Help - Search - Members - Calendar
Full Version: Hacking bank accounts
Dumpshock Forums > Discussion > Shadowrun
Pages: 1, 2, 3, 4, 5, 6
SpellBinder
Get the players for the thrill of it, not the monotony of a daily grind. Hacking a thousand accounts a day for 5 nuyen each would be like doing customer service and helping 100 customers a day for the same thing. Might as well classify yourself as a wageslave at that.

Also try getting them in the reputation. Word spreads through the shadows in mysterious ways, and a particular contact could make a disparaging remark about the mass robbing-the-poor style of earning cash.

And in the case of hacking, there's always the Honeypot (see Unwired). Something I had set up for a player of a magician who wanted to start earning extra cred by mugging people (by using a Fichetti Pain Inducer), his first mark was going to actually let him walk away with a relatively big score of five thousand nuyen. That nuyen, unbeknownst to the player until he tried to spend it (easy enough), was going to be forged and automatically set off alerts when used. Now I know a smart player might actually check the cred first and pitch the stick it's on, but this one wasn't all that bright.
FuelDrop
I'm personally thinking of doing a little bit of hacking to try and recoup the losses from our current run. 40 grand between six characters isn't much to begin with and factor in that most of us needed to buy new vehicles for the terrain and I'd lost money on the run before it even started!
Let me explain: The person that got the call was our uncouth sniper adept, who didn't bother to contact any of the three primary faces and instead went with the dwarf hermetic mage as his face *Facepalm*. he got the mission without asking for any details ("It's a manhunt." "Tell us more about..." "I always wanted to do a manhunt! Let's go!" "We'll give you 40 grand for it." "Let's nego..." "Sounds great, done deal!" *Facepalm*)
The only reason the rest of us agreed to come along is that a) It's not fair on the GM to just turn down his missions and b) Our group has a 'Stick together, so that if one day you're the one in trouble someone's got your back' philosophy.
The first commlink I hack is going to be his. Seriously, if I'm getting paid less than it costs for a second-hand dirtbike and a second-hand antique rotordrone then I expect the mission to be straightforward, not scour 400 square km for a gone-to-ground paranoid survivalist who's security clearance at Ares was so high that our middle-manager contact can't even find his job description on the system! Oh, and have I mentioned that he's buddies with the local authorities who patrol the area in armoured rovers sporting machine guns?!?
Yeah, Malcolm (the pc) really dropped the ball on this one.
Tymeaus Jalynsfein
QUOTE (FuelDrop @ Nov 16 2012, 03:58 PM) *
I'm personally thinking of doing a little bit of hacking to try and recoup the losses from our current run. 40 grand between six characters isn't much to begin with and factor in that most of us needed to buy new vehicles for the terrain and I'd lost money on the run before it even started!
Let me explain: The person that got the call was our uncouth sniper adept, who didn't bother to contact any of the three primary faces and instead went with the dwarf hermetic mage as his face *Facepalm*. he got the mission without asking for any details ("It's a manhunt." "Tell us more about..." "I always wanted to do a manhunt! Let's go!" "We'll give you 40 grand for it." "Let's nego..." "Sounds great, done deal!" *Facepalm*)
The only reason the rest of us agreed to come along is that a) It's not fair on the GM to just turn down his missions and b) Our group has a 'Stick together, so that if one day you're the one in trouble someone's got your back' philosophy.
The first commlink I hack is going to be his. Seriously, if I'm getting paid less than it costs for a second-hand dirtbike and a second-hand antique rotordrone then I expect the mission to be straightforward, not scour 400 square km for a gone-to-ground paranoid survivalist who's security clearance at Ares was so high that our middle-manager contact can't even find his job description on the system! Oh, and have I mentioned that he's buddies with the local authorities who patrol the area in armoured rovers sporting machine guns?!?
Yeah, Malcolm (the pc) really dropped the ball on this one.


So just ambush one of the patrols and take their stuff (I assume that your team is somewhat competent, so this should not be all that difficult). Why you got to buy your own?
Mantis
I'm not sure the word "buy" should really be in your vocabulary for many jobs. Just figure out who has what you need and swipe it so long as it isn't specialized gear.
ShadowDragon8685
QUOTE (Tymeaus Jalynsfein @ Nov 16 2012, 07:15 PM) *
So just ambush one of the patrols and take their stuff (I assume that your team is somewhat competent, so this should not be all that difficult). Why you got to buy your own?


Kill a bunch of cops and hijack an armored security vehicle that's going to be filled to the nines with a bare minimum of tracking devices, if not mechanisms by which the vehicle may be remotely shut down?

Good plan!
taeksosin
HERF gun? biggrin.gif Though, if I remember right, that might not work on all dohickeys.
SpellBinder
QUOTE (taeksosin @ Nov 16 2012, 06:19 PM) *
HERF gun? biggrin.gif Though, if I remember right, that might not work on all dohickeys.
Like stealth tags. nyahnyah.gif
taeksosin
What's the range of a broadcasting stealth tag anyways?
SpellBinder
The default is Signal 1, which is good for roughly 40m, though I'd wager it's possible to augment that to a 3 (a range of 400m), and I recall reading somewhere about a Signal 5 tag.
Halinn
Even at just 40m, usually that's good enough to bounce off something with a higher signal.
Tymeaus Jalynsfein
QUOTE (ShadowDragon8685 @ Nov 16 2012, 06:05 PM) *
Kill a bunch of cops and hijack an armored security vehicle that's going to be filled to the nines with a bare minimum of tracking devices, if not mechanisms by which the vehicle may be remotely shut down?

Good plan!


There are ways around everything. And it is not like your keeping them. Unless you are, of course. *shrug*
FuelDrop
QUOTE ('ShadowDragon8685' date='Nov 16 2012 @ 06:05 PM')
Kill a bunch of cops and hijack an armored security vehicle that's going to be filled to the nines with a bare minimum of tracking devices, if not mechanisms by which the vehicle may be remotely shut down?


Good plan!
QUOTE (Tymeaus Jalynsfein @ Nov 18 2012, 07:45 AM) *
There are ways around everything. And it is not like your keeping them. Unless you are, of course. *shrug*

Who said anything about cops? The patrols are military.
Yeah, there is no way we're getting paid enough for this one.
ShadowDragon8685
QUOTE (FuelDrop @ Nov 17 2012, 08:57 PM) *
Good plan!

Who said anything about cops? The patrols are military.
Yeah, there is no way we're getting paid enough for this one.


Which military, specifically?

You might be able to get paid twice by impersonating a rival military and framing them for a border raid.
SpellBinder
QUOTE (Halinn @ Nov 17 2012, 02:55 PM) *
Even at just 40m, usually that's good enough to bounce off something with a higher signal.
As long as your transmitter with the activating key code is within range, and depending on how the stealth tag is programmed (maybe it'll only connect to the device that gave it said key code despite how every wireless data is a router?).
Draco18s
QUOTE (SpellBinder @ Nov 17 2012, 10:43 PM) *
As long as your transmitter with the activating key code is within range, and depending on how the stealth tag is programmed (maybe it'll only connect to the device that gave it said key code despite how every wireless data is a router?).


