HACKING 101 Hacking a Node

One of the most common things that a hacker will need to do is hack into a node, to allow them access to the files or control over the devices they need. What follows is a quick guide to how to do just that

Before Hacking:
Before you hack into the node, there are a few things you might want/need to do 1. Spoof your Commlink ID: Its a good idea to change your commlinks access ID, to make it harder for people to follow your datatrail. This can be done using a Hacking + Software (2) Test (the spoofed ID will last until you reboot your commlink) or using a Hardware + Logic (2) Test (the spoofed ID will last until you change it again). Detect Hidden Node (Complex Action): If the Node you want to hack is in Hidden mode, find it using an Electronic Warfare + Scan Extended Test . The threshold is (4, complex action) if you know roughly where the node should be (e.g. Mr Johnsons commlink). If you're doing a general scan for all hidden nodes within signal range the threshold is (15, combat turn).

2.

Hacking a Node - Step by Step:

Now that youre ready, follow these steps in order to hack into the node of your choice 1. Analyze Node (Simple Action): Check the Node out before hacking with a Computer + Analyze Test. Each hit gives you a piece of information about the node, such as: System/Firewall/Response rating of node Whether the node is encrypted Current Alert status of the node Whether the node has a Data Bomb (for info on Data Bombs see SR4A p. 233) Hack (Complex Action): There are two ways to hack yourself access to a node: Slow Probe: You take time to probe the system you want to hack, looking for weaknesses: In VR: Hacking + Exploit (Firewall + System + level of access modifier*, 1 hour) Extended Test. In AR: Hacking + Exploit (Firewall + System + level of access modifier*, 1 day) Extended Test. The node gets one Analyze + Firewall (Your Stealth Rating) test once you login to try and spot you. Hacking on the Fly: You hack in as quickly as you can, on the spot: Hacking + Exploit (Firewall + level of access modifier*, complex action) Extended Test. The node gets an Analyze + Firewall (Your Stealth Rating, Complex Action) Extended Test to spot you. It rolls every time you roll. Analyze Node (Simple Action): Once youre in, you may want to check a few more details about the node with a Computer + Analyze Test. Each hit gives you a piece of information, such as: Number of icons (IC, other users, Agents etc.) subscribed to the node Gateways to other nodes within this node. Programs currently running on the node Data Search (Complex Action): To find the icon you plan on interacting with, youll need to use Data Search + Browse (Threshold set by GM). Note: programs other than Browse may be used in some cases - see SR4A p. 230. Analyze Icon (Simple Action): Once youve found your icon, you may want to use Computer + Analyze to check if its encrypted or if it has a Data Bomb on it. Each hit will give you one piece of information regarding the icon. Initiate Cryptanalysis (Complex Action): If the icon is encrypted, you can decrypt it with an Electronic Warfare + Decrypt (Encryption Rating of file x 2, Combat Turn) Extended Test. This takes one Complex Action by the hacker to get started, after which the Decrypt program takes over until decryption is completed. Having found the icon you want, do whatever you came here to do steal the file, take control of the cameras, open the lock, edit the data etc. etc. Edit (Complex Action): If you have time, you might want to hide the evidence of your tampering with a Computer + Edit Test (Threshold set by GM) to modify the logs. Now youre all done you can Log Off (Simple Action) and Jack Out (Free Action). No test required providing you havent been hit by Black IC.

2.

3.

4. 5. 6.

7. 8. 9.

Dont forget: if youre running in Hot Sim VR, you get+2 dice to all Matrix actions. * Level of Access Modifiers: User: Standard threshold (nodes Firewall) Security: +3 to threshold Admin: +6 to threshold
Hackers Skills highlighted in yellow, Programs in green, Attributes in red, Commlink stats in pink. Node/Agent/IC/NPC Ratings and Programs in blue.

