First off the Hacker/TM has to figure out a way to access the data. One good way is for the Hacker/TM to tell the group he needs to break into an insurance company and run the plate. With a bit of hacking the Hacker/TM can pull up a customer and start the paperwork for a collision and use that to find out the name and registered address of the other driver. Scary but true.

Another way is to break into a police node and run a search. Risky, though. Better off paying a visit to a cop who is a contact and asking for a hand.

How hard? A munchkin TM can do it in about 5 dice rolls. They thread their Exploit, Stealth, and Analyze up to 6 [if not 6 already] then use a rating 6 registered sprite to bring it to 12. They then exploit in as an administrator [+6 to threshold], create a legit account for later, wipe off their resonance signature from the exploiting and edit [erasure], and logout. then 1 sec later they login using the legit administrator login, data search for the stuff they want unmolestable by anyone except another threaded, assisted TM.

Usually after walking a GM through that a few times they will either:

1. Trip you up with honeypots, bouncer nodes, and other tricky matrix things [which is great fun] or
2. Take a majority of commlinks offline such as Fixers that dont want to get hacked, or
3. Use a profuse amount of antiwireless paint so remote hacking is nigh impossible, or
4. Say that moderately difficult things just take X amount of time and that you succeed.

Especially if the Hacker/TM has high edge their 1 or 2 big all-or-nothing hacking attempts per run can produce some silly high numbers that only an equally silly cybercombat can balance.

My 2 nuyen... ymmv...

One of the differences (and it's one that makes hacking the commlink actually make more sense) is that getting access to a DSL router would let you REACH the nodes behind it, but not actually give you any particular control over them. Most of a 2070 person's personal electronics, though, are /designed/ to be controlled via commlink. It's the universal remote for all the stuff you're carrying. So it makes sense that hacking it would let you mess with everything else.

I'd be very interested.

Count me as interested, too.

I'm interested.

Correct. Its a mystery until the firewall is hacked.

The usual sequence is:
Scan for node
Hack node
Enter node
Observe in Detail (matrix perception, to check for an alert and for any agents/spiders)
Data Search (for paydata) or Edit (camera feeds)
Edit logs to erase signs of passage
Logout

The system is constantly doing Analyze operations if its well designed and if an intruder is spotted the node sets off an alarm which gives it a bonus to whoop the intruders patooty. This only works if they dont log in as an Administrator to later hack in with a permitted account.

Another good step to add in there few use is "List Subscribed Devices". Its handy and easy to get a list of what the firewall doesnt want you to monkey with...

Lastly, check out Pavao's site for hacker cards. you stick em in a baseball card sleeve with a playing card behind them and you have a quick reference for your hacking stuff as well as a way to track what programs a hacker has active:

http://www.pavao.org/shadowrun/index.html

First, during a game, I believe it's better to just assume that a skilled hacker could find the node he was looking for rather than look up a threshold I don't have on hand at the moment. The real fun is once he's in the node anyway.

Second, I would say they need a username and password at least. That usually requires a hack. If you can get access to someone's comlink, you can probably get access to the person, though, so I'd say a little bit of tortue and an intimidate test should get the person to access it for you.


In all seriousness, though, a stolen comlink still needs to be hacked. The hacker can probably bypass the electronic warfare test to find the node if he's holding it in his hand and can just apply a direct cable, IR port, or some similiarly more direct means. Besides, that close to his PAN, it should be one of the strongest unknown wireless signals detected.

Thresholds like Scan+EW arent resisted so the only point of the threshold is to determine how long it takes. I 100% agree that this should be relegated to "after 20 or so seconds you find..." and then drive on with the Story.

With EW4 and Scan6 you throw 10 dice to find a hidden pan. Thats 3.333 hits on average so 5 passes to exceed the threshold of 15. In full VR you'd add two more dice so it would only take 4 passes. Thats a few seconds of real time.

Whats more time consuming than finding hidden pans is finding the RIGHT hidden pans. If in AR you might wanna be overlooking the crowd or if in a meeting room reduce signal to only encompass the room to rule out signals farther away. Barring a good position yourself use drones to triangulate camera feeds with the position of the signals you find.

The short answer is yes, its easy. Its unresisted. thats why most GM's just say it takes a few seconds or maybe a minute and boom, you're looking at a node asking to be hacked.

Alright, I think I got it. The hacker in my group only has 3 dice atm though, so he's likely to glitch (cant afford program).

Edge.... when you ab-so-lutely have to hack every node in the room... accept noooo substitutes.

Yeah he has edge 6 (those damned overpowered humans )

Since he's in a static (-2) area, he'll need to use edge just to find a single one... at least until he can afford a REAL Scan programme.

Just Matrix perception tests, per p. 217 in your hymnal.

