This is the first post in a series, where I want to present my interpretation of hacking runs.
With several posts (all int his thread) I want to cover several situations, and my interpretation of how the matrix rules can be used and balanced.

(might not be the order of final posting)
Hacking a host and performing a data steal
Hacking through a relay of linked nodes
Hacking a security camera and performing overwatch
Hacking someone's wireless equipment
Hacking into a drone network

TODAY: Hacking a host and performing a data steal
Note that this is only my interpretation and not final. I might edit this post a lot during the next days, depending on comments and other considerations, but I will note changes by using different colours and maintaining a changelist.

General comments:

Deleted subscriber house rule

1.) When you successfully hack in, you have a valid user/security/admin account for this session only. When you leave the node, your account has gone. Legal actions (actions covered by the permissions of the account) can be performed by a simple computer+skill test (if needed at all). Illegal actions (actions not covered by the permissions of the account) must be perfomred by an opposed hacking+skill test vs. system+firewall of the node. The GM may call for an extended oppesed test if a certain treshold has to be achieved. Net hits of the node determine that the node notices that something is being tempered with. The GM decides what happens with which number of net hits.

2.) IC/agents have to successfully detect a stealthed hacker to engage in actions (including analyzing hack attempts) against him.


(H) Hacker:
Hacking: 5 (specialization stealth)
Computer: 5

Hot-SIM: +2 dice

Firewall: 5
Response: 5
Firewall: 5
Signal: 5

Loaded programmes:

- Exploit 5
- Analyze 5
- Browse 5
- Stealth 5

Not loaded programmes:

- Edit 5



(N) Node:
Firewall: 4
System: 4
Signal: 4
Response: 4

Loaded programmes:

-Analyze 4

(IC1) IC: Patrol-1
Pilot 4
-Analyze 4
-Attack 4
-Armor 4

(IC2) IC: Patrol-2
Pilot 4
-Analyze 4
-Attack 4
-Armor 4


Steps:
(bold steps denote the minimal version of this example)

(H) Hacking In
(N) Noticing the Hack
(H) Matrix Perception
(IC1) Matrix Perception
(H) Stealth roll
(IC2) Matrix Perception
(H) Stealth roll
(H) Unload Exploit
(H) Load Edit
(H) Browsing for Data
(H) Browsing for Data
(N) Noticing the Hack
(IC2) Noticing the Hack
(H) Stealth roll
(H) Downloading the Data
(N) Noticing the Hack
(IC2) Noticing the Hack
(H) Stealth roll
(H) Logging off

Explained:

(H) Hacking In
Hacking+Exploit(Firewall, 1 Turn): 5+5+2 = 4 hits (porb. to fail hacking in in 1 turn: 39%)

The hacker is trying to hack into the node. He is going for a user account. The rules say he has to engage in a Hacking+Exploit (firewall, 1 turn) test, to do so. With his first roll he is beating the treshold and is in.


(N) Noticing the Hack
Firewall+Analyze(Stealth): 4+4 = 4 hits (prob. to notice the hacker in 1 turn: 9%)

The node is trying to notice that somebody is hacking in. He rolls, per RAW, Firewall+Analyze versus a treshold of the hackers Stealth programme. As this is a "hack on the fly" attempt, the node may roll everytime, the hacker is rolling to hack in. In our example, the hacker needed only one try, so the host may only roll once, too.
As the node scores only 4 hits, and the stealth programme of the hacker is 5, he is not noticed. The GM may note down the 4 hits, as they may act as a treshold for the hacker to clear the system logs of his hack attempt.


(H) Matrix Perception
Computer+Analyze vs Firewall+Stealth

The hacker is setting his analyze programme to constantly analyze his sourroundings. He is rolling Computer+Analyze vs. Firewall+Stealth to find stealthed IC or backdoors. For ease of gameplay, the GM is only rolling this test for stealthed objects. If the hacker wants to further examine something he has already detected to gain further information he must explicitly say so.
As the two patrolling IC are not stealthed, the hacker sees them without performing any test. The GM does not have to roll for stealthed objects, as neither the IC, nor the node, are running any stealth programmes.