Stop, stop right there. Don't question how it works, because Shadowrun's matrix does NOT function like the real world.

A stealth tag can, and will, phone home without an "activating source" and will perform signal relays.
FuelDrop
QUOTE (ShadowDragon8685 @ Nov 18 2012, 10:23 AM) *
Which military, specifically?

You might be able to get paid twice by impersonating a rival military and framing them for a border raid.

I am so using this. Heck, if we get enough people to pay us for the one job then we might break even!
SpellBinder
QUOTE (Draco18s @ Nov 17 2012, 10:55 PM) *
Stop, stop right there. Don't question how it works, because Shadowrun's matrix does NOT function like the real world.

A stealth tag can, and will, phone home without an "activating source" and will perform signal relays.
I know that, but I used terminology that's used in the books.

And right from the book:
QUOTE (SR4a, page 329)
Stealth Tags:Stealth tags are encoded to remain silent and only respond to transmissions with the proper passcodes. They cannot be located with a commlink or bug scanner (unless the codes are known). They typically use special frequencies and other tricks to avoid detection. These tags are also disguised so as not to look like RFID tags (an additional –2 Concealability). Stealth tags are often used as a backup for security tags, and may be implanted in the same way.
That there says they're not even acting as a passthrough for data for other devices, and unless you've got the passcode they're very difficult to find.

Of course it's also possible for a stealth tag to be programmed to periodically 'phone home', but they'll be found by the paranoid hacker that leaves his Scan and Sniffer programs running 24/7/365 or the TM who happens to sense an occasional pulse of data on a regular basis.
Tymeaus Jalynsfein
QUOTE (ShadowDragon8685 @ Nov 17 2012, 07:23 PM) *
Which military, specifically?

You might be able to get paid twice by impersonating a rival military and framing them for a border raid.


Thought you said it was a Bad Plan ShadowDragon8685.
ShadowDragon8685
QUOTE (Tymeaus Jalynsfein @ Nov 18 2012, 10:24 AM) *
Thought you said it was a Bad Plan ShadowDragon8685.


It is, but they seem to be stuck with it. Therefor, if they can get away with pinning the blame on someone else - and making enough money to turn a profit, or at least break even - so much the better.
Eratosthenes
There are a few deterrents to this kind of mass-hacking:

1) Banking transactions should typically require biometric authorization, even for a $1 soycafe. They could also possibly require other autorization schemes (confirmation dialogues, passcodes, etc.), that come from the banking system, and not from the user's commlink. Meaning you'd have to hack the bank's node to bypass these schema.

2) Assuming you got by #1, most people will notice that their accounts are shortchanged in due time, and report the descrepancy. Even that $5 slice of pizza or coffee is likely to alert a decent percentage of people. If the banks start getting alerts about fraud (and it's entirely reasonable to believe banks share fraud alert information to better combat fraud), they'll likely assign an analyst to look into it. If it appears to be widespread (i.e. you're hacking enough people to make this profitable), they'll assign a team to analyst the fraud.

3) One hack might go undetected, and be impossible to trace. 1000 hacks will not only be detected, but will provide much more information for the investigators. They could pull security footage, correlate the locations of victims to determine where the attacker was sitting/standing/idling in their van, etc. Even if they cannot locate the current whereabouts of the hacker, they could easily determine a modus operandi, and set baits and traps for them. The honeypots, as someone else said, or just people on the lookout for this sort of fraud.

4) Someone has likely already tried this. Busy locations may very well already have the occasional plain-clothes hacker-cop keeping an eye out on wireless traffic for these kinds of schemes.

But, really, #1 should be enough to shut this sort of thing down. A simple "What's your secret confirmation passcode for this purchase?" sent from the bank's own node via an encrypted subscription for any purchase should be enough to prevent unauthorized purchases. Sure, some dumb people will have their passcode stored somewhere on the commlink (there's no accounting for human stupidity), but there's no reason to think the majority will, since responding to such a query is easy, and likely has been drilled in to the populace by the banks to prevent this sort of fraud.
Draco18s
QUOTE (Eratosthenes @ Nov 19 2012, 10:25 AM) *
1) Banking transactions should typically require biometric authorization, even for a $1 soycafe. They could also possibly require other autorization schemes (confirmation dialogues, passcodes, etc.), that come from the banking system, and not from the user's commlink. Meaning you'd have to hack the bank's node to bypass these schema.


Uh. No you don't. If it's any kind of request from the bank to the compromised comlink, then it's bypassable at the comlink level.

The bank queries a security question, the hacker gets the opportunity to spoof the response.
Eratosthenes
QUOTE (Draco18s @ Nov 19 2012, 10:50 AM) *
Uh. No you don't. If it's any kind of request from the bank to the compromised comlink, then it's bypassable at the comlink level.

The bank queries a security question, the hacker gets the opportunity to spoof the response.


Sure. Spoof or hack. Regardless, the hacker would be spoofing the much more secure bank system than the personal commlink.
_Pax._
QUOTE (Eratosthenes @ Nov 19 2012, 09:25 AM) *
There are a few deterrents to this kind of mass-hacking:

1) Banking transactions should typically require biometric authorization, even for a $1 soycafe. They could also possibly require other autorization schemes (confirmation dialogues, passcodes, etc.), that come from the banking system, and not from the user's commlink. Meaning you'd have to hack the bank's node to bypass these schema.

A small-amount transaction is probably not going to require biometric authorisation.

Also: if you ever need more than your own commlink to spend money, then effectively, you can't spend money. IOW: no matter what the bank does, if simply having (or controlling) the commlink in question is not sufficient to initiate, conduct, and successfully conclude even a SMALL transaction ... the entire premise of how SR4 handles money and electronic transfers breaks down completely.

QUOTE
2) Assuming you got by #1, most people will notice that their accounts are shortchanged in due time, and report the descrepancy. [...]

Key words, "in due time".

True story: the other day, I glanced over the family cellphone bill out of curiousity, and because we've been discussing ways to tighten up our budget and save some money lately. I noticed two charges on my g/f's phone that seemed out of place - insurance for $7/month, and some download subscription for $4/month. The insurance has been getting paid, without being noticed, since she got the phone three or four years ago (and those payments have now exceeded the price of her phone, twice over). The download charge started LAST MAY, six months ago. And we're only JUST noticing it now.

QUOTE
3) One hack might go undetected, and be impossible to trace. 1000 hacks will not only be detected, but will provide much more information for the investigators. They could pull security footage, correlate the locations of victims to determine where the attacker was sitting/standing/idling in their van, etc. Even if they cannot locate the current whereabouts of the hacker, they could easily determine a modus operandi, and set baits and traps for them. The honeypots, as someone else said, or just people on the lookout for this sort of fraud.

That's why you (a) use a disguise, (b) pick a VERY busy place, © never go back to fetch the commlink, (d) set the commlink to delay the onset of it's hack attempts for 1 or 2 hours (it can spend the intervening time scanning and analysing the surrounding nodes to pick out he ones that aren't mobile - and pu them on it's "don't bother" list), and (e) use the Palming skill to surreptitiously Gecko-tape the commlink to the underside of something.