Incidentally, I should also mention that I'll switch back and forth a lot if there are other players present, and not just standing by making snarky comments. All those times where I'm saying "while you're doing that I should mention ..." is when I usually cut to somebody who isn't in cyberspace and give them a bit of time (I cut a lot of hit-counting time in the audio; we're not dice-counting savants).

It sounds like you're coming at it from the wrong direction, IMO.
Then eliminate user level access and require them to get security level, not the other way around.
Lots of devices have admin level access only. Most devices that are designed to have only one user/operator, for instance.
Many devices will also have security level access, for those times when you want the user(s) to be able to do mostly everything, except for a few features you want to restrict to just one or two admins.
Finally, large systems, such as hosts, that need limited access for lots of users have the user level.

*This is all in my game, of course, and by no means official. I have no book quotes to back this up, it's just the way I do things.*
So if the system involved is, for example, a dedicated security network, it will have no user access. It's not designed to have lots and lots of users, and the restrictions that go along with that make it harder to crack. Thus, there is only security and admin levels. Just about everyone who uses this system has security access. It lets them look at cameras, lock and unlock doors, command drones, etc. One or two people have admin level access that can lock out security level users and change fundamental system configuration.
Another example: Commlinks. The primary user of commlinks have admin-level access. There are security and user level accounts, but they do almost nothing. They let you look at your commlink's "myspace" page, and whatever other little bits you want to show any random person that finds you interesting. The security level account lets the cops check your ID, but neither account is very useful for a hacker, so for commlinks the admin account is the only one that matters.
Another example: Smartgun system. Admin only. There is no security or user level.

However the GM wants the node to be designed. For example, the devices in a person's PAN are generally subscribed to her commlink. In a recent adventure, there was an NPC who was wearing fake cyberware, which was subscribed to a commlink (full of nasty) which was in turn subscribed to the guy's commlink (which was normal). In our example, the run was on a small business, so everything was subscribed to the same node.

I like to use the metaphor of a node being a secure building, where the guards are the IC, and the Firewall and Analyze are the security systems. Choosing how much one node has in it is like deciding how many layers of physical security you want in your building. The NPC above is like a castle with an outer and inner curtain. The small business was more like an ATM shelter in a mall parking lot.

Again, it's up to the GM as the designer of the node. Permission to do different things with the commlink is different for each device, depending on its design goals. For example, a fixer's commlink may require admin access for sending messages, but a public access terminal would allow it at user access.

I use the cost jump for electronics that exists between Rating 3 and Rating 4 and the table on page 214 of your hymnal as a base. If the node is "more secure," I add 1, and if it's "a lot more secure," I add 2. I remember that only hardcore, Kuang-level scary stuff is Rating 7, and most military-grade stuff is 5. Even a rating 3 node can be effective if it's got IC patrolling, and downright impenetrable if there's a spider in the web.

Remember that hacking a node is mostly a stealth game, for nodes that are worthwhile. Back to the building metaphor, one could easily storm and control a village cottage (Rating 2 or so), but the same trick wouldn't work at a military base (Rating 5).

Another thing to remember is that anything you throw at players can be thrown back. When we first took SR4 out for a spin, I played a hacker. The GM took one look at my Rating 5 everything and made the first node we bumped into Rating 6. I "probed the target," and got in with admin access after a number of hours. Then, after a long stretch of breaking of copy protection, I took copies of all the nice Rating 6 programs the node was running, netting me tens of thousands of nuyen worth of software.

1) Honestly, that is all up to you, as the GM. I've had buildings all run off one node and other buildings run off a node for each floor. I've done runs where there was a dedicated node for security access (doors, elevators, temperature controls) and a separate node for data storage. I like to keep changing things for my players so they don't always do the same things in every matix run. Sometimes I might make a node only accessible from a certain location or force the hacker to directly access it via wires...so really, those choices are all up to you and the specific system. I'd recommend keeping it changing just so you are not boring the players or yourself with every matrix run.

2) Again, I think this is all individual, to both the GM and the system. Realize, that with any type of access, a hacker can do anything, its just a matter of whether it is a legitimate action that won't cause the system to think twice or an illegimate action that may cause the system to take actions. Most of the time, if I put a system into a run, I know ahead of time the types of information that I will allow/disallow for certain access types. The rest of the time, I just judge based on my own reasoning. You never have to worry about admin, as they have access to the entire system (granted, that doesn't mean every node can do EVERYTHING, so there could be limitations on a node and no matter what access, the hacker just can't do something). So really, you are just wanting to decide what the difference is between normal and security users. Sometimes one or both of them will not even be available...again, it comes down to how you want to handle it and will differ in each system/node, so there really isn't a wrong answer!

3) Personally, I start everything as a rating 3...programs, IC, everything. If I have a special node for a specific run and pre-plan everything, then I will vary things, but for most on the fly hack jobs my group will throw at me, I just stick to 3s across the board. If I feel the node is really insignificant, with little to no paydata, I'll drop it to 1. And if its something that I think is important, then I will up it to a 4, 5 or 6, but the vast majority, unless I have something specific planned, I stick it at 3.