HACKING 101
An Example Skills, Programs and Stats used listed in red.
Twitch - Wannabe Hacker Skillz: Programs: Commlink: Computer: 3 Analyze: 2 Firewall: 3 Cybercombat: 2 Attack: 2 Response: 4 Data Search: 3 Browse: 3 Signal: 2 Hacking: 2 Edit: 3 System: 4 Exploit: 2 Spoof: 3 Stealth: 3 Local Stuffer Shack - The Node System Stats: Programs: IC: Firewall: 3 Analyze: 2 Rating: 3 Response: 4 Browse: 2 Attack: 3 Signal: 2 Edit: 2 System: 2 Command: 2

Twitch is low on funds, but really wants a slushie. He thinks hes a pretty wiz hacker, so decides to head to his local Stuffer Shack and use his commlink to hack the node, making the slushie machine give him a slushie for free. Twitch finds a quiet corner of the store, where hes pretty sure the security cameras and the really bored looking clerk cant see him, and gets to work. Switching on his AR glasses, Twitch accesses the shops node as a public user and finds himself confronted with the nauseating corporate sculpting of the node. All of the grubby shelves and walls are suddenly overlain with shiny neon colours and massive Stuffer Shack logos and a perma-grinning virtual clerk (nothing like the real thing - nowhere near surly or spotty enough) asks what he can do to help Twitch get stuffed today in cheery voice. This public level of access is no use for Twitch, so he decides to scope out the node before hacking in. He starts by analyzing the node. Twitchs player rolls 5 dice (his Computer skill of 3 + his Analyze program of 2) and gets 1 hit, gaining one bit of info about the node. The player decides that Twitch would want to know the Firewall rating of the node (which is 3). Satisfied that this node is within his hacking capabilities, Twitch starts hacking on the fly. He knows that even the bored looking store clerk is allowed to override the slushie machine, so hes pretty sure hell only need standard user access. Twitchs player rolls 4 dice (Hacking 2 + Exploit 2). His threshold is 3 (the nodes Firewall rating of 3 + 0 for standard User access) but he only gets 2 successes - hes not quite in yet. The node then has a chance to detect the intrusion and rolls 5 dice (Analyze 2 + Firewall 3) getting 1 success, not enough to beat Twitchs Stealth program of 3. Twitch wipes a bead of sweat from his brow, glances nervously about to make sure hes still not being watched and continues his attempt at hacking on the fly. In the second turn, Twitchs player rolls another 4 dice, getting another success. Added to the successes from last turn, this brings his total up to 3 - he has hacked himself a User account. But wait! The node gets another chance to spot the intruder and rolls another 5 dice. It gets 1 success again, bringing its total up to 2 - still not the 3 successes needed to see past Twitchs Stealth program. As far as the system is concerned, no hacking has taken place. Twitch licks his lips imagining the tasty free slushie that will be his at any moment. Hes now logged on as a User and ready to roll. What Twitch doesnt realise is that the grinning virtual clerk from earlier is actually an IC program, watching the employee access gateway to the node. It is Rating 3 and uses the systems Analyze program rating of 2 (rolling 5 dice in total) to check Twitchs credentials when he logs on as a User. This is an opposed test, vs. Twitchs Hacking 2 + Stealth 3. The IC rolls 2 successes, but Twitch rolls 3 - as far as the IC is concerned, Twitch is a valid user of the system. Twitch does a quick Data Search to find the controls for the slushie machine and hits the virtual override button to make it dispense a free slushie. Twitchs player rolls 6 dice (Data Search 3 + Browse 3) to find the slushie machine controls. The GM sets the threshold at 1, as the controls are easy to find - theyre virtually overlaid on the actual slushie machine in AR! - and the player easily gets enough successes. As hes feeling mean, the GM also makes Twitchs player roll to work the slushie machine override. Twitchs player rolls 5 dice (his own Computer skill of 3 + 2 for the rating of the Command program running on the node - Twitch can use this as he has a User account and he doesnt have a Command program of his own) and gets 3 successes. The GM set the threshold to use the override at 2, so this is enough. Twitch decides he doesnt want to leave any evidence of his illegal transaction behind, so he quickly edits the slushie machines logs, updating the log of the override that he just did to show as a normal refund for an unhappy customer. The GM sets the threshold for this at 2 as well. Twitchs player rolls 6 dice (Computer 3 + Edit 3) and gets 2 successes the log is updated. Twitch logs out of the node and casually saunters over to the slushie machine to pick up his prize. Unfortunately, a fault with the machine means that he has gotten blueberry instead of raspberry as hed wanted and that, children, is proof that crime doesnt pay!
Hackers Skills highlighted in yellow, Programs in green, Attributes in red, Commlink stats in pink. Node/Agent/IC/NPC Ratings and Programs in blue.

