But spoofing your access ID has another purpose than just redirecting trace, which would make the redirect trace action unnecessary.

Second: The rules say you can only redirect a trace in progress. Which means you cannot continously redirect trace just because someone might try to trace you at that moment. Right? Otherwise every 1/3 action the hacker takes will be a redirect trace (assuming it's a complex action).

As for the crashing, sounds logical but that means cybercombat vs humans is a waste unless you use black hammer or blackout (in which case the persona is unharmed and the person is not).

Hacking: I was assuming the Spider is patrolling the matrix (or just playing GL while still connected on standby). As soon as he get's the alert he can get to the node in question asap. He may even be logged in already, but in AR, and switching to VR is a free action so no biggie. And not logging on the node with the alert is silly, giving the hacker more time. Thus only 1 complex action to get there at best I take it. And he doesen't need to physically plug anything, this is 2070.

Sever connection, I forgot about that one I have never even used it. So I guess this works even if the hacker got admin access? Of course the hacker can use edge on this and easily beat the node.

When inside, the hacker could get away with: 1 search for admin accounts, 2 edit accounts, 3 log off, all which can be done in a single round. So the the IC or Spider has only 3 rounds to find the hacker with a simple action (analyze+computer vs stealth), start trace, and attack with appropriate programs.

Can Spiders and hackers jam a connection like IC do?

Oh, and after getting a backdoor, the hacker can log in in his leisure, delete security accounts and any other admin account, copy everything on the node (given limitless bandwith and storage capacity. Boom, now the hacker has all the info in the node (no need to search while on the matrix), and all the programs (must be cracked) including the IC! Right?

No, read the description of redirect trace... "By redirecting, you send a flurry of spoofed signals out in the hope of confusing the Track program." Its exactly that, spoofing in an attempt to avoid being traced.

Second: If it didn't disallow redirect actions with no trace active, you could simply do it before hand, as a success test (instead of opposed), and then have those success to add to new traces. This was unwanted, so you can't perform the action unless you actually have a trace in progress to oppose the test. Otherwise, I'd let them spend the complex action, and they can guess how well they did based off how many hits they got. They know they were bad (no hits) decent (1-3 hits) or good (4-6 hits) against any given traces running on them at the moment. Paranoid hackers probably would be running this action once every few combat turns, just in case.

Third: Cybercombat against humans is not a waste. It boots the hacker out of the system, the system is on alert, and they have to reboot, and hack in again. Now you're ready for them.

Hacking: As far as patrolling the 'trix already, its still a complex action to validly login with a passcode. Thusly, the hacker has at least one complex action before spiders can show up. Unless they just happened to be in the node the hacker is when the alert goes off.

Yes, this works even if the hacker has admin access. Exploit + hacking skill (6 + say, 7) is 13 dice. Plus edge of 8 at most, is 21. System 6 + Firewall 6 + 4 (active alert) is 16. Not bad. Take out the edge, and the sytem almost always wins. Edge SHOULD let the hacker squeeze by and avoid being booted, remember, hes got roughly 7 complex actions ahead of him to safeguard his entry.

When inside: I thought you wanted to erase security logs too? Or did you decide to cut that out until you're done done hacking? Alright. Search for admin accounts: Interval is 1IP, I'd say admin accounts would be hard, if not extreme. So, threshold 8. Assuming 12 dice, chances are it takes him 3 IPs to find them. (3 hits + 3 hits + 3 hits). Thats one whole combat turn in hot VR, and more in cold/ar. Now, he can edit them, for another complex. Lastly logging off, for a total cost of 4 1/2IPs. (4 complex + 1 simple). Assuming he has a stealth of 6, the spider has 6 analyze and 6 computer, thats 12 vs opposed of assuming 6 vs 6. So, 12 vs 12. Chance are, it'll bounce between the spider seeing him, and him hiding every test. So, chances are, the spider/IC will see the hacker by the 2nd IP. Giving them 2 1/2 IPs with which to start screwing with him, like, crashing his persona, tracing him, etc.

