The rules tell us that people use their comlink for just about everything - its their interface for working, communication and entertainment. He's an example that I need help to understand.

Joe Wageslave is at home with his comlink on running on a public network in passive mode. I think we all agree that if you know Joe's commcode #, you can hack his comlink. My first question is what if you know his commcode and he's in hidden mode? I assume that the comlink appears to be off but that a successful "Matrix Perception" would let you know that he's actually just hiding. Sound reasanoble?

The next part of my problem happens when Joe Wageslave goes to work in the morning. Lets say Joe works for a AA corp in a large complex that has its own private wireless network. Is Joe's (and every other employee's) comlink not a huge security flaw? Theoretically just by knowing Joe's commcode anyone could hack his comlink and spy on his work. Joe's comlink should be much easier to hack than the corporate network.

My idea for a solution to this is that while a work, Joe's comlink subscribes to the corporate network and not the public one. The corportate network allows legitimate trafic through (i.e. phone calls and email) but denies all other access. If you wanted to hack Joe's commlink while he is at work, you'd then have to first get through the corporate fireweall.

Does this sound reasonable? Am I on the right track?

Your reasoning is sound. Keep in mind however, that the human element is always the weakest link in any security plan.

Sure, the office building may be set up so that inside the building, you can only access the corporate network, and not the public grid, but maybe Joe's on his lunch break and wants some outside access for whatever reason (His company blocks access to the sports news sites, and he wants to check the latest scores for his Urban Brawl team). Joe cracks open a window, slips an antenna on an extension cable outside, and then closes the window back.

and you still have access to at most what he's seeing, and trust me, people with access to the good paydata, aren't retards that hang a open connection out just to catch the sports.

Also, unless he demands a certain station, most corporations promote a healthy environment for those sorts of things and create thier own stations for such things or have a subscribed service for it, (similiar to how some companys do today in employee lounges) these are AA and AAA corps we're talking about largely (and less tend to have less paydata)

Having access to his node doesn't mean you have access to anything good regardless.

You've just bypassed one security point out of many.

Heya RunnerPaul, good questions both. Personally, having worked at a Financial Institute, I disagree with Liper suggesting that a retard would be hanging an antenna out like that, I guarantee that would be an almost common practice actually.

However, I believe that Joe's PAN is only going to give info from Joe, not the Corporation. Sure, you could possibly read the precise files he's accessing, but not much more than that, definitely not complete access into the intranet of the company he's working for, or even information he has access to, only to things he's accessing or has stored for data in his own personal PAN.

I don't think you should view him as a back-door, but rather as a limited node. He's great if he's willingly helping you (Ie: agreeing to view the information at a certain time so you can 'view' it over his shoulder), but randomly picking Joes to find information (and hoping they're looking right at the info you want when you hack them) would be more horrendous than just hacking the Corp's network.

Sphynx

Financial Institute != Bank The average person working at a financial institute is little more than a data processor. He takes reports, puts the data into forms that calculate stuff like residual interest and accrued income. My job is to remove the need for him by programming something to do that automatically. So who knows, maybe in 2070 they won't even need such people in buildings.

As for node to node, getting into his PAN only opens a path to the AN of the corp. You'd still have to hack through their firewall from that point. All you've done is put a middle-man where no middle-man was needed.

In today's security, I write stuff like VisualBasic FTP programs to limit access to data. Rather than grant FTP access to that processor guy, I write a program that let's him grab via FTP protocol only 1 of X number of files. So, using a today's example, if you got onto his computer, and used it to get on the intranet (assuming you had his passwords, which are accessable if you're a hacker and have hacked into his computer), you'd find you couldn't get on the intranet directly (no shell accounts anywhere), and could only 'read' files that he's allowed access to.