The way I run it is the team's commlinks become part of the hacker's PAN, assuming that they are all set to send and receive no traffic except to and from the hacker's commlink. Each team member's commlink counts against the hacker's subscription limit, and the connection to the hacker's commlink counts against a team member's subscription limit.

This is basically a form of slaving that my group has come up with. The concept is mentioned in the FAQ, but is neither elaborated upon nor put forward as an official rule, only acting as a foreshadowing of content in upcoming material. The official rules as currently written state that any device can be hacked if one is within Signal range, regardless of subscription or slaving (as it stands, subscription merely means that one need not spend a complex action to log on). As such, I personally only use the house rule for slaving above in home games, and leave it at home when I'm running games at conventions or at my FNGS.

It's wireless though, all a hacker has to do is spoof as commlink A in order to Hack B. Regardless of how kickass commlink A is, Commlink B only has it's rating and programs to use to defend itself. And the only way to get around this problem is to do callbacks, which increases the traffic enormously. So you can be secure, but at the expense of slowing down your system tremendously.

1) Its virtual, so up to the designer. Any time you have something super sensitive you may want to alter the signal strength, hardwire it, etc. Each layer of this security onion, so to speak, should be a seperate node for best effectiveness.

So in the examples above where the security node is should be hardwired, not wireless, and on a node. The data should be on a hardwired node, and the wireless access should be on a regular wireless node with only as much signal rating as appropriate... and using antiwireless paint as appropriate to contain the signal. Will that stop a determined hacker/TM? Heck no, but it'll make them WORK for it...

The way I have run this, is basically, the group ends up with one node. So, I am abstracting the whole situation due to the subscriptions. So, no one really could hack any of the non-hacker's comms because they are all subscribed to the hacker's commlink. And therefore you end up with not 5 separate nodes, but one node, based on the hacker's comm and then after hacking into it, gain access to the other commlinks...

I don't think there is anything specific in the book about this, but it did seem to make me think that subscribing to devices really changed the way the network reacted. It has worked for me so far and I have even considered having individual nodes inside the group node for each comm, which still needs the spoofing and so forth to access it, but that is just adding another layer (and difficulty), which may or may not be needed for each situation.

But, I think by abstracting the groups comms into one node, stays in line with the rest of SR4 and just keeps it all simple.

Perhaps the Intercept Traffic option to insert faked traffic will work instead.

Only things running Analyze get to Analyze. I usually run corporate nodes as running multiple agents that are all actively analyzing and subscribed to each other. They are instructed as a group and if one is spoofed and not the others the others set off an alarm.

If you want to analyze in multiple nodes yourself you would need to be inside each of the nodes and spending actions to scan each node individually. This comes at great risk though because if you get attacked in multiple nodes you're screwed.

Each commlink is a seperate node. A node can contain multiple devices such as wireless cameras, door locks, etc, and all are behind one commlink. Commlink == node. When two nodes are subscribed they trust each other and allow the exchange of info so a shadowrunner team that has one member with cruddy commlink can get hacked and then all the communications the cruddy one is subscribed to can be messed with, recorded, etc, from the cruddy commlink.

Yes, individual commlinks can be hacked. Hacking from the hacked commlink to another one is not the path of least resistance necessarily but it works. This also means running a low signal commlink to hide from corpsec and having high signal drones near you can allow them to hack you through the commlink built into the drones.

Hope that helps!

If one of the agents is spoofed, how would the others notice unless they succeed in a test to notice the spoof? This isn't something one just automatically knows. Also, to my knowledge there is no possible way to spoof multiple agents at the same time. A spoofed command given to an agent would look as if someone with all of the necessary rights gave the command. Why would an agent put out an alarm against the node itself or a user that gave a legitimate command?

It wouldn't. To prevent an alarm in the event of multiple agents watching each other the spoofed command would also need to go to the other agents as if a group of people were bouncers at a club and a con man had only succeeded against one of the group.


FURTHER LOGIC:
If all the agents are subscribed to each other they can be assumed to transfer information freely. Otherwise a camera on a smartgun would only have a chance of projecting crosshairs to the image link and an agent ferrying a data stream in courier fashion might be incomplete in its transmission.

If the agents have instructions to monitor each other, do not hide from each other, and are transmitting their status to each other then the odd-man-out becomes apparent.


THE COUNTER:
To spoof multiple agents use multiple agents. Instruct them as to what they are to do and point out their targets then tell them to begin. Swarm on swarm. Using Sprites and having the Sprites suppress an alarm is even more effective since a high enough Data Search and Analyze can make it so blitzing is possible without fear of an alarm... unless the Sprite suppressing the alarm is de-rezzed.

I agree with this 1000%.