As for the modus operandi, that's why I said you never repeat the same scam in the same location less than three months apart. Preferably less often than that.

QUOTE
But, really, #1 should be enough to shut this sort of thing down. A simple "What's your secret confirmation passcode for this purchase?" sent from the bank's own node via an encrypted subscription for any purchase should be enough to prevent unauthorized purchases. Sure, some dumb people will have their passcode stored somewhere on the commlink (there's no accounting for human stupidity), but there's no reason to think the majority will, since responding to such a query is easy, and likely has been drilled in to the populace by the banks to prevent this sort of fraud.

Even if the system works that way, you know what happens? Your self-replicating Agent program is under orders: "Sit back and watch. When transactions are made, RECORD THE SECRET PASSCODE. Then and only then, send 5¥ to ____, and upon confirmation of the transaction, delete EVERYTHING from the commlink.... including yourself, last of all." And with Admin access to the commlink, even an encrypted subscription doesn't matter. The Agent would have the decryption keys.
almost normal
And there'd be a log of that particular access ID being the last thing in the node before everything crashed. Quick way to get caught.
Eratosthenes
QUOTE (_Pax._ @ Nov 19 2012, 01:26 PM) *
A small-amount transaction is probably not going to require biometric authorisation.

Also: if you ever need more than your own commlink to spend money, then effectively, you can't spend money. IOW: no matter what the bank does, if simply having (or controlling) the commlink in question is not sufficient to initiate, conduct, and successfully conclude even a SMALL transaction ... the entire premise of how SR4 handles money and electronic transfers breaks down completely.


Hrm, I disagree (though that does not preclude me from being wrong).

An example transaction from Bob to Sally, for $5:

1) Bob tells his commlink to transfer $5 to Sally's commlink.
2) Bob's commlink notifies Sally's commlink that a transfer shall take place. It gives her his banking information, and receives her banking information. Effectively a banking handshake.
3) Bob's commlink notifies his bank (hereforth known as Bank) to transfer funds to Sally's banking information (hereforth known as Recipient).
4) Bank sends a verification ping to Bob's commlink, for a verification passcode, biometric scan, (perhaps parental consent sent to a guardian's 'link), whatever, via encrypted subscription (basic encryption software baked into the banking software the commlink comes with).
5) Upon verification, Bank releases the funds to the Recipient, and logs the transaction.

The handshake, and verification, are nigh instantaneous. So you can easily have it apply to any and all transactions. The only reason we forgo needing a signature for credit card purchases for amounts less than $20 today is because it's a hassle for the merchant (cost/benefit/risk analysis). Given the ease of obtaining verification there's no reason to not do it for every transaction. Can the verification be spoofed? Sure. But you're spoofing the bank's system, not the more vulnerable commlink.

QUOTE (_Pax._ @ Nov 19 2012, 01:26 PM) *
Key words, "in due time".

True story: the other day, I glanced over the family cellphone bill out of curiousity, and because we've been discussing ways to tighten up our budget and save some money lately. I noticed two charges on my g/f's phone that seemed out of place - insurance for $7/month, and some download subscription for $4/month. The insurance has been getting paid, without being noticed, since she got the phone three or four years ago (and those payments have now exceeded the price of her phone, twice over). The download charge started LAST MAY, six months ago. And we're only JUST noticing it now.


Certainly. I've had a similar situation happen to me. But when you're hacking large numbers of people, some of them quite possibly will notice something funny. Even if only 1% of people pay attention to their spending habits, that's still 1 person out of 100 that'll notice, which may (or may not) invite the banks to investigate for similar behaviors.

If we're talking anecdotes, what about those people who get hacked, and are on a really tight budget? Suddenly they're getting overdraft notices for no reasons, because that $5 charge sent them over the edge. Or their rent check bounced because they had less money than they expected.

All I'm saying, is that if you're hacking one or a handful of people for petty larceny, fine. Large scale? Odds become good that it gets noticed quickly by someone.

QUOTE (_Pax._ @ Nov 19 2012, 01:26 PM) *
That's why you (a) use a disguise, (b) pick a VERY busy place, © never go back to fetch the commlink, (d) set the commlink to delay the onset of it's hack attempts for 1 or 2 hours (it can spend the intervening time scanning and analysing the surrounding nodes to pick out he ones that aren't mobile - and pu them on it's "don't bother" list), and (e) use the Palming skill to surreptitiously Gecko-tape the commlink to the underside of something.

As for the modus operandi, that's why I said you never repeat the same scam in the same location less than three months apart. Preferably less often than that.


The "deployed commlink auto-hacking and stealing from people around it" bit has numerous problems, off the top of my head. From what happens when it fails a hack-on-the-fly (which will happen), to being detected, to being too-sophisticated for all but the most high-end agents (making it not cost effective), etc. IMO.

QUOTE (_Pax._ @ Nov 19 2012, 01:26 PM) *
Even if the system works that way, you know what happens? Your self-replicating Agent program is under orders: "Sit back and watch. When transactions are made, RECORD THE SECRET PASSCODE. Then and only then, send 5¥ to ____, and upon confirmation of the transaction, delete EVERYTHING from the commlink.... including yourself, last of all." And with Admin access to the commlink, even an encrypted subscription doesn't matter. The Agent would have the decryption keys.


The main point I am trying to make, is that the banks will have had quite a bit of time to come up with ways to combat simple fraud/theft such as this. If this sort of hack is possible, confidence in the banking industry would be pretty shot. Any wiz wanna-be street hacker likely would try their hand at stealing from the patrons of the nearest Stuffer Shack.

What if it's not just a passcode, but current biometrics, and a rotating "Secret Question" style sheet. Maybe it asks what the last transaction was, where you were the last time you made a transaction (or other meta-type questions). There's a bajillion potential verification methods the banks could use to prevent this sort of fraud.

Can they prevent a dedicated hacker from doing a one-off? No. Can they limit mass theft scenarios? Hopefully.
ShadowDragon8685
QUOTE (Eratosthenes @ Nov 19 2012, 12:54 PM) *
An example transaction from Bob to Sally, for $5:

1) Bob tells his commlink to transfer $5 to Sally's commlink.
2) Bob's commlink notifies Sally's commlink that a transfer shall take place. It gives her his banking information, and receives her banking information. Effectively a banking handshake.
3) Bob's commlink notifies his bank (hereforth known as Bank) to transfer funds to Sally's banking information (hereforth known as Recipient).
4) Bank sends a verification ping to Bob's commlink, for a verification passcode, biometric scan, (perhaps parental consent sent to a guardian's 'link), whatever, via encrypted subscription (basic encryption software baked into the banking software the commlink comes with).
5) Upon verification, Bank releases the funds to the Recipient, and logs the transaction.

The handshake, and verification, are nigh instantaneous. So you can easily have it apply to any and all transactions. The only reason we forgo needing a signature for credit card purchases for amounts less than $20 today is because it's a hassle for the merchant (cost/benefit/risk analysis). Given the ease of obtaining verification there's no reason to not do it for every transaction. Can the verification be spoofed? Sure. But you're spoofing the bank's system, not the more vulnerable commlink.


Stop. Right there. There's your problem.