(IC1) Matrix Perception
Pilot+Analyze vs Computer+Stealth: 4+4 = 3 hits

The patrolling IC Patrol-1 is set to constantly analyze the node for intruders. As the hacker has a valid user account for this session, he is no intruder, but the IC will have to detect the presence of the hacker to note any hacking actions he might undertake. As the hacker is running a stealth programme, the IC must undertake an opposed test to detect him. For ease of gameplay, this test should be rolled by the GM.


(H) Stealth roll
Computer+Stealth vs Pilot+Analyze: 5+5+2+2 = 3 hits (prob. for the hacker to get noticed: 13%)

The GM rolls 3 hits for the hacker. The IC does not detect the presence of the hacker. Unless something happens, the IC will not attempt again to detect the hacker. If the IC tryies again, it will have a -2 dice penalty for trying again.


(IC2) Matrix Perception
Pilot+Analyze vs Computer+Stealth: 4+4 = 5 hits

The second IC (Patrol-2) is trying to detect the hacker, too.


(H) Stealth roll
Computer+Stealth vs Pilot+Analyze: 5+5+2+2 = 3 hits (prob. for the hacker to get noticed: 13%)

The IC has 1 net hit in this opposed test. It has detected the hacker. As the hacker has a valid user account for this session, the IC does nothing else.


(H) Unload Exploit
Simple Action

The hacker is unloading his Exploit utility. He can only have 4 programmes running without a response penalty and wants to load an edit tool.


(H) Load Edit
Complex Action

The hacker is loading his edit tool.


(H) Browsing for Data
Computer+Browse(5, 1 Phase) 5+5+2 = 3 hits, 8 hits = 2 phases

The hacker is using his user account to browse for the file he seeks. The GM knows that the file is not listed in the directories that are accessible for normal users. He decides, that it will need an extended test (5, 1 phase) for the hacker to find, that the file is not listed in the directories. As this is a legitimate action, the ahcker uses his computer skill. After 2 phases the hacker accumulates 8 hits and is informed that the file is not listed. IC2 is constantly analyzing the hacker, but as he is doing nothing wrong, nothing happens. IC1 is not even aware that the hacker is in the node. (Note: Some very high security system might synchronize the detections of their IC, but this triggeres wrong alarms, very often. GMs, do not synchronize your IC unless you want to make your system extremely high security, as sucess probabilites for a hack decline rapidly.)

Note that the hacker is using computer+browse only because he exactly knows which file he is looking for. If he only knew which kind of information he was looking for, he might have to use the data search skill and face a much higher treshold.


(H) Browsing for Data
Hacking+Browse vs System+Firewall (1, 1 Phase) 5+5+2 = 3 hits

The hacker has not found the files in the user acessible indexes. He knows that the file is there, so he tries to hack into the full file index.
This is an illegitimate action, as accessing the full file directory would need security access. The GM decides that finding a simple file in an index is an (1, 1 Phase) extended test.

Note that the hacker would be using hacker+browse even if he only knew which kind of information he was looking for, but he might have to face a much higher treshold.


(N) Noticing the Hack
System+Firewall vs Hacking+Browse (1, 1 Phase) 8+8 = 2 hits (prob. for the hacker to get noticed: 19%)

The node is trying to detect that sombody is hacking into the file system. As the hacker achieves 1 net hit, he is finding the file in 1 phase. he GM may note down the 2 hits, as they may act as a treshold for the hacker to clear the system logs of his hack attempt.


(IC2) Noticing the Hack
Pilot+Analyze vs Hacking+Stealth 4+4 = 1 hit

IC2 is constantly scanning the node for intruders. As the hacker is now trying to o something, that is not covered by his access rights, the IC might notice it. The GM is rolling an opposed Matrix Perception test.