HACKING 101 Alerts and Cybercombat

or what happens when things go wrong The previous information assumes that no one spots the hackers illegal activities. So what happens when things dont go according to plan? There are two main ways that hackers can be detected

Getting Found Out:

1. 2. The intrusion could be spotted by the nodes Analyze + Firewall Test as the hacker is trying to gain access in the first place - this is much more likely if the hacker is Hacking on the Fly rather than performing a Slow Probe. The hacker could be spotted by another user/Agent/IC program after they have logged in illegally. A node might have Agent/IC programs scanning users of the node periodically or scanning all users that enter certain areas of the node. Alternatively, the node gets another chance to spot the hacker whenever they perform any unauthorised actions (i.e. try and do something that the level of access they are using shouldnt be able to do). Most commonly this would be when the hacker tries to perform further hacking actions - e.g. attacking another icon on the node or trying to use spoof on an icon they dont have the right level of access for. Note: detecting a hacker once they are logged on to a node is an Analyze + Firewall Opposed Test vs. the hackers Hacking + Stealth (not a passive test against the rating of the hackers Stealth program as it was when they hacked in originally).

Alerts:
If the node becomes aware that it has been hacked, it immediately goes on alert and gains a +4 Firewall bonus against the intruder that triggered the alert, making it harder for the intruder to finish hacking in or to perform other hacking actions against the Firewall rating. The node will also take action against the intruder, the most common actions being Trying to Terminate the hackers connection: This is an Opposed Test, with the node rolling Firewall + System (dont forget the +4) vs. the hackers Hacking + Exploit. Further situational modifiers include: o +1 to the node for each IC program running o + 2 to the hacker if he is using a Security account o + 4 to the hacker if he is using an Admin account Rebooting the entire system: This is a rare last resort action as it also affects all legitimate system users. Shutting down and rebooting requires the node to complete a System + Response (10, Combat Turn) Extended Test. Sending something to attack the intruder: The node may well scramble IC or a security hacker (AKA: Spider) to attack the intruder. The IC/Spider will need to locate the hacker first, with a Rating (for the IC) or Computer (for the Spider) + Analyze Opposed Test vs. the hackers Hacking + Stealth. Once the hacker is located, its time for

Cybercombat:
Combat in the matrix is much like combat in the meat world, and goes a little something like this 1. Determine Initiative: This depends on all matter of things Meat People in VR Cold Sim: Initiative = Response + Intuition. They get 2 passes. Hot Sim: Initiative = Response + Intuition + 1. They get 3 passes. Agents/IC/Sprites Initiative = icons Pilot/Rating + systems/sprites Response. They get 3 passes.

Meat People in AR Use normal physical Initiative and number of passes.

2.

Attack: You attack other icons using an offensive program such as Attack, Blackout or Black Hammer. Attacking is an Opposed Test. If the attacker gets more hits, they inflict damage. If the defender rolls more, or there is a draw, no damage is inflicted. The dice pools rolled depends on a number of factors Defender Meat People Response + Firewall Full Defence: + Hacking Agents/IC/Sprites Icons Firewall + systems/sprites Response Full Defence: + icons Rating

Attacker Meat People Agents/IC/Sprites Cybercombat + Offensive Rating + Offensive Program Program

3.

Damage and Damage Resistance: Matrix users have their own damage condition monitor (except for Technomancers, who use their normal monitor) with a number of boxes equal to 8 + (System 2, rounded up). If an attacker hits, the damage inflicted equals their offensive program rating + any net hits. The defending icon also gets a chance to resist some of the damage, with every hit preventing one box of damage. The dice the defender rolls to resist Matrix damage depends on the program being used to hit them

Hackers Skills highlighted in yellow, Programs in green, Attributes in red, Commlink stats in pink. Node/Agent/IC/NPC Ratings and Programs in blue.

HACKING 101
Attack Program Resist damage with System + Armor Notes: Attack will crash an icon and forcibly log out a meat user if an icons condition monitor is filled. Blackout / Black Hammer Program Resist Damage with Willpower + Biofeedback Filter Notes: These programs only work against meat users. They inflict real physical damage (Stun for Blackout, Physical for Black Hammer) and jam open the users connection if any hits are scored - defender needs to win a Willpower + Biofeedback Filter Opposed Test vs. the Black IC Rating + Response to jack out.