Bob is busy. Bob is busy doing Bob Stuff; Bob Stuff like trying to get that slice of authentic pizza with actual meat of pig on it - his weekly treat to himself - before the last slice is bought up by some wanker named Geoff, or Bob Stuff like paying Sally the 5 nuyen.gif she wants to give him a quick footjob under the table while they eat their lunch, or Bob Stuff like quickly buying a neat new gun pack in Miracle Shooter, or Bob Stuff like paying off his bar tab before his thumbs get broken or whatever.

Notice what is distinctly not part of Bob Stuff?

Going to the hassle of putting his thumbprint on some biometric scanner (which does not come with his commlink; the bank will have charged him for that, of course,) or racking his brain to figure out some bullshit trivia about the last time he did something, or trying to remember what answers he put down as his security answers back when the bank asked them, and then trying to remember the exact wording and spelling he used.

That is not Bob Stuff. That is bullshit that gets in the way of Bob Stuff, and 99.9% of the time, Bob is going to be annoyed to enraged by the delay. Bob is not going to think "Oh hey, it's taking me an extra ten or twenty or thirty seconds to authorize this transaction before I can my 5 nuyen.gif slice of meat-of-pig pizza for my protection," he's thinking "Arrrrrgh stupid bank, hurry up, hurry up hurry up, I want that pizza! It's mine! There, I've just - NO! Why'd you sell it to that guy? NO NO NO!"


The fundamental reality of commercial transactions is that the consumer does not want to be bothered with this security nonsense, because he authorized the transaction, not anyone else, and he doesn't want to go to some two-step bullshit.

He just wants his goddamn pizza, his under-the-table footjob, his motherfucking gun pack, and his bar tab paid off, and he wants them now. Not thirty seconds after now, not twenty seconds or even ten seconds after now. He wants it now now.
Tymeaus Jalynsfein
So Bob should not complain when he is compromised. Others of us actaully care about such things and take precautions. Do you keep the Same Login and Password on your Computer for every place you log into? Do you change them? If you don't take security seriously, you have no one to blame but yourself. It is really not all that difficult to do.

Yes, Most compromised Data leaks are because of people who don't care about such things. Granted. That does not mean that in a society 60 years in the future they will still act that way. Especially when all it takes is to thumb print authenticate a transaction. Hell, that takes lesss time than actually providing a signature. *shrug*

In the end, it all comes down to the type of game you want to run/play. If you want such transactions to be easily compromised, then they are. If you want to make them very difficult, it is not all that hard either. By the conceit of the game, such things are difficult, otherwise the banking system would fail completely. *shrug*
Draco18s
QUOTE (Tymeaus Jalynsfein @ Nov 19 2012, 03:56 PM) *
Yes, Most compromised Data leaks are because of people who don't care about such things. Granted. That does not mean that in a society 60 years in the future they will still act that way.


Yeah they will.

And it won't entirely be the Joe Shmoe pushing for it.

Do you know the very core of why economics works? The very essence of why we do things for other people in exchange for barter-able goods?
Eratosthenes
QUOTE (ShadowDragon8685 @ Nov 19 2012, 03:42 PM) *
That is not Bob Stuff. That is bullshit that gets in the way of Bob Stuff, and 99.9% of the time, Bob is going to be annoyed to enraged by the delay. Bob is not going to think "Oh hey, it's taking me an extra ten or twenty or thirty seconds to authorize this transaction before I can my 5 nuyen.gif slice of meat-of-pig pizza for my protection," he's thinking "Arrrrrgh stupid bank, hurry up, hurry up hurry up, I want that pizza! It's mine! There, I've just - NO! Why'd you sell it to that guy? NO NO NO!"

The fundamental reality of commercial transactions is that the consumer does not want to be bothered with this security nonsense, because he authorized the transaction, not anyone else, and he doesn't want to go to some two-step bullshit.

He just wants his goddamn pizza, his under-the-table footjob, his motherfucking gun pack, and his bar tab paid off, and he wants them now. Not thirty seconds after now, not twenty seconds or even ten seconds after now. He wants it now now.


You're envisioning it incorrectly. Or at least differently than I do. Same thing. biggrin.gif

Bob, through whatever interface (likely an AR display through his image link) selects what he wants to buy (via commlink controls, AR gloves and physically choosing from the display, or DNI and thinking at it). Immediately - not 5 seconds, not 10 seconds, immediately - a confirmation dialog box pops up, and he says yes.

To Bob, nothing more than a quick popup appeared. If that.

Behind the scenes, whatever peripherals he's running may do a biometrics check (why thumbprint when his image link could do a retinal scan? Or his skinlink can verify his skin voltaics, or whatever else you think they might want to use). He's running DNI? Heck, even better - check his brain wave pattern to ensure he wanted the transaction itself.

Or maybe that immediate popup has a question about Bob's favorite band, the Gynogobbos of Gynormia. His security question has become a trivia game for him.

Whatever.

In the end, as Tymeaus said, if you want it easy, make it easy. If you want it hard, make it hard. It's all conjecture at the moment. I'd go for harder myself since it prevents the hackers from just being ATMs.
Draco18s
QUOTE (Eratosthenes @ Nov 19 2012, 04:31 PM) *
Bob, through whatever interface (likely an AR display through his image link) selects what he wants to buy (via commlink controls, AR gloves and physically choosing from the display, or DNI and thinking at it). Immediately - not 5 seconds, not 10 seconds, immediately - a confirmation dialog box pops up, and he says yes.


Have you told your browser to cache log-in information for various websites? Told said sites to "always remember me"?

If you answered yes, think about why you've done that, and how awesome the security of your browser is and how easy it would be for someone who had complete control of your computer to completely ruin your (online) life.

If you answered no, then I suspect that you're lying.
_Pax._
QUOTE (almost normal @ Nov 19 2012, 12:53 PM) *
And there'd be a log of that particular access ID being the last thing in the node before everything crashed. Quick way to get caught.

Great. A log of an AccessID that can't be traced anywhere except to an abandoned, black-market commlink.

And, here's teh catch: it would only hold the log of that AccessID deleting itself. BEcause "Everything" includes the Access Log.

(... or if you want to get extra-fancy, you load the Agent with Corrupt, and have it CORRUPT everything, then delete itself - keep in mind, Corrupt can be attached to a file the same was Data Bomb can be, so it can go off after the Agent has been deleted.)





QUOTE (Eratosthenes @ Nov 19 2012, 12:54 PM) *
Hrm, I disagree (though that does not preclude me from being wrong).

Here's something to keep in mind, from SR4A p331:

Credit Account: A credit account is an online banking account
that can be accessed at any time via your commlink. Transactions require
verification such as a passcode, a correct originating access ID
(p. 225), and/or biometric authorization. All transactions are ender


Note that one of the possibilities is to require just that the transaction come from the correct AccessID. You know, like the customer's commlink.

Also note, most commlinks are not equipped to provide biometric scan data. Which kind of puts the kibosh on "always" for that sort of thing, right there.

