comStar Firewall alert - PhaseThrough

hacker’s handbook . . . . . . . . . . . . . . . . . . . . . . . . . .
98
without actually granting him an account. To create a hidden access
point, the hacker must have previous access to the system and
must make a Hacking + Exploit (Firewall + System, 1 minute)
Extended Test.
The advantage is that such hidden access points make it very
easy to penetrate the system, requiring only a simple Hacking +
Exploit (1) Test, and the Firewall gets no test to detect the intruder.
As no account is being used, access won’t be noticed as long
as the intruding hacker remains under the radar of patrolling IC.
Since no passcodes have been obtained, however, the hacker
has no account privileges at all and must rely on Hacking for all
tests as long as he is connected to the node in this manner (it is
common practice to access the system via the hidden access point
and then create an account, leave the system, and do a “legal” log
on with the fake account). IC or security hackers that perceive the
hacker will immediately recognize him as an intruder.
Note that the actions of a hacker who uses a hidden access
point are still recorded in the access log, but they are obscured
and confusing because they are not tied to an account. The
hacker’s datatrail may still be tracked, however.
detecting Backdoors
Users with security or admin privileges can
conduct account audits and security sweeps to
look for known or suspected backdoors. Of
course, hackers with security or admin access
to a node can conduct their own searches
and keep the results to themselves,
making use of the hard work of
their fellow hackers. Some technomancer
hackers have been
known to watermark their
backdoors (see p. 237, SR4),
so that other technomancer or
sprite hackers can find them.
Reusable Exploits and
Hacked Accounts: A spider or
hacker conducting a routine audit
will detect a reusable exploit or
unauthorized use of a legitimate
account on a successful Extended
Data Search + Browse (lowest
Stealth rating of hacker using
exploit or account, 1 day) Test;
the exploit may be immediately
fixed with a successful Extended
Software + Edit (Firewall, 1
minute) Test, while the legitimate
account is typically locked
pending an official review. If the
logs show the legitimate account
has not been engaging in any illegal
or questionable activity, the account
will be unlocked; otherwise the user
will face arrest and/or questioning.
Hacker-created
accounts subject to this
review are typically deleted
unless the hacker has taken care to have a good cover story and has
been editing the logs to hide her activities.
Hidden Accounts and Access Points: Hidden accounts and
access points do not show up on routine inspections by securitylevel
and admin users, but if a spider becomes aware of them
(either through a sloppy log edit or seeing the hacker use them),
a thorough account audit—a successful Extended Data Search +
Browse (lowest Stealth Rating of hacker using access point or account
x 2, 1 day) Test—will reveal them, after which they may be
edited or erased as normal.
Probing the Target: At the gamemaster’s discretion, a hacker
who is probing the target (p. 221, SR4) may discover a backdoor
rather than a flaw to exploit.
advanced Spoofing
The SR4 rulebook details several good uses for the Spoof
program: redirecting traces, spoofing the datatrail, and spoofing
commands to agents, drones, and sprites. A common misconception
is that spoofing is a simplified version of hacking in with an
exploit and controlling the agent, drone, or device in question—after
all, if the target does what you want, you’ve
hacked it, right? Not really. Spoofing is a great tool, but
it has its limitations. The following rules expand on
spoofing options and provide a few new ones.
expanded command Spoofing
As described under Spoof Command, p. 224, SR4, a
hacker can use Spoof software to send commands to a target
that look like they were sent by someone with control
or access privileges. This trick may be used to
falsify commands to drones, agents, sprites
(technomancers only), electronic devices,
and slaved nodes.
Spoofed commands will seem
to come from the authorized user
you are spoofing (why you need their
access ID), and so will be treated as having
the same access privileges (personal,
security, or admin) as that impersonated
user. It is up to the gamemaster to decide
what commands are legitimate for which
access privileges. For example, spoofing
a command to an oven to start cooking the
turkey is something anyone accessing the oven is
likely allowed to do. If you are spoofing commands to
a drone, pretending to be the controlling rigger, you
could certainly instruct the drone to log that rigger off
or slave that drone to your commlink instead (since the
controlling rigger would have privileges to do that). To
add, alter, or delete an account, you would almost certainly
need to spoof a command from someone with
admin privileges. Many legitimate users have limits
on what they can do with their accounts, and security-
or safety-conscious spiders can and
do program agents, drones, and nodes to
ignore certain orders. After all, the last
thing a security hacker wants is to be
the target of their own IC.
Unwired
Simon Wentworth (order #1132857) 9