QUOTE (Karoline @ Apr 26 2010, 02:52 PM)

There really isn't anything about this in the books. I'd say if it was a long hack (The kind that takes several hours) then it would remain until they do a complete upgrade of their system (Likely several months or longer), or at least receive a patch that fixes whatever exploit you used (Which might happen every few weeks). On the other hand, if you run a quick hack, I'd imagine it would last on the order of a few hours or days. Because the exploit was done quicker, it is more likely to be noticed. Perhaps oddities in the logs, perhaps some part of the code that will correct itself on each reboot. Whatever the case, I wouldn't expect it to last beyond one business day (Hacks over the weekend might take longer to notice if the system isn't being monitored much).
Just going by RL times, when it comes to Admin accounts in the systems I provision for the company that I work for, if they are not supposed to be there, it takes less than two or three days for it to be brought to someones attention. The recon people get only two days after that to identify the who, what, when, where, how, and why for the account. After that time, if it is still an unidentified account, it is terminated. So, that's just about a week before said login would be found and trashed. This is assuming of course that someone didn't go through the process of falsifying records to make the account appear 100% legitament. So the real question is, does creating these accounts assume that these records are created to, or does it just make the account? If the records were created, a falsified account would last 3 to 4 months before it was noticed when they did quarterly access certifications. I work for one of the biggest finicial companies in the nation, which I think would be a good modern day representitive of the megacorps of the future.
Now, this is assuming you are actually using a user account. If you are actually exploiting a hole in the system, then I agree with Karoline, it could take a good amount of time before it's found.