QUOTE
An example transaction from Bob to Sally, for $5:

1) Bob tells his commlink to transfer $5 to Sally's commlink.
2) Bob's commlink notifies Sally's commlink that a transfer shall take place. It gives her his banking information, and receives her banking information. Effectively a banking handshake.
3) Bob's commlink notifies his bank (hereforth known as Bank) to transfer funds to Sally's banking information (hereforth known as Recipient).
4) Bank sends a verification ping to Bob's commlink, for a verification passcode, biometric scan, (perhaps parental consent sent to a guardian's 'link), whatever, via encrypted subscription (basic encryption software baked into the banking software the commlink comes with).

4A) Hacker spoofs propr response. You can encrypt it as strongly as you like - you can pop full-blown MilSpec R9999 encryption on it if you like. Since the commlink itself must be able to understand the message, IT HAS THE DECRYPTION KEY ... and thus, so does any hacker who has successfully obtained Administrative access.

QUOTE
The handshake, and verification, are nigh instantaneous.

Not if you require data entry by the customer - passcode, biometric scan, etc.

QUOTE
The only reason we forgo needing a signature for credit card purchases for amounts less than $20 today is because it's a hassle for the merchant (cost/benefit/risk analysis).

Um, yes, exactly.

QUOTE
Given the ease of obtaining verification there's no reason to not do it for every transaction. Can the verification be spoofed? Sure. But you're spoofing the bank's system, not the more vulnerable commlink.

Actually, since you "have" the commlink, the odds are very good that there's no spoofing needed. Because 5¥ is almost certainly at a level where the only verifying data needed or asked-for is "has this request come from a device bearing an authorised AccessID?" (See above rules reference.)

Which, given the nature of the hack, it has.

QUOTE
Certainly. I've had a similar situation happen to me. But when you're hacking large numbers of people, some of them quite possibly will notice something funny. Even if only 1% of people pay attention to their spending habits, that's still 1 person out of 100 that'll notice, which may (or may not) invite the banks to investigate for similar behaviors.

Great. At the 14K¥ level, and 5¥ per person, we've hacked ~2800 people. Call it 30 folks who notice "by the end of the day".

First question: how many different banks do those thirty people do business with? (Keep in mind, each Megacorp probably operates a bank or "credit union" for it's employees, and participation in it may be mandatory; even AAs probably do this.)

Second question: how many of those thirty immediately make a fraud report? And how many instead say "that's weird, I'll have to watch and see if it happens again?"

Third question: given the above, and given a habit of running this scam at most every ten days (preferably every fifteen), in different locations and possibly different cities or even different nations (there's four within reasonable travel distance of Seattle, after all) .... and in light of the destination account changing every time you run the scam, too ... how long will it be before even ONE bank pegs to a pattern at all? And then how long before they share that information with their nominal competitors?

Fourth and final question: how long do you think those Food Courts etc are keeping uneventful video recordings around?

...

Time is the insulating factor here. By the time "the authorities" even realise something has happened, the something is already at least 1 month, and probably 3 months, old. The trail is cold and dead. Impossible to follow, no. Easy (and importantly, inexpensive) ...? Also no.

QUOTE
If we're talking anecdotes, what about those people who get hacked, and are on a really tight budget? Suddenly they're getting overdraft notices for no reasons, because that $5 charge sent them over the edge. Or their rent check bounced because they had less money than they expected.

Actually, overdrafts are extremely rare in Shadowrun. The rules state that almost all banking transactions are conducted "in real time".

Also, you could simply script the Agent to check someone's balance, and not transfer anything if less than X number of nuyen are there.

QUOTE
All I'm saying, is that if you're hacking one or a handful of people for petty larceny, fine. Large scale? Odds become good that it gets noticed quickly by someone.

And I'm saying, "quickly" for the institutions in question tends to mean "in less than half a year". Especially where each theft is five measley nuyen. Each incident is "small beans"; the authorities won't mobilise until a pattern is detected, and that will take significant time.



QUOTE
The "deployed commlink auto-hacking and stealing from people around it" bit has numerous problems, off the top of my head. From what happens when it fails a hack-on-the-fly (which will happen), to being detected, to being too-sophisticated for all but the most high-end agents (making it not cost effective), etc. IMO.

Let's say Joe Wageslave is running a Sony Emperor with Renraku Ichi, and a Basic User Suite. That gives him Firewall 2 and Analyze 2. Let's also assume that Joe isn't a total chump, and he didn't disable Analyze. So, great, his 'link is getting 4 dice to detect hack-on-the-fly attempts.

The link I posted upthread? Stats of 3. Stealth 5 (optimised +2), Exploit 5 (optilised +2); it's getting 8 dice against a threshold (for an Admin account) of 8; meanwhile, the target link has a threshold of 8 to detect the attempt. (Possibly more if there are appropriate autosofts.)

Which link do you think will reach that threshold first - the one with 4 dice, or the one with 8? I dunno about you, but my money's on the 8 die pool. Yes, it may fail occasionally - but not vry often, and even then, the physical link won't be easy to find. And WORST case, we're out the cost of the link, period - which we already wanted to treat as disposable already.

As for the whole high-end Agent thing? It's all Warez. Buy it once, then make as many copies as you like.
_Pax._
(stupid limit to post lengths ...)



QUOTE (Eratosthenes @ Nov 19 2012, 03:31 PM) *
You're envisioning it incorrectly. Or at least differently than I do. Same thing. biggrin.gif

Bob, through whatever interface (likely an AR display through his image link) selects what he wants to buy (via commlink controls, AR gloves and physically choosing from the display, or DNI and thinking at it). Immediately - not 5 seconds, not 10 seconds, immediately - a confirmation dialog box pops up, and he says yes.

To Bob, nothing more than a quick popup appeared. If that.

And with that self-replicating Agent sitting in Bob's commlink ... he doesn't even get THAT, because the Agent intercepts it.

Oh, and does the "click yes to authorise" thing, too.

Because if it's literally instant, and takes less than 5 seconds? It's not typing out an answer to a Secret Question. Nor is it providing biometric data (which Bob's commlink is physically incapable fo doing, anyway). It's just clikcing "YES, I authorise this payement".

Which the Agent does. Poof, payment authorised, money transferred,and Bob is none the wiser.

QUOTE
Behind the scenes, whatever peripherals he's running may do a biometrics check (why thumbprint when his image link could do a retinal scan? Or his skinlink can verify his skin voltaics, or whatever else you think they might want to use). He's running DNI? Heck, even better - check his brain wave pattern to ensure he wanted the transaction itself.

A biometric scanner is not standard equipment for a commlink. Each one costs 200¥, and no, the normal cameras on a commlink aren't capable of taking a retina scan. Yes, that includes Facial Recognition, too

Figure that your typical Wageslave is going to be running with a CMT Clip (300¥), Sony Emperor (700¥), or at best a Renraku Sensei (1,000¥) .... and paying 200, 400, or 600 for one or more biometric scanners is not Bob Stuff, to borrow the phrase.

QUOTE
Or maybe that immediate popup has a question about Bob's favorite band, the Gynogobbos of Gynormia.

And starts taking time, because answering that question is going to be non-instantaneous. Bob starts getting annoyed again ...

QUOTE
In the end, as Tymeaus said, if you want it easy, make it easy. If you want it hard, make it hard. It's all conjecture at the moment. I'd go for harder myself since it prevents the hackers from just being ATMs.