(H) Stealth roll
Computer+Stealth vs Pilot+Analyze: 5+5+2+2 = 3 hits (prob. for the hacker to get noticed: 13%)

The IC does not notice the hacing attempt of the hacker.


(H) Downloading the Data
Hacking+Edit vs Firewall+System (1, 1 Phase) 5+5+2 = 3 hits

The hacker is trying to download the data. As the file can only be read (and downloaded) with security access, he has to perform a hack to do it.
In his first try, he rolls 3 hits.


(N) Noticing the Hack
System+Firewall vs Hacking+Browse (1, 1 Phase) 8+8 = 2 hits (prob. for the hacker to get noticed: 19%)

The node again tries to detect the hack. It rolls 2 hits, which means the hacker achieves 1 net hit and downloads the file.


(IC2) Noticing the Hack
Pilot+Analyze vs Hacking+Stealth 4+4 = 2 hit

As the hacker is again trying to o something, that is not covered by his access rights, the IC might notice it. The GM is rolling an opposed Matrix Perception test.


(H) Stealth roll
Computer+Stealth vs Pilot+Analyze: 5+5+2+2 = 3 hits (prob. for the hacker to get noticed: 13%)

The IC does not notice the hacking attempt of the hacker.


(H) Logging off


The hacker is login off. Note that the node accumulated 8 hits during the hack. This means, the hacker left lots of evidence of his activities in the node.



Discussion:

This was an example of a competent hacker (all ratings 5), hacking into a high traffic database (node 4) with good security (analyze 4, 2 patrolling IC).
To achieve his run unnoticed he had to hack in in 1 turn (giving the node 2 tries to achieve his stealth treshold of 5 would result in a 66% chance of being detected). Hacking in in 1 turn left him with a 9% chance of being detected.
In the node he had to do 2 opposed test with 12 dice vs 8 dice (browsing and downloading). His chance to fail such a test are 19%. His chance to fail at least one of the tests are 35%. Edge can be used here.
Then he had to survive the scanning attempts of the IC. Depending on how many of the IC detected him at the initial test, he had to face 0-4 opposed test with 14 dice vs 8 dice. As mentioned before, the chance to fail one such a test are 13%. As tehre opposed tests are doe by the GM, the GM might as the player beforehand whether he might invest Edge to avoid detection. The GM can then use Edge in such cases.
Note, that Edge-wise it makes a huge difference whether the hacker is rolling ONE stelath test when he enters the node, which every IC has to beat, or whether he (or the GM for him) is rolling a stealth test seperately for each IC. I recommend the second version.

All in all, GMs should be careful. After the hackers Edge has run out he is very likeley to trigger an alarm, which is very bad in most hacking runs.
The rolls in this run were tailored such, that it does not get too long and different situations are explained. The chance (without Edge) for the hacker to get this run through unnoticed are under 40%.

Better figure out the probabilites beforehand (i.e. with a calculator tool like this: http://www.serbitar.de/stuff/probabilities.xls ).


Thanks to comments from:
Dashifen
Aku
Rotbart van Dainig
blakkie

Edit:
- Changed Karma for Edge
- added hot-sim, stealth specialization, changed probabilites
- added hint about data search
- deleted subscriber house rule
- added not loaded programmes
- corrected wrong attributes used in scanning tests for IC

serb you may want to factor in that most hackers would go in HOT ASIST and that they just maybe specialized in the most important of hacking tasks in the game the entry
so an Exploit specialization would not be unlikely

Karma can be used for hacking??

he means edge

Damn, sorry, I'm still playing SR3, too . . . I'll convert that .. .

Also how fast does the runner need the file?
If he has overnight he might as well do it the slowway, with packet sniffing

Sure, but then he might have gone for admin access anyway (no reason not to), and then he wouldnt have to roll anything at all, as an admin can do anyhting. That would have made my example rather short . . .