A Quick Note on Dumpshock: Users who are in VR and are forcibly logged out of the Matrix, due to a system reboot or losing cybercombat, will take physical dumpshock damage. The amount of damage taken is 5S for cold sim users and 5P for hot sim users. This is resisted using Willpower + Biofeedback Filter, with every hit reducing the damage by one. In addition, users are disoriented by dumpshock and suffer a -2 dice pool modifier to all actions for (10 - Willpower) minutes

Another Example Skills, Programs and Stats used listed in red.

Twitch - Wannabe Hacker Skillz: Programs: Commlink: Computer: 3 Analyze: 2 Firewall: 3 Cybercombat: 2 Attack: 2 Response: 4 Data Search: 3 Browse: 3 Signal: 2 Hacking: 2 Edit: 3 System: 4 Exploit: 2 Spoof: 3 Stealth: 3 Local Stuffer Shack - The Node System Stats: Programs: IC: Firewall: 3 Analyze: 2 Rating: 3 Response: 4 Browse: 2 Attack: 3 Signal: 2 Edit: 2 System: 2 Command: 2

Somewhere, in an alternate universe, things did not go so smoothly for poor old slushie lovin Twitch Twitch starts hacking on the fly. He knows that even the bored looking store clerk is allowed to override the slushie machine, so hes pretty sure hell only need standard user access. Twitchs player rolls 4 dice (Hacking 2 + Exploit 2). His threshold is 3 (the nodes Firewall rating of 3 + 0 for standard User access) but he only gets 2 successes - hes not quite in yet. The node has a chance to detect the intrusion and rolls 5 dice (Analyze 2 + Firewall 3) getting 2 successes, not enough to beat Twitchs Stealth program of 3, but close. Twitch doesnt realise, but hes riding a thin line. In the second turn, Twitchs player rolls another 4 dice, getting another success. Added to the successes from last turn, this brings his total up to 3 - he has hacked himself a User account. But wait! The node gets another chance to spot the intruder and rolls another 5 dice. It gets 2 successes this time, bringing its total up to 4 - this beats Twitchs Stealth program of 3 and the system goes on alert. Luckily, Twitch has already hacked an account, otherwise his threshold for success would have just risen to 7 (Firewall 3 + 4 due to the alert). Twitch licks his lips imagining the tasty free slushie that will be his at any moment (he doesnt know about the alert). Hes now logged on as a User and is just about ready to roll when he is approached in AR by the grinning virtual clerk again, except this time the grin is kinda angry looking and the clerk is menacingly brandishing a large kielbasa. After the alert is sounded, the node scrambles its IC to search out and attack the intruder. The IC heads to the area of the node where the intrusion has taken place and scans to find the intruders icon. The IC rolls Rating 3 + Analyze 2 and gets 3 successes. Twitchs player rolls Hacking 2 + Stealth 3 and only gets 2 successes - the IC has spotted Twitch! Twitch is glad he loaded his Attack program before he started hacking, because that kielbasa looks hefty! Twitchs icon pulls out a baseball bat studded with nails and he steps in to engage the angry looking virtual clerk. Twitchs initiative is pretty lousy - hes in AR and his meat bod is in pretty poor shape (probably all the slushies), so the IC attacks first. The ICs Initiative = 7 (ICs Rating 3 + nodes Response 4), before adding any successes from the Initiative roll. To attack, the IC rolls Rating 3 + Attack 3 and gets a massive 4 hits. Twitch rolls 7 dice to defend (Response 4 + Firewall 3) but only manages 2 successes - the IC has 2 net hits and has hit him hard. The IC is doing 5 damage (3 for the rating of the Attack program, plus another 2 for the net hits). Twitch has no Armor program (doh!) so he rolls 4 dice for his System rating to try and resist some of the damage, but gets 0 successes. Twitchs icon takes 5 boxes of damage and, as a result, Twitch will now roll -1 dice for all Matrix actions. Twitchs player knows that the IC will get three initiative passes per combat turn, whilst Twitch only gets one as hes in AR. It doesnt look good for Twitch winning this combat, so the player opts to jack out on his turn. With a swing of the giant sausage, the virtual clerk hits Twitchs icon square in the jaw, causing it to flicker and jump. Twitch realises hes brought too much heat down on himself and so quickly logs off from the node, jacks out and beats a hasty retreat from the Stuffer Shack. Looks like hell have to find a way to make some cash and buy that slushie fair and square and that, children, is proof that crime doesnt pay!
Hackers Skills highlighted in yellow, Programs in green, Attributes in red, Commlink stats in pink. Node/Agent/IC/NPC Ratings and Programs in blue.