QUOTE (Draco18s @ Nov 19 2012, 03:46 PM) *
Have you told your browser to cache log-in information for various websites? Told said sites to "always remember me"?

This.

In fact, my bank prompts it's customers to do this - asking if they want to permanently authorise the computer they're using to log in. So if someone sat at my computer? They have access to all my banking accounts.

Which maps pretty well onto SR4's "authorised AccessID" thing, when you think about it.
Draco18s
QUOTE (_Pax._ @ Nov 19 2012, 05:53 PM) *
In fact, my bank prompts it's customers to do this - asking if they want to permanently authorise the computer they're using to log in. So if someone sat at my computer? They have access to all my banking accounts.

Which maps pretty well onto SR4's "authorised AccessID" thing, when you think about it.


My old bank wouldn't let me, and I was annoyed every time I had to log in; Firefox simply didn't recognize the user/pass fields as being a login. But I recognize why they made that choice (so my computer could be compromised, but it wouldn't compromise my bank account).

My new bank?

Still no idea what my login info is. They send me an email with a PDF attachment that opens up some kind of secure thingy with a user and pass field that I have no idea what goes into them.
almost normal
QUOTE (_Pax._ @ Nov 19 2012, 04:52 PM) *
Great. A log of an AccessID that can't be traced anywhere except to an abandoned, black-market commlink.

And, here's teh catch: it would only hold the log of that AccessID deleting itself. BEcause "Everything" includes the Access Log.


The node would show the Access ID of the agent leaving, and that's it.

It could possibly show more. Access Logs tend to be encrypted, even if nothing else is. Honeypots can and do easily fool agents.

Granted, when traced it will only trace back to the abandoned commlink... and every other agent that commlink sent out.
_Pax._
.... oh, and I also use LastPass to remember all of my passwords, and even generate them in the first place. I can use really, really STRONG passwords, and not have to try and remember twenty different strings of gibberish. But again, if anyone ever got onto my actual computer? Doomed.
Sengir
QUOTE (_Pax._ @ Nov 19 2012, 10:52 PM) *
4A) Hacker spoofs propr response. You can encrypt it as strongly as you like - you can pop full-blown MilSpec R9999 encryption on it if you like. Since the commlink itself must be able to understand the message, IT HAS THE DECRYPTION KEY ... and thus, so does any hacker who has successfully obtained Administrative access.

Exactly.
If an intruder has managed to get root (admin in SR terms) access all data stored on that machine and every action performed with it could have been read, manipulated, or even completely forged.
Tymeaus Jalynsfein
QUOTE (Draco18s @ Nov 19 2012, 01:46 PM) *
Have you told your browser to cache log-in information for various websites? Told said sites to "always remember me"?

If you answered yes, think about why you've done that, and how awesome the security of your browser is and how easy it would be for someone who had complete control of your computer to completely ruin your (online) life.

If you answered no, then I suspect that you're lying.


Suspect all you want. I do not Cache Login Information to any sites that may require of me any PII that confirms my identity (Especiall;y Banking Sites). I manually log in each and every time. smile.gif

For entertainment sites (Like Dumpshock) I might have them remember me, but there is nothing intrinsically PII about that as long as I keep an eye on what information I put in the profile. *shrug*
_Pax._
QUOTE (almost normal @ Nov 19 2012, 05:25 PM) *
The node would show the Access ID of the agent leaving, and that's it.

Actually, the Agent never leaves. It deletes itself. Erased. Gone. Vanished into the electronic nether.

QUOTE
It could possibly show more. Access Logs tend to be encrypted, even if nothing else is.

So "get fancy" and use Corrupt. corrupt doesn't give a toot if the file is encrypted. It just messes the file up while preserving it's checksums or whatever.

QUOTE
Granted, when traced it will only trace back to the abandoned commlink... and every other agent that commlink sent out.

... no, because the hack-and-inject Agent is constantly erasing it's own commlink's AccessLog. smile.gif Which makes the throw-away link a complete dead end.

Extra-EXTRA fancy measures could include a micro explosive charge - just enough to render the internals of the commlink into irreparable scrap - and set it up to go "pop" if the commlink moves more than two, maybe three meters. Teeny pop noise, wee puff of smoke, and ... so much for any of THAT evidence, hey? smile.gif
almost normal
QUOTE (_Pax._ @ Nov 19 2012, 10:20 PM) *
Actually, the Agent never leaves. It deletes itself. Erased. Gone. Vanished into the electronic nether.


Maybe. Maybe it starts to delete itself and then bugs out. Depends on the GM.


QUOTE
corrupt doesn't give a toot if the file is encrypted.


Yes it does. Pg 112 of unwired.

QUOTE
The gamemaster
may also modify the dice pool or threshold to account for addition
factors, like encryption and protection of data.


Given that access logs are going to be the most protected thing on most nodes, I'm guessing the agent can't handle the job. If you've got a high enough rating agent anyway (Where are you getting all this nuyen from?) then you're compounding the problem of the next point.

QUOTE
the hack-and-inject Agent is constantly erasing it's own commlink's AccessLog. smile.gif Which makes the throw-away link a complete dead end.


It's not so much the commlink that's the problem as the Access ID. The threshhold to change a copy of an agent's AID is measured in weeks, and goes off the rating of the agent in question. This isn't something you can just spray around town with a few hundred agents and hope for the best. That means the plan to steal 5 nuyen is out the window. Let's break it down.

Option 1: You individually code 500 agents AIDs. Assuming you get your GM drunk, you manage to convince him that Rating 2 agents will get the job done, and somehow in 500 rolls, never crit glitch, glitch, or fail a threshold of 6 on Software+Logic. In 9 years and change, you can successfully steal a few thousand nuyen a 'cycle.' As time goes by, you find yourself unable to create more AIDs then are lost to firewalls and white hats. Your 9 and change years of work nets you 30 grand.

Option 2 : You let all the copies use the same Access ID. A few successful hits later, you've got 30 nuyen in an anonymous account that you're slightly afraid to touch, and every OS releases a quick patch to block the agent's AID from accessing any commlink. Repeat until caught.
_Pax._
QUOTE (almost normal @ Nov 19 2012, 11:03 PM) *
Maybe. Maybe it starts to delete itself and then bugs out. Depends on the GM.

I believe you meant to say "depends on teh rules and the dice, unless the GM has valid story-based reasons to decree otherwise".

Becuase a GM who decides "X fails" for no other reason than to dick with a player? Is a GM that sucks.

QUOTE
Yes it does. Pg 112 of unwired.

Okay, teh die pool might be modified. But then, we both forgot: with root access, there's no such THING as "encrypted" anymore, not for a file the commlink itself has to be able to access - like, to write anything into an access log. You root the 'link, and you have all the keys to the kingdom.

QUOTE
Given that access logs are going to be the most protected thing on most nodes, I'm guessing the agent can't handle the job.

Protected by what, exactly? Encryption? Admin access, decryption key in hand. Data Bomb? Likewise.

If the commlink has to access it, then the comlink has to be ABLE to access it. And if you have root access, you chave everything the commlink has.

