I'm not the most tech savvy guy in the world. Most of my computer knowledge begins with remembering how to write code in FORTRAN and ends with "Did you try turning it off and on again."
I was wondering, if my players are tracking down someone and they use the Safehouses option of finding a Hacker's personal "electronic handwriting" or if I just want to describe a particular hacker's style, what are some adjectives I could use to describe a hacker's footprints? How would you describe the coding or methods of certain hackers over others? Antiquated or unusual terms always welcome. Thanks!

Better idea, watch the original Tron, then the movie Hackers. Any time I try to apply real-world programming or electronics hardware logic to Shadowrun, my brain sits down and cries.

This isn't 2012 computer programming. The Matrix works with virtual reality and direct neural interface. The programmer isn't a coder he's a sculptor or a craftsman. Use this metaphor and you'll be fine.

QFT

In the fiction there are hackers that'll refer to writing or slinging code, including Bull (the best ork decker you'll ever meet) and maybe Slam-O!. But the bulk of it boils down to the sculpting now, how it looks in the matrix, as opposed to a particular line of code that might be a signature of a particular hacker. Think of it as the 'Z' scratched in the adobe wall that was the mark of Zorro, or something, and your brain won't pop like a pimple at trying to figure it out.

And though the story lost to the visual effects of Tron Legacy, there are some beautiful visuals there that can help out as well. I suggest that movie, too, but watch it at your own risk. You won't be able to un-watch it.

Style over Substance!

Another angle could be the hacker's modus operandi... maybe the hacker is extra careful and always takes time to probe the target, remove logs, etc. This would be the work of a real professional, not leaving traces or anything (which by itself is also some kind of "handwriting"). Another hacker could just kick down the door and fight his way through the defenses, leaving a trail of destruction.

Bye
Thanee

really bad and annoying?
and this will be one of the few times i am willing to accept the existence of the Die Hard 4.0 movie . .
watch it, cringe and remember.

Wait. What?

My god, Hackers was so bad at describing anything about computers.

Which is exactly why they said to use that as a comparison to the Shadowrun matrix rules.




-k

The only remotely interesting thing about Hackers was that the 'bad' guy rode around on a skateboard pulled by a car.

And a young Angelina Jolie in a wet t-shirt...

As far as SR4 goes, the fact that they are calling crackers hackers sets off my geek early warning system just about every time. While it seems like they've maybe got some clue of how networking might really work in the 2070s in some of the fluff (albeit w/ a lot of holes and inconsistencies), the rules themselves seem designed to streamline and speed up game play and gloss over any real technical detail. Ultimately this is a good thing for the sanity and sustained consciousness of the GM/non-networking geek players IMO.

My specialty isn't Incident Response (especially not at the level you're talking about), but you will see a few pieces that lets you put together a pattern. I also don't play SR4, so I don't know what the safehouses options are.

The obvious one is similar or related actions which are temporaly adjacent. If someone is calling Verizon asking for my password reset, and fifteen minutes later someone is hitting my router through my verizon account, that's a good hint. Most likely your links will be a little more tenuous, though. The most common example of this is a ping on port 1, then a ping on port 2, and so on.

You can also identify an individual using his traffic routing and periods of activity. If you have five attacks through the month, all between 2am and 4am, through a particular proxy, that's a good hint it's the same person.

Third you can look at the software. Most substantial attacks require loading software onto the target, be it a virus, utilities, whatever. And most hackers are lazy, so they have a handful of tools or even packs of tools they load up. Even if they delete the tools afterwards, it's possible to recover them, and from that you can detect the list of tools, their version number, custom scripts and configurations, etc. If it's a new virus, that's pretty damning. Most likely you just have a bundle of remote clients for common tools, but still recognizing that this guy is using beefhook 5.2 and a stripped down version of webscarab marks him as different from someone using a different set of tools. And since there's a number of tools available for any particular purpose (especially for something like ftp!) there's enough variation to get a sense for the person. If a person is creating multiple viruses, you can still recognize similar code tricks between them, because people write their code differently.

You can also look at the system logs to determine the order of activities. If gain entry, ftp in my tools, add myself as a user, then log in, this may mark me as different than someone who gains entry and just keeps leveraging between servers, or who gains entry, does whatever, and leaves. In Shadowrun, this is also the difference between the guy who wanders through servers for fun, who only hacks to reach a particular goal, who loiters to monitor traffic, who smashes the defenses, who sneaks, etc.

With the tremendous amount of data available in Shadowrun, all of these become more poignant. There's a thousand tools and versions out there. There's a hundred items that require special coding, and the hacker will cut and paste like crazy, etc.

Because this is Shadowrun with the VR component, you can also insert stuff about what his avatar looks like, or the kinesics of his avatar's locomotion or how he's customized his attack program to work.

Bazinga!

Hackers is still a great movie despite being super dated (someone mentioned Jolie in a wet t-shirt, remember also you get a very brief glimpse of her pre-surgery breasts as well!). Evil corrupt hacker tries to rip off megacorp and street level hacker gang becomes to the scapegoat. But it doesn't really address the signature issue.