I know that you have a different opinion, but I can not model any rule set which

- lets IC analyze things
- is not totally impossible to hack
- does not need an infinite ammount of dice rolling
- gives admin and security access and advantage over normal access

with that assumption.
I would recommend sattelite nodes to prevent easy hacking. The hacker may get admin access to the sattelite, by probing, but then he has to ist there for several hours if he wants to get admin access to the second line "real" node. IC or patroling security personel (security hackers?) could wonder what even an admin is doing there for hours . . . (if they detect him)

Apparently your memory is quite short.

@blakkie

p. 222 Patrolling IC . . . (emphasis by me)

I want to have patrolling IC, because I like the idea, i ilke how it adds to the hacking experience and because it is in the rulebook.

As to tapping the camera: thats a valid thing to do, but this makes subscribing just an additional dice roll to to. Just complicating things without adding anything. I just dont like it. I stated before several times that this is my interpretation of the matrix rules.

You are neither creating problems, nor solutions. In fact you have not contributed constructively to any of the matrix threads arround.
I know your argumentation, I know your view of the situation (even before this thread. I considered it and mentioned you in the credits because of this) and I think, by now, everyone reading this thread does, too. So everybody who is sharing your view can skip this thread and label it "not appropriate" for him.

Everybody who is interested in a workable solution can read on (at least until blakkie is coming up with his own).

Okay
Blakkie: Serbitar has a point in tat using patrolling IC would be a cost effective way to provide a second layer of defence to a host

Serbitar: Blakkie has a point in that IRL hacking is done by packet siffing or finding a OS exploit that allows root (admin) access and abusing thepriveledges given therin, therefore shadowrun modelling it such is quite realistic.

Then tell me how you want to manage player comlinks, where they can install as much IC as the rules allow? (Analyze 6, 3-4 Analyze 6 Agents on a 6 comlink)

Johnsons, runners and people of the same category do what is possible by the given rules.
You have to balance matrix hosts against that. As I said before, you have never tried to fit it all into a consistent picture. I have at least tried to.

Good points. Thats why I am restricting anlayzation rolles to illegal actions. If every action, even those covered by the hacked account, where illegal, I would have to roll much more often.

Also remember that you as the GM decide what is "illegal" for an Admin account and what is "legal." Corp Security designers aren't stupid. They know Hackers can get in with Admin access, so they aren't going to let Admin's do everything any time they want. Any action that is "overtly" damaging or hostile should not be under the pervue of the Admin account. Period. Therefore, the Hacker makes his Hacking roll, and the system makes its roll to oppose. In fact, I would say the system is more prone to analyze actions taken by the Admin account than any else.

Think about hueristic virus scanners. That's basically what they do. Virus usually do their nastiness by using low-level system interrupts and such (stuff that I would call "Admin" actions). The anti-Virus programs look specifically for an unusually high number of those actions and try to detect if they originate from a malicious source. So, if anything, Hackers should be "logging on" with normal User privelages and "hacking their way up" to things they want to perform. I would say that systems "watch" what Security and Admin users are doing more than regular "Joe users."

Oh thank god I'm not agreeing with blakkie anymore

Blakkie
the starting hacker in the book has rating 5 comlink

Negative:
The system does not question admin actions. The system can only verify that it is an admin. The system can not find out whether an action is appropriate for the overall situation or not. Thats why any actions performed by an admin will never be hacking actions.

If you hack yourseelf root access, you are root. The system never questions root. It only verifies that you are really root.

So to sum things up:

Comlink all 6
6 Analyze
3 Agents 6
Encryption 6

is a thing which most likely every Runner worth his salt will have, given the cost and availabilities in the book. Nothing of these is even restricted, you can walk into a shop and just buy it. Thus any matrix rules, or interpretation of the rules, must cope with this fact and take it as a quasi baseline.