QUOTE
If you've got a high enough rating agent anyway (Where are you getting all this nuyen from?) then you're compounding the problem of the next point.

Pfff. Rating 3, cracked and self-replicating. Buy it once and use it over, and over, and over.

QUOTE
It's not so much the commlink that's the problem as the Access ID. The threshhold to change a copy of an agent's AID is measured in weeks, and goes off the rating of the agent in question. This isn't something you can just spray around town with a few hundred agents and hope for the best. That means the plan to steal 5 nuyen is out the window. Let's break it down.

It's a black-market program bought with a throw-away R1 Fake SIN. The Agent's AccessID is a dead end, too.

And, you don't need to create a new AccessID every time you copy an Agent. The rules don't even hint at suggesting such a thing - indeed, they say the exact opposite (Unwired p114, "Replicate" program option).

One Pilot 3 (Cascading 3, Exploit 3) to create the account; one Pilot 3 (Replicate 3, Corrupt 3, Command 3) that copies itself over, and does the actual stealing of money. Stealth 5 (optimised +2, ergonomic), and Analyse 5 (optimised +2, ergonomic) running on the 3-3-3-6 commlink. None of it Copy Protected - including the Firewall program.

The self-copier rolls 6 dice, against a threshold of 12 with an interval of 1 combat turn. Statistically, if should finish in 6 combat turns - 18 seconds. That's it, done deal, next commlink.

Oh, and while I'm thinking of it ... the money-grabber Agent? Picks a random time, sometimw between "now" and "1h59m59s from now" to actually conduct it's single transaction, corrupt the AccessLog, and delete itself.

QUOTE
Option 2 : You let all the copies use the same Access ID. A few successful hits later, you've got 30 nuyen in an anonymous account that you're slightly afraid to touch, and every OS releases a quick patch to block the agent's AID from accessing any commlink. Repeat until caught.

Pfff, afraid to touch? It's a black-market, numbered,no-SIN-attached-to-it account obtained through Pusan Undernet. It's scheduled to transfer every single nuyen into a one-time credit account, also from Pusan Undernet, precisely 13h22m51s after it was created, without any additional external input. One hour after that, the entire balance of that account will be emptied into a credstick, and delivered to the local Yak or Mafia money-launderer - whereupon, the one-time account ceases to exist, vanishign with no record of ever having been at all.

Once you get your half back from the launderer, all that money is as good as untraceable.

...


And if you wish to suggest that at any point in time, one of those steps "cannot work" ...? The entire game and it's premise crashes down around our ears. Shadowrunning relies on the ability to (a) mask your datatrail, and (b) move money untraceably. If either or both cease to be true ... Shadowrun ceases to work. At all.
almost normal
I feel like you missed the self deletion point. You can't have a computer program delete everything. At some point, you start deleting the algorithms that hold everything together, at which point all further commands fail.

I'll respond to the other points in the morning.
_Pax._
Um, duh: the Agent doesn't actually do teh deleting. It directs the Commlink to do so. Of course.
almost normal
And? The issue remains.
_Pax._
QUOTE (almost normal @ Nov 20 2012, 02:13 AM) *
And? The issue remains.

No, it doesn't.

The Agent directs the processor of the commlink to conduct an operation (delete the Agent's program and payload from memory). The processor does so. The agent does not need to remain intact during this process.

Want proof of that?

Make a new folder on your desktop. Copy a couple dozen gigabytes of small files - pictures, PDFs, whatever- into it. Close the folder. Right-click, select "delete", then immediately stand up and LEAVE THE ROOM.

If the delete operation does not fail to proceed despite yoru not being theire to shepherd it through, then obviously, you weren't necessary to complete the operation.

Same for an Agent issuing a command to the Commlink.
Midas
As a GM I would rub my hands with glee the first time a player decided to try a mass hack in my gameworld. I would warn him of the dangers, but if he went ahead we could play it out. The problems he would face would probably include:

1) Commlink accounts are not so common
By telling me how ridiculously easy they are to hack, you are not exactly selling the concept to the joe-wageslaves in the gameworld.
Convenience, you say?
Sticking a credstick in a slot is safe, and the credstick itself is small and easy to carry. You can use certified cred if you don't want Mother Corp to know how much you are hanging out in bars or casinos, and buying a bottle of jack with the groceries on the way back to your cramped corp apartment with the nagging wife and the tearaway kids.
Swiping your corp ID card at affiliated corp malls gets the payment deducted from your next paycheck, and gets you loyalty points that you can save up for washing machines and a family holiday up into space. That would get them all off your back for a while at least, and the good thing about loyalty point vacations is that your boss can't deny you the vacation time.
In a busy place, I am sure you could find enough people making transactions with commlink accounts within your signal range to hack over time. The trouble is, that the higher the signal range the sooner you get detected, the lower the signal range the fewer accounts you can access, so given that many people are using credsticks, corp ID's and corp scrip to pay as well it will probably take hours rather than minutes to recoup your commlink and agent upfront costs, let alone make any money, especially given the increasing possibility over time of ...

2) Security
Having mass hacks take place at your mall or coffee shop is not good for business. Mall security or shops may do occasional random sweeps for commlinks in hidden mode. Someone with a commlink account may notice the hack quickly and report it to mall security/the cops. This might be because they gave account restrictions (notify me when I have gone over x amount/day, get bank to notify me of my account balance after each transaction has gone out).
There is no such thing as the untraceable hack crime, especially if it gets found before your commlink is due to self-destruct.

3) Wrong Customer
The problem with an agent hacking random commlinks is that it might inadvertantly pick the wrong pocket. High firewall commlinks might detect the hack attempt. Restricting your targets to customers who the agent can verify have Firewall 3 or less restricts your targets and increases your exposure time, as well as potentially pissing off nasty customers with low Firewall shell commlinks such as shadowrunners, mobsters and company men to name but a few.
Most of these people do not react well to being pick pocketed.

4) The fraud squad
If you were to beat the odds and make money this way on a regular basis, you would start to have either the corp or police fraud squad on you before long. The more you make, the more attention you get. Your motion bomb MO will link the crimes, and can be countered easily (by not moving the commlink). If you hang around to blow the device as soon as it is discovered, the chance of them finding you increases. Every step you take, they will learn from it and develop countermeasures. Every success makes them lay more honeytraps.

For all these above gameworld logic reasons, in my game you would be lucky to make the cost of your commlink and agent upfront costs, but if you did I wouldn't recommend it as a long term income source.

The game ecosystem reacts to whatever you do. You are taking money from somebody's hand, and they ain't necessarily gonna like it. If you steal cars and fence them with your high loyalty chop shop owner, he might not be able to take so much volume without raising eyebrows, steal from the wrong guy and he will track you down, a bent cop might come sniff you out for a cut etc. With ChemistryRun and TalismongerRun there are problems as well - I am not convinced how big the market size for higher margin products such as refined gold because most talismongers would make these in house, only outsourcing for lower margin refined products. You make foci, you will be unable to run for long periods of time per month and get tagged by your fixer as unreliable. You make high margin drugs, you are interrupting someone else's supply and are heading towards a 2070 style BreakingBadRun ... and will have costs and hassles associated with selling such product.