Assuming this isn't a techno that you're dealing with, the key thing is how the hacker sculpts his metaphors and if any of the characters are mathematically inclined, they could detect patterns in the way he cracks copy writes and codes. No matter what, computer technology is still based heavily on mathematics. If the hacker in question probably has some sort of MO in regards to how he writes his own apps or cracks/modifies existing code.

Many things can tip off someone in how the code is structured. Most of the time, at work, I know who worked on a particular piece of code without having to resort to my log files simply because they used comments situated a certain way. Verbose code versus slimmed down code. Different algorithms that are structured and sculpted a certain way. The amount of documentation that is attached to different lines of code. What variable, object, class, interface, ect naming schemes they have.

If you're looking at a corporate API, the functions and such are named something that everyone in the company understands. If you're talking about a consumer API or a distributed API, then the naming conventions change to match a larger subset of programmers. Technically, all functions and objects could just be named 'Cow' or the letter X. The computer doesn't care what it's named, quite honestly, so long as it doesn't find conflicting names elsewhere. It's all a bunch of 1's and 0's at the end of the day, no matter if you're talking about current programming or VR. It's just a different amount of 1's and 0's.

As stated previously, Deckers finesse the matrix in which they're currently loitering/guarding/spoofing/looting.

Use visual metaphors, mention how attacks form out of nothingness as the security tally (I run 3rd, do you even have those anymore?) rockets up when your player just HAD to gank the oblivious security bot/Patroller 6 and now the nasty Ice has come out to play.

Sculpted systems are a living metaphor; use castles, markets, offices, airports and populate them with "ordinary" people/programs (What's your identity, program?) that the decker has to sleeze their way past or adapt their icon on the fly to "fit in" and get the thing done.

Hacking into a local megacorp satellite office? Imagine Dwight and the rest, but your players are trying to get into his office and steal files from his desk, while he's trying to get it on with what's her face.


Deckin' ain't borin'. Git some!

-Tir.


And Tron Legacy is better thought of as a 127-minute music video with occasional rambling dialogue over the rockin' soundstrack.
-Silly user should have backdoored the system before tinkering with the hardware...amateur mistake...

Good answers all and keep them coming.
For the record I, and everyone alive, have seen Al Gore's favorite movie: TRON as well as read my fair share of William Gibson. I can work out an ASIST metaphor and sculpt a node just fine, but not being tech savvy I'm not sure what parts of scifi description of hacker footprints are legit and which are bollocks. Could you describe one hacker as being "playful" while another looks "overly cautious."
Could you describe a hacking style as antiquated, forceful, insouciant, blase, introspective, weird, Jack Kirby-esque, etc? Or would all of those seem overly ridiculous for any tech minded person to ever utter when describing a hack?

Think of a persona's icon as a metaphor of how a person wants to look in the matrix, with all the facial twitches and quirks that people have in the meat world (check pages 40-41 in Unwired for an example). You can pretty much put all of those descriptors in for a matrix user while in VR as you could people in the real world.

Regarding footprints, could be described the same way as finger prints and other such signature things in the real world. Would be most likely found by using an Analyze program (with higher grades likely looking like some kind of visual aid). Unique programs will leave unique effects when used, and I don't see any reason why this can't be described visually too.

As for 'antiquated', that might work better as describing a persona and/or icon as being 'low res'. Think of this in a video game graphical sense, like comparing Link in the original Legend of Zelda on the 8-bit NES to the same character in Skyward Sword. Still, unless you're in a military/government grade ultraviolet node (not something the general public can usually access), persona icons are still recognizable as computer generated.

The idea of electronic handwriting goes back a long ways, starting with the telegraph. A skilled operator could tell who was on the other end of the line by how they typed in the dots and dashes.

Advance a bit further, and you'll find that programming is the same thing. People have individualistic styles of typing and using code that can also be recognized. Some more than others. (My teachers hated to mark my code because of my very individualistic styling, which came about because I had to work with a defective computer in High School as a challenge. The teacher in that class knew I was good for it.).

Now, Deckers (And Hackers that AREN'T Skript Kiddies!) are likely to have the same things going for/against them. Their programs of choice, either coded from scratch or modified from another program, and how they execute commands (which, according to the fiction and other items since SR1, require a little "Fine Tuning" as you're firing them off) are likely to have just as much of a style as anything else, a signature if you will. Even worse if the character has the "Signature" quality. (I think that's what it's called. I'm tired.).

So, yeah, that's the background for the reason I put in that bit of information. Hope it helps in some way.