I believe the same thought process applies in the nodes with a PAN. His PAN is today's Laptop. Just because he plugs that network cable into his laptop doesn't mean you get full access to the network he's plugged into. Firewalls prevent that. Best you can do is see what's on his laptop, and if you're lucky, find a program on his laptop that will have the access you need (which is guaranteed not to be shell access unless he's the IT manager or something). And trying to hack from his laptop into the network is alot harder than hacking into the network via wireless antenna (in today's world anyhows), and hacking directly. Using his Laptop you'd be limited to the processing speed of his laptop, and hope he's not using alot of that himself.

As such, converting the terminology to PAN, you'd find yourself limited to his System and Response to still hack into the Corps primary node instead of using your own SotA system.

That make sense? Of course, as seen by my not quoting quotes from the book, this is just my IT Common-Sense speaking, not neccessarily by-the-book. Ie: nothing more than a liberal interpretation.

Sphynx

Thanks all

I agree that by hacking someone's comlink while at work the best you could do is "shoulder surf" and see what files they are acessing. This however wouldn't prevent you from copying or modifying the files, or would it???

So what do you think about my orginal point?

Is it reasonable that corps would have their employees subscribe to a private network while at work, thus making the comlink inacessable from the public network?

Of course there's a million ways that an emplyee could screw up the system.

I doubt that workstations are actually obsolete. I see a normal person's commlink as performing the roles of a real world cellphone, wallet, pda, and ultra-portable laptop computer. People in the real world have all those things and still log into a workstation at work. Even telecommuters frequently have dedicated work computers at home.

I see no reason why it wouldn't be possible to extrapolate from the PAN centered around a commlink to a VPN centered around a workgroup server. In this setup, each workstation on the VPN is configured to only access the matrix through an encrypted channel to the workgroup server. In order to mess with a workstation, you either need to find the user breaking the security policy by setting up an insecure matrix connection, hack the workgroup server, or Decrypt the VPN link and then use Spoof to trick the workstation into thinking that you're the workgroup server (the other way around is interesting too).

Commlinks could be VPN nodes too, in which case all the comm traffic would be routed through the workgroup server. Ack! Employers would log all their employee's cellphone calls.

that way you can track their email++

I envision the "standard" corporate scenario being thusly:

Bob W. Slave gets up in the morning when his Comm tells him to and takes a shower. Over breakfast he checks the email that was forwarded to his comm. His email is all encrypted by the corporate system so he has decrypt them first. Being a lower-echelon slave, the encryption probably isn't necessary but the corporation doesn't see the point in having multiple systems to support. Bob's comm can't run the required level of encryption so he's not able to access the company's network remotely or even reply to his email.

His office is in a shared megaplex rather than one of the big arcos so he stays on the public phone system until he steps through the office doors. The wireless shielding blocks out everything but his company LAN. The company requires encryption on all wireless communication with the servers. Given Bob's barely-adequate Comm he's limited to making calls to the outside world and some websurfing, and even that goes through the company firewalll.

Logging into the network causes the security doors to open, letting him get to his cubicle farm. Except they got rid of the cubicles years a few years back; AR makes the walls redundant. He grabs a cup of soyacaf and sits in his surprisingly comfortable chair. He was surprised when he got out of college that the chairs were so nice until he realized that pain is a distraction that lowers productivity and a chair is relatively cheap.

He sets his comm into its docking cradle (wired connection) at which point it becomes little more than a gateway to the corporate network. Bob makes sure his peripherals are still set to minimum range (Signal 0). If he was on a more secure floor he'd need even his peripherals to be encrypted or skinlinked but as a general paper pusher the physical security was considered sufficient. The world shivers a bit as the loads his corporate approved AR interface (Private Jr. Office/Quiet Music/No Plants/Small Window). Bob hops onto the TPS node and gets to work. Bob does lots of TPS reports. He's secretly happy about the AI meltdown a few years ago since it killed the TPS AI project. Bob never actually loads a TPS report onto his comm; all the data stays on the server. Not that Bob would want to keep a TPS report.