Also, dont' forget that admin accounts would likely also be encrypted/data bombed. This adds even more time to the hacker before he can mess with them.

Yes, Anyone with blackout/blackhammer can jam open a connection.

After getting a backdoor (again, very hard actually) then he can start messing with the node by deleteing security logs (after defeating their encryption/data bombs), mess with other admin accounts, or copy whats on the node. Unless its data bombed/encrypted, in which case, the data bomb can delete the whole shebang. Worthless to the hacker now.

Yeah, it seems to me redirecting trace is something different than spoofing your commcode to avoid datatrail.

Second: Are you telling me that you can try to redirect trace almost all the time, but you don't actually roll unless someone is tracing you?

And yeah my hacker is paranoid

Third: The system is on alert against the intruder. If the hacker has to reboot, he'll probably spoof his commcode as well, meaning the computer should get no benefit against him anymore. And yeah the Spider is now ready for an attack - which might never come. The hacker can wait as long as he want to and the Spider has no way of knowing when the next attack ocurrs, or who was behind it. Seems like waste of time. From now on my Spiders will all be using Black Hammer or Blackout, and carry at least one Black IC backup.

Hacking: Ok thanks for clarifying this for me, didn't remember that part of logging on requiring a complex action and that data search is needed to find the files you want to edit.

My hacker is not nearly that good and can't afford better than rating 3 programs. Or maybe he just prioritized differently (since they got 75k each on a run once). On the other hand he is yet to face a system with firewall 6, best so far is 4 (he's not hacking megacorps, you know.) And he did need to use all 6 edge in the cybercombat vs the corporate spider, which of course had better programs than he did.

Hmm all this tells me I'm not nearly good enough to set up computer security. I've only used data bomb once, I didn't know they were that common,or that they could be used on admin accounts to prevent tampering.

You should note that my hacker has usually only tried to hack systems with low security - and often those with little data of value. It becomes silly if both the local Stuffer Shack and Ares HQ has 6 in all computer stats in all their systems.


Why would searching for admin accounts be hard, or even extreme? If even the admin can't easily access the different levels of user accounts with something as simple as a "list accounts" command, then the system will be a pain in the ass. I have no problems editing and creating admin accounts on my windows OS at least.

You say getting a backdoor is hard, but the part that should be hard is getting the admin access in the first place. Once that done I have a hard time seeing why doing anything at all with the system a legit user can would be hard (except databombs).

Hmm, he'll probably want to search for the password/passkeys to the databombs (defusing all the while) right after turning off the alert.

Edit: Is there any reason why he shouldn't be able to copy all the programs he wants (even IC) and use them for himself (after possibly cracking them)?

Maybe different the application, but they are both spoofing something, they're seperate actions with seperate mechanics, and if you want to use spoof to hide your datatrail, guess what, its a redirect trace action. (Its like saying you want to use an action to pull the trigger on your gun, when theres an action for fireing a weapon already, how you describe doing it is irrelevant, the action is there, and thats what you use.)

I'd say that redirect trace actions could easily be rolled by the GM the same as perception checks. If you're so paranoid that you redirect trace once per combat turn, then the GM can factor that in, and roll a handfull of dice every combat turn. You don't know how you did, or if you were even being traced, which is how it shoudl be.

I'd argue an alert is an alert. Being on alert gives it an extra +4 firewall to any intruders it knows are intruders (has defeated their stealth program).

Data bombs are great. They sit there, and unless you spend a simple action to observe in detail the file you're going to access (and succeed with a hit to ask if theres any data bombs on it), then you don't know its there. When you trigger it, you take its rating in damage on your condition monitor. Also, it can erase the file when its activated (as well as working with encryption). Fantastic for slowing hackers down (even if only to make them waste simple actions examining every file before they touch it). They can't outright prevent tampering, but, they do hinder it in an extreme way. If you try to access the admin files, and set off the data bomb erasing them, you can't just recreate them (since you never saw them) so you can't easily edit in a new admin account for yourself either. Encryption is nice too, first, they have to decrypt the file, once thats done, disarm the data bomb. Encryption wastes time for them to break, and the databomb will remove the file if they fail to disarm it before opening the file. Fanstastic stuff really.

