaging agents.

If he has agents commanding agents, then point him towards the botnet section of page 100 and the replicate autosoft on page 113 of unwired. And perhaps also the section on Autonomous programs on page 110 that defines the limits of agent movement and collaborative efforts.

All in all it reads like your player is going for a agent smith setup (named for the character in the matrix movies, particularly the second and third), a idea/complaint that arose soon after the publication of SR4. Unwired added some details to try and curb this. First of all running copies of a agent share a access ID, unless the hacker takes time to spoof it when loaded onto a external node. This allows a target node to screen out all of those agents once one of them triggers an alarm. Second, note the Mook sidebar on page 101 of Unwired. Commercial agents do not do criminal acts out of the box, and they do not do well with complex tasks no matter their rating. Sidebar on page 102 may also be of interest.

So to sum up, what he is playing with is not a botnet in the Unwired sense. But a extrapolation of pre-Unwired rules and gray areas of those rules (in that there are no rules saying that a agent can not command agents of their own).

[Zarek]

Ahh yes, you have identified the source of the problem. It is exactly the agent smith scenario. However. He is clever enough to have looked into:

From Unwired 111

A copied agent may be patched in order to give it a
separate unique access ID with a Logic + Software (Rating
x 3, 1 week) Extended Test.

I was dumb enough as a GM to tell them three months had passed.

[Tymeaus Jalynsfe...]

I was dumb enough as a GM to tell them three months had passed.

So... 6 Agents (Rated 3) Patched (2 per Month, assuming average rolls on 16 Dice)?

[Zarek]

So... 6 Agents (Rated 3) Patched (2 per Month, assuming average rolls on 16 Dice)?

2 becomes 4, becomes 8, etc. I think that is what he did. Becuase I think he used the recently copied agents to act as mooks to do change ID test. That may have not been legal though.

[Kirk]

Yeah, I'd say changing IDs is outside normal operating bounds.

[Tymeaus Jalynsfe...]

2 becomes 4, becomes 8, etc. I think that is what he did. Becuase I think he used the recently copied agents to act as mooks to do change ID test. That may have not been legal though.

Agents do not have the software skill, nor can they get it. So yes, quite illegal.

[Zarek]

I'll give it to him, it was a clever attempt at a work around. Thanks so much everyone for helping me figure out what he did.

The reason hes making so many now, is hes got all these different agents stored on his home nexi. It all makes much more sense now that I know this isnt a real botnet. I could not for the life of me make a connection between the botnet rules and what he was doing. Haha.

I think what Im gonna do, since his army of agents is uniquely based on the same mal-ware (replication auto-soft), is let Renraku to try to make a career comeback in seattle with a fantastic new anti-virus program with free demos. Get a fear campaign going against this guys agents. Where every wageslave/corp/etc starts buying into platinum plus versions of this software, etc.

[Kirk]

If he's been going to all these dark alleyways in the Matrix, perhaps he's brought home an infection or two of his own?

Remember, anything the player can do to the world, the world can do to the player. (An ambush ambushed isn't very nice.)