I'm not talking about observing personas without a Reality Filter or describing node metaphors. I know how to do that. That stuff is limited only by your imagination and doesn't need any technical insight.
I'm talking about descriptors of a hacker's "digital/electronic handwriting" as described on p. 12 & 15 of Safehouses which is a Data Search and not an Analyze test, and things like observing changes to a node's Access Log. Stuff where the user's persona is no longer present in the node so it can't be Analyzed, but where the presence of something can be found and the way in which it was done points to a particular style of hacking as opposed to a particular configuration of a persona, it's attached programs and the way it interacted with the node's ASIST.
Stuff that breaks down some of the overall metaphor of the Matrix and gets into some of the actual coding. The nuts and bolts of the Matrix only hackers deal with. Something on how hackers would talk to each other in a way only they can understand. I'm looking for some shop talk amongst techies and how they might describe the way a fellow hacker hacks as opposed to how an ASIST might interpret that for your average Matrix user.
Something I can have an NPC hacker say to my technomancer or some way I an describe electronic footprints to her that would resonate to someone who actually codes things.
I get how ASIST works; but I don't know if, when describing a hacker noticing trends in actual lines of code, I'm describing things in a way that a technical person might or if I'm just spouting jibberish like a Liberal Arts major.

Yeah. That. I'm looking for that. How would you describe your own individualistic stylings and how might you describe other's?

It's a lot like writing styles. Some people have very distinctive style of flow (I'm said to be one, and I have to work hard against it when writing in other "Voices". I had to delete three times what I wrote for Safehouses, as it didn't "sound" like /dev/grrl, but did sound like me.).

Most of my classmates, having just learned how to program, are very basic, very textbook. Very boring, but sufficient. Generic lines, reused code from other programs frequently that aren't as effective but do the job, so on. This isn't a smack against them, as their style worked just fine, but was very bland.

Myself, I gave myself a bit more flare, putting my creative juices into things, and custom building items at times. Sure, I "Re-invented the wheel" often, but sometimes you want a smaller wheel or a larger one, right? Custom transmissions as well. It made my work identifiable, but hard to go through for someone else. But there was no mistaking it compared to folks who just used textbook.

And that's not even including comments in the code, to explain what you're doing, where, and why. Which isn't always done. Got to have job security somehow.

There are two different things here:
- The modus operandi: the hacker probed the target/used a known backdoor/forced his way in, once inside he hid completely/attacked everything in sight/acted as an administrator and so on.
- The code signature: I disagree with you here, you can have code without breaking down the metaphor. For example, the hacker erased/corrupted the logs, depending on the way he (and his programs) works, the log file might look burnt, cut with scissors, shredded, covered with paint, covered with "censor" or "redacted" blocks and so on.

I think I get what you're looking for. Imagine this, if you will;

You are tasked with telling a story before an audience. It needs to be a very particular story, with a particular beginning and end. But in the middle, things keep on changing, as the audience demands particular new characters or challenges or whatnot. Oh, and your entire story needs to be told in Italian.

You've done this before, though. So you can bring your library with you of stories (and story pieces) already translated for you, that either you, or other people wrote for when they had to do this.

How do you tell your story? Do you tell the same chunks every time? Are the chunks modified to be as quick as possible, or do they wander a little? Do you make up new pieces sometimes? If someone saw your books, what would they find? Do some pieces contradict? Have some pieces never been updated? Are all of the pieces even useful?

So imagine that library. Some code is really refined. Some is cribbed. Some is everything and the kitchen think. Maybe it's clunky and doesn't make sense. Maybe it's really sharp (and doesn't make sense). Maybe it's just straight-forward, with no flair. So on and so forth.

The Kitchen Think is vitally important. I used it in a lot of my programs.

Something to keep in mind is that the choice of compilers will affect the code that a hacker writes. You can justify recovering code from a node's temporary files. For example, assembly language allows you to highly optimize your code, but takes a long time and requires some knowledge of the system hardware. A full suite of hacking tools will be fast as lightning if written by a gifted coder, but will be attacking old exploits. Visual Basic will allow rapid turn around to attack new vulnerabilities, but the code is incredibly bloated. C code is going to be a good balance of development speed and optimized code. With the variety of languages and the ability to mix them (writing an oft used routine in assembly, but coding everything else in c), the fact that different programmers will have different strengths (sort algorithms, database knowledge, etc), and the mixture of purchased, freeware, and home written code (this code used Ares routines, or this error was caused by a freeware unsigned math library), I think these are the characteristics that make up a hacker's signature.

A hacker using Ada has obviously been hit by psychotropic black IC.

for RL more or less this. Theres more than one way to tackle a problem so some people like regular expressions others like loops and temp files etc etc

Unlike RL, In SRworld there really isn't going to be many people writing code for attacks. It's just not something well supported by the rules. Pretty much everyone is going to be using the COTS programs.

Well, someone wrote it. So, you might not say this attack software code is characteristic of Bitm0use, but you might say that this code is reminiscent of Hoosier Hacker House software. That combined with the sequence of events leading up to the breach indicates that we are likely looking at bitm0use or a copy cat.

Anyway, that's how I would play it.

I also bet that anyone save Skript Kiddies are likely to be writing their own to exchange with the warezhaus.

Or has at some point worked on a military contract.

Mmm. Regular expressions.

I enjoy languages where I can load a regexp in a select/case/switch statement since I do a lot of work dealing with data out of databases. That way I can query the major recordset and parse each record off to it's destination, usually by some sort of assembled key based on record fields, instead of running a query for each subset of records which works well since regexp are great for more closely analyzing a string value than you can get with straight conditionals.