For the same reason that hacking one is a +6 threshold modifier. I figure, if an easy search is threshold 2, and hard is threshold 8. Its more of carrying over that its not the easiest thing in the world to mess with admin accounts (as theoretically, once the system is set up, you shouldn't need to access them very often). The people who run the system will know where the file is, and won't require a browse action to find it, since they already know where its at. Liken the browse action to using the find feature in windows, to look for some file, versus just knowing what folder its in, and navigating to there via explorer. Which is faster? (Well, generally, knowing where its at is).

No, getting admin access semi-easily (especially if you probe it first) is a nessecity for hackers being useful in a shadowrun setting. The backdoors are what cause problems, and they are hard to make. You don't know the passcodes/locations of everything. So, first, you find the admin accounts files, Then observer in detail it, decrypt it, observe in detail it again, disarm the data bomb, and now, you can finally edit it. Thats an extended action, simple, extended, simple, complex, and simple. Quite a bit of time for security to respond.

What kind of system are we talking about? No secure system would have the passcodes laying about. Search fails, period.

Yes, encrypt then databomb them all. Unless he wastes the time to decrypt and then disarm all of them, when he tries to copy them, the databomb goes off, and crashes his persona, as well as removing the file. He gets nothing.

Sidenote: Does your name mean eventually you could become a Dorksaken?

Alert: The books specify that alerts are against "the intruder", but as others are detected by analyse+computer when trying to break in they become intruders themselves. My point was that if he has a backdoor the system identifies him as admin, not as an intruder so the alert is useless.

Data bombs: The player mentioned something: If he copies a file with a databomb ,the bomb should not go off as the file is not opened or changed. Then he can search and disable the bomb, descrypt it etc. If this was the admin files, then he could probably get the passwords from it right? After all the admin account must know the passwords to recognise them when a legit user uses them. That was what I meant by searching for passwords etc. before. Of course to access them you need admin access, you need to get around the databomb and you need to decrypt the files.

Hmm seems like you said even copying will trigger the databomb. My player thought that couldn't happen as the databombs can't detect that you are copying them (at least there are no programs today that can detect itself being copied). I don't know what's right, and the book is as always silent... except it says that if someone tries to access the file the bomb goes off. Arguably copying IS accessing.

Sidenote: That is for the Gay Lord of the Dork to decide. As a true follower I make no demands.

(PS no disrespect to any gays)

Yeah I know, but I need SOME way of understanding what can and what can't be done, and when the books are silent or nonspecific I have nothing to turn to other than real life.

Ahh, yes, then I would agree, a validly logged in admin would never be considered an "intruder".

Data bombs say their effect occurs when someone accesses the file. Not opens. Accesses. This to me says doing anything at all with the file contents. I.e. Edit/transfer/read actions set it off; Analyze or browse actions don't.

Actually, yes, current day programs can detect when a FILE is being copied. How? Because the hard drive is reading the sectors in which the file is located. Data bombs protect files(which can be inactive programs as well). So yes, it will know when it is being copied, and having not been defeated, inflict rating dmg to his matrix icon, as well as sounding alerts/erasing the file as instructed.

Ty I think this answers my questions. Ugh, until next time my player who admitedly knows alot more about computers, networks and hacking than me comes up with a new dilemma.

I'd guess that actually restoring the system would take some time in off-hours, as they need to physically reset and restore the whole system at location.

Hmm, yeah this was pretty much what I envisioned. The reason I asked is that my player have read tons of referanses to a cyberlimb or other cyberware being hackable in the BBB, but if everyone just uses DNI and only activiates wireless when going to the doctor, hacking cyberware is not a good strategy.


I have yet another question, but I'll make a new thread.

Remind me to put my admin account in read-only memory – to save me the trouble of having to go down to the office and restore the system in the middle of a rainy night, having the guards make clever comments about my ork barbarian PJs and pink, fuzzy bunny slippers, and then having to hack all their finances and give them some interesting criminal records.