HACKING 101 Spoofing

AKA: the quick and dirty way It is not always necessary to hack a node in order to achieve your goals as a hacker. In fact, if youre looking to control a peripheral device (like a camera or a door lock) it may be easier to spoof a command. This essentially means that you send the device a fake command, trying to fool it into thinking that your command actually came from an authorised user. Before you can spoof a command, you need to know the Access ID of a valid user. You can gain this by analyzing a users icon, or by tracing a user

Getting an Access ID:

Analyze Icon (Simple Action): Computer + Analyze Test. o If the user is running a Stealth program: this becomes an Opposed Test, with the user rolling Hacking (for a meat bod) or Firewall (for Agents etc.) + Stealth. Each (net) hit earns you a piece of information regarding the target, in this case you only need one success to learn their Access ID. Trace User (Complex Action): Computer + Track (10, Complex Action) Extended Test. Note that a Stealth program run by the target acts as a negative dice pool modifier. When you reach the threshold, you have traced the user, learning their access ID and (bonus) the physical location of their originating node (usually their commlink).

Once you have a valid Access ID, youre ready to spoof

Spoofing a Command:
Spoof Command (Complex Action): Hacking + Spoof Opposed Test vs. the targets Pilot/Sytem + Firewall. If you succeed, the target accepts the command as legitimate. Note that additional net hits do not provide additional commands - each new command requires a new Spoof Command attempt.

One Final Example

Twitch - Wannabe Hacker Skillz: Programs: Commlink: Computer: 3 Analyze: 2 Firewall: 3 Cybercombat: 2 Attack: 2 Response: 4 Data Search: 3 Browse: 3 Signal: 2 Hacking: 2 Edit: 3 System: 4 Exploit: 2 Spoof: 3 Stealth: 3 Local Stuffer Shack - The Node System Stats: Programs: IC: Firewall: 3 Analyze: 2 Rating: 3 Response: 4 Browse: 2 Attack: 3 Signal: 2 Edit: 2 System: 2 Command: 2

In yet another alternative universe, Twitch decides that he doesnt want to risk hacking the local Stuffer Shack node. Instead he decides hes going to fool the slushie machine into accepting an override command using his Spoof program. First, he needs an Access ID that the machine will recognise, so he switches on his AR glasses and looks over to the (real) store clerk. The clerks persona icon is a boring generic commlink icon, but with a neon red Stuffer Shack apron overlaid on it. Twitch scans the clerks icon to learn his Access ID. Twitchs player rolls 5 dice (Computer 3 + Analyze 2) and gets 2 successes. The clerk isnt running a Stealth program, so he doesnt get to oppose this at all. Twitchs player is entitled to 2 pieces of information (1 for each hit), but he only needs to know one thing - the clerks Access ID. Twitch stores the Access ID in his commlink memory (if this works, he might want to use the ID again after all) and turns to face the slushie machine. In AR, the machine is also garishly overlain with neon colouring and giant logos. Twitch uses his Spoof program to tell the machine to dispense a free slushie, trying to convince the dumb peripheral device that the order actually came from the store clerk. Twitchs player rolls 5 dice (Hacking 2 + Spoof 3) and gets 3 hits. The GM decides that the slushie machine has a Device Rating of 2, so Twitchs roll is opposed by the slushie machines System 2 and Firewall 2 (all stats match the Device Rating in this case). Unfortunately for Stuffer Shack, the machine only rolls 2 successes - Twitch has one net hit. Twitch grins almost as widely as the virtual clerk on the Stuffer Shack node - a free slushie awaits. Unfortunately, what Twitch doesnt realise is that slushies are full of a number of additives that are outlawed in most sane nations (not UCAS though - huzzah!). The slushies might taste good, but one of those additives is severely affecting Twitchs sperm count and that, children, is proof that crime doesnt pay!

Hackers Skills highlighted in yellow, Programs in green, Attributes in red, Commlink stats in pink. Node/Agent/IC/NPC Ratings and Programs in blue.