Steve is one of Bob's friends. Steve works on time-critical applications that sometimes require remote access, so he has a comm able to handle the encryption. Steve's day is similar (wake up, read encrypted email) except that Steve can reply to emails and log onto the corporate network from home or in the car.

When Steve walks into the office he can immediately begin accessing the network. All of Steve's peripherals are skinlinked or encrypted. It doesn't matter when he visits Bob in TPS-land but things are different on his floor. He remembers the time that Simmons accidentally picked up his son's encryption-free earbuds and was visited by a pair of stern security staff when a routine scan detected an unencrypted communication. Simmons was made fun of as much for his choice in Japanese Kawaii pop music as he was for failing to meet corporate security guidelines.

Steve looked around his office in pleasure. Sure, Bob had his VR office, which was almost identical, but its different when you have real solid walls. Too bad Bob's security level was too low. The only way Bob could visit was through AR or by leaving his comm at the security desk (Bob's firewall did not meet the standard required for devices in that area) and who could get by without a comm?

Steve considered his comm. It was getting near end of life; when he got a new one maybe he'd buy out the old one's lease and give it to Bob as a Wintereenmas gift. Then Bob could finally see the office!

*edited to correct

excelent writing there kigmatzomat.

Kigmatzomat, thanks. You're explaination is excellent and more or less the way I was starting to think.

I think it has just as much to do with Bob's peripherals signal range being 2 meters.

And interesting situations are the point, no?

Going back to something earlier in the thread, the fact that the cubicle farm has no more cubicles.

Would WiFi inhibiting cubicle walls be feasible? You could cut down that 3m distance that your wireless peripherals are vulnerable to eavesdropping down to something a lot smaller. Of course since all you need is a chair and a docking station, these cubicles could absolutely claustrophobic: 1m by 1.5m should do the trick.

Of course, since they aren't full height walls, so a spiderdrone crawling on the ceiling would be able to trace line of sight to an employee's comlink and avoid the WiFi shielding, but it deters casual "walk-by" signal eavesdropping.

It's probably overkill for the lowest tier of security, but for those employees who handle slightly sensitive data that you don't want to blow a full office on, it'd seem like a good option.

Besides, I kind of like the idea of coffin-cubicles.

Would you even be able to get the password at that range? The low-level encrypted information in that situation would simply be display information, sent to the glasses, datajack, earbuds, whatever. The encryption, firewall, everything security-related would presumably be handled automatically between the commlink and the wired connection, and any connection with the comm would still need high level encryption access, right? So shoulder-surfing within 3m, sure, but that still wouldn't get you root on his link.

I would think that it should be tracking specific devices harder than others, to prevent data theft! After all, if a comm with access to paydata starts exploding with activity, it might very well be downloading some of it to sell to some guy offering meganuyen for industrial espionage, while if a comm with no access starts exploding with activity, he's probably just downloading porn.

I'd say it'd certainly be easier to get in through Steve, but Bob is less likely to be noticed...and more importantly you can code an agent to get you through any security protecting the paydata, but you can't stop them from monitoring activity. It'd be a -harder- way in, but I'd argue a safer one and more likely to net you a bonus from your employer for getting them the data without them being put on alert.

Well the time is irrelevant. You can't retrieve the agent's download until they leave work anyway.

I'm not worried about what the Agent has to do, as you can program for that, what I'm worried about is a security monkey going over the bandwidth logs and spotting unusual activity from Steve's comm (I believe there's a program for that) and raising an alert. But then I'm assuming that if they have any paydata they're going to be actively watching everyone with access to make certain they don't sell it for ridiculous (for a wageslave) sums of nuyen. For that same reason; you can program around any static firewall or IC defense.

But if you can't keep an eye on everyone because its expensive, why bother keeping an eye on the activity of those who don't have the opportunity to do it?

I'm just extrapolating from modern corps, who already start from the assumption that their workers will screw them whenever they can. SR corps will do the same thing, and have much better ways to curtail their privacy.