Rant over! biggrin.gif
DMiller
@Midas
I agree with most of your post, except #1. In SR4 the credstick is almost gone. Yes you can still get one and a few places (non-shadow markets) may actually accecpt a credstick if you happen to have one, but you will get a lot of odd looks for even pulling one out. In shadow and grey markets I'm sure the credstick is still used but a hacker would be a complete fool trying this process there for more than one reason.

-D

P.S.
I'm AFB at the moment, but I'm sure somene will find the print references about credsticks being dead (or almost dead).
SpellBinder
Number 3 made me think of The Big Hit right away.

And you want Unwired, page 11 for what you're looking for DMiller. Though what I find interesting is that credsticks are listed as having a Signal attribute (see page 204), which would suggest that a reader is absolutely unnecessary.

And do remember that in many feral cities they still use paper script, and electronic transfers are nearly impossible.
_Pax._
QUOTE (Midas @ Nov 20 2012, 03:28 AM) *
1) Commlink accounts are not so common

The rules and fluff both say the exact opposite.

QUOTE
2) Security
Having mass hacks take place at your mall or coffee shop is not good for business.

Which is why I suggested having the agent replicated onto each target commlink use a varuable up-to-one-hur delay between getting onto the commlink, and actually doing it's thing. Making it that much more difficult to figure out where the intrusion itself even happened in the first place.

QUOTE
Someone with a commlink account may notice the hack quickly and report it to mall security/the cops. This might be because they gave account restrictions (notify me when I have gone over x amount/day, get bank to notify me of my account balance after each transaction has gone out).

... those alerts can be, and if you plan it right would be, intercepted before ever getting to the person's attention, unless they're SO paranoid they have a second commlink. In which case, their first commlink's stats are probably higher than 2's, and the drop-link should never have attempted the hack in th first place.

QUOTE
3) Wrong Customer
The problem with an agent hacking random commlinks is that it might inadvertantly pick the wrong pocket. High firewall commlinks might detect the hack attempt. Restricting your targets to customers who the agent can verify have Firewall 3 or less restricts your targets and increases your exposure time, as well as potentially pissing off nasty customers with low Firewall shell commlinks such as shadowrunners, mobsters and company men to name but a few.
Most of these people do not react well to being pick pocketed.

So you tell the Pocket Hacker not to touch anything with a Firewall over 2. After all, determining that is just an Analyse roll or three away ...

Poof, problem solved.

QUOTE
4) The fraud squad
If you were to beat the odds and make money this way on a regular basis, you would start to have either the corp or police fraud squad on you before long. The more you make, the more attention you get. Your motion bomb MO will link the crimes, and can be countered easily (by not moving the commlink). If you hang around to blow the device as soon as it is discovered, the chance of them finding you increases. Every step you take, they will learn from it and develop countermeasures. Every success makes them lay more honeytraps.

The problem here is, you're thinking of this in terms of "one crime", and happening "at one place. One single heist for 15,000¥ in a single spot, yes, will draw attention,a nd quickly.

Three thousand separate 5¥ crimes, occurring over the space of some ten hours, at widely-separated locations (due to the up-to-one-hour delay), however? It will be a while - weeks or months at least - before any corps or police even realise there is a pattern ata ll, let alone suss out what that pattern is.

QUOTE
The game ecosystem reacts to whatever you do. You are taking money from somebody's hand, and they ain't necessarily gonna like it.

Joe Wageslave can't do much. And even if he could, he's not GOING to, over a mere 5¥.

And it will be a long, long time before anyone who can and WILL try to do something, even knows there's a reason to react. By which time most or all of the trails are months cold, and long dead - making tracking you down a serious "needle in teh haystack" scenario.

And consider, if you insist it'll happen faster and easier than that? Then it'll happen even faster and even easier, when the cause isn't "swindling a bunch of wageslaves for a half-cup of soycaf each", and is instead "broke into Secure Site 22 and stole a half-million-nuyen prototype ... which mysteriously turned up in the hand of our competitor, who then beat us to a five-billion-nuyen market with our own product, rebranded as theirs".

Even if you ran that scam twice a month for a year, that 300,000¥+ is small beans next to the 500,000¥ prototype and subsequent 2,000,000,000¥ loss of market share the actual shadowrun just cost some AAA megacorp.

So, you'll quickly run into this single, gigantic problem: all your runners will die horribly, mere days after their third serious run. Tops.

...

The answer to an idea like this is not "make it not able to happen", it's "take the player(s) aside and explain how it would negatively impact the game". Or if you ABSOLUTELY have to, bullsh*t your way through charging a higher percentage for laundering themoney, after he first run or two - and if word gets out in the shadows, slap the offenders with a point of Notoreity (and keep slapping those on 'em every so often, if they persist).

Because anything you do that makes the "mass skim" impossible, also makes shadowrunning impossible. BEcause every countermeasure to the skim, should happen double or triple for an actual shadowrun.
Midas
QUOTE (SpellBinder @ Nov 20 2012, 10:16 AM) *
Number 3 made me think of The Big Hit right away.

And you want Unwired, page 11 for what you're looking for DMiller. Though what I find interesting is that credsticks are listed as having a Signal attribute (see page 204), which would suggest that a reader is absolutely unnecessary.

And do remember that in many feral cities they still use paper script, and electronic transfers are nearly impossible.

I stand corrected, it seems I am still a little retro in my use of credsticks. Corp ID or corp scrip payments should still be relatively common, though.
Midas
QUOTE (_Pax._ @ Nov 20 2012, 10:39 AM) *
The rules and fluff both say the exact opposite.

I stand corrected, see above post.

QUOTE
Which is why I suggested having the agent replicated onto each target commlink use a varuable up-to-one-hur delay between getting onto the commlink, and actually doing it's thing. Making it that much more difficult to figure out where the intrusion itself even happened in the first place.

An agent staying unnoticed for an hour? Yeah, right.

QUOTE
So you tell the Pocket Hacker not to touch anything with a Firewall over 2. After all, determining that is just an Analyse roll or three away ...

Not sure how many Joe Wageslaves would have Firewalls of 2 or less.

QUOTE
The problem here is, you're thinking of this in terms of "one crime", and happening "at one place. One single heist for 15,000¥ in a single spot, yes, will draw attention,a nd quickly.

I thought the premise was a hidden pocket hacker.

QUOTE
And consider, if you insist it'll happen faster and easier than that? Then it'll happen even faster and even easier, when the cause isn't "swindling a bunch of wageslaves for a half-cup of soycaf each", and is instead "broke into Secure Site 22 and stole a half-million-nuyen prototype ... which mysteriously turned up in the hand of our competitor, who then beat us to a five-billion-nuyen market with our own product, rebranded as theirs".

Because anything you do that makes the "mass skim" impossible, also makes shadowrunning impossible. BEcause every countermeasure to the skim, should happen double or triple for an actual shadowrun.

Not so. If the runners do their job and make a clean getaway, the corp won't spend hours tracking them down because they will know the handover will have taken place by the time they do so. This is a strawman that is clearly against the fluff, because yes, if the PCs don't use a tag eraser or faraday cage and can be tracked in real time the corp may do that.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Dumpshock Forums © 2001-2012