As to monitoring system logs: It is right there in my example. It has been there from the start.

umm.... isn't hacking on the fly 1 IP not, 1 turn?

one small thing about admin accounts. in windows today you can remove the default admin accounts access to anything if so wanted. basicly is just another account, but as default it have higher access then the rest of them.

therefor its possible that even with a admin account you can run into files and other objects that you have no legal access to. now there are some safeguards buildt in, like say a admin can take ownership of something. but he cant give it back, so it will be noticed if its not supposed to be done unless asked for or orderd.

hell, there is a "crasy" security system being put into use for linux, developed by the NSA. its called SElinux. and with that, even if i log in as root i may not have all the powers one would normaly expect. i dont fully understand its full range of abilitys myself, but it seems one can vary the access rights based on if the root account is accessed localy or remotly, among other things.

so in many cases there would still be things one could not do, even with a admin account, when logged in remotely.

hmm, now that i think about it there was a story in a book i read, or maybe a web article, where the only way to gain full unrestricted admin access from a terminal was by having that terminal connected on the correct port on the network.

now the makers of this system was showing it of at some industry gathering, and was offering a money price if anyone could crack it, so sure of its safety they was.

but someone did in the and crack it. by waiting for the techies to walk away for a coffe break, leaving some sales zombie there. then one person distracted that zombie, while another picked the lock of the networking locker, flipped some wires over, created a secondary admin account or something like that, flipped the wires back, relocked the locker and waited for the techs to return. then he walked up to a terminal, enterd into the admin account and called the techs over so they could see end of the day he walked out of there with the cash.

as the name of the person? kevin mitnick

@Virus
I will check that

@hobgoblin

sure, there may be the ocasional account called "admin" or "root" that can not do anything in some system. But there is allways an account, that can do anything. Just call this one admin, and the rest security.

After all its just a matter of naming. For sake of simplicity, at least.

Those are extreme exceptions. They do not have to be covered by rules, as long as they stay just that, exceptions.

Blakkie That does notin any way model Real Life computing systems

Now considering that the SR4 wireless change was supposed to add realism

The closest I have seen to a system with admin being limited was quite simply one where nousernames were assigned to the Root

You could still hack root access withan exploit

At the last Ruxcon (big Hacker convention in Sydney Australia) the winning time for a particular hack contest for such a system was 12 seconds

there is a reason why NT is not normally used for large networks

besides which with NT all the major hacking (SR) actions can be done on an account with full priveledges

even crash (BSoD) although on NT it might take a hacking action

UNIX and LINUX systems, which are more secure, do allow root to access the kernel

oh and IRL NT does have a level of account which can access the kernel, it is just only supposed to be available to microsoft personnel

NT has been used in every large network I've encountered including two colleges, a 1500 employee (~1200 workstations) company, and a 110,000 employee company (with who knows how many workstations).

In the classified lab I worked in NT was used for some stuff and linux was used for others. The choice was made based on programmer's personal preference and software of choice.

interesting
was going on US and Aus national statistics
most of the large networks in te US are UNIX or Linux(I think 75% or so between them circa '99)
the rest are wither MACos (rare as hen teeth) or NT

I can only speak from personal experience, not having worked in 75% of the companies in america and Australia. I'd be interested in seeing a source for that statistic, given how easily manipulated statistics can be. You'd probably get different numbers if you talked to Microsoft then you would if you queried a BBS populated by *NIX gurus.

the aussie ones were supposed to be Australian Bureau... not sure if the US ones were as reliable.

It makes sense, as it is only a recent development for networ hub machines to be PCs as opposed to dedicated unix servers

Those are also 1999 statistics, which mean next to nothing now. I'm not saying it's wrong, just that tossing out a 7 year old number from partially unknown sources is far from being evidential.

evidential it is
Absolue proof it is not
(sorry , the distinction between those is a pet peeve)

my major point was that the standard 'admin' account in NT is not what SR is calling 'admin' that is more like a security account