comStar Firewall alert - PhaseThrough

software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
124
users—or the successful implementation of social engineering—
rather than flaws in a computer system’s security. It is up to the
gamemaster to decide if and when a character’s online activities
justify an infection.
activating trojan Horses
As soon as the trojan’s façade program is executed, the trojan
malware hidden inside is activated as well. Most trojans are
designed to immediately install something on the infected system
(such as a backdoor or hidden proxy server), or to download and
install some other sort of malware (such as a virus or worm). A
few are designed to undertake some other sort of action, such as
disarming the Firewall. Each trojan is designed with a different objective,
and so functions differently, according to the gamemaster’s
discretion (see Sample Trojans, p. 124, for specific examples).
Because trojans are (unknowingly) activated by the duped
user, they take action with the same account privileges as that user.
This means that in many cases, the trojan’s actions are considered
legal and are not contested by the Firewall.
detecting and disinfecting of trojans
Since trojan horses take a variety of forms, there is no universal
method to automatically locate and eradicate them. Trojans are
particularly difficult to spot before they have been activated. They
roll Rating x 2 to oppose Matrix Perception Tests once activated. If
the trojan has not yet been activated, apply a –4 dice pool modifier
to the Matrix Perception Test. A detected trojan can be purged
with an Opposed Disinfect Test (see p. 121).
SaMpLe troJanS
Although a plethora of different trojans exist under different
names and handles, some representative samples of trojan horse
programs and their functions are described below. Gamemasters
and players are encouraged to expand this list on their own and
develop new trojan programs.
Hijacker
Hijacker trojans subvert the activating user’s connections, redirecting
him to other nodes—typically nodes loaded with spam,
porn, or extremist political media. The trojan may occasionally
redirect the user’s connection attempt to a different site, or it may
always open an additional second connection every time the user
opens one.
proxy
This trojan installs a secret proxy server (p. 104) on the
user’s node when it is activated. If the user’s privileges allow for
this, it is automatic; otherwise the trojan rolls Rating x 2 (10, 1
Initiative Pass) to install it. The trojan then keeps the server hidden
using Rating x 2 to oppose any Matrix Perception Tests. If
successful, the proxy server details are immediately transmitted
to the trojan’s deployer.
puppeteer
Puppeteer trojans are designed to aid a hacker to spoof commands.
When activated, the puppeteer informs the deploying
hacker of the infected user’s access ID (if this changes, the trojan
will update the hacker), enabling the hacker to more effectively
spoof commands from the user. More insidiously, however, the
Puppeteer opens a channel by which the hacker can send commands
to the trojan, which then resends the commands as the
infected user (and with the user’s access privileges) to any drones,
agents, or devices under the user’s command. Because these
commands are “legitimate” (coming from the authorized user’s
account), they are automatically accepted.
rat
An abbreviation for “remote access tool,” the RAT is designed
to immediately install a backdoor within the node when it is activated.
Roll its Rating x 2 to create a reusable exploit, a legitimate
account, a hidden account, or a hidden access point (see Backdoors,
p. 99). If successful, the backdoor details are immediately transmitted
to the trojan’s deployer.
Sapper
Sapper trojans feature coding similar to the Disarm program
(p. 111). When activated, they remain hidden in the node until
they receive an activation code from the deploying hacker. At this
point, they attempt a Disarm action (p. 112) to neutralize the
Firewall against the hacker, rolling Rating + Disarm.
vector
When activated, Vector trojans immediately open a connection
to download and install a virus, worm, or agent from a
predetermined Matrix site. Vector trojans are a common method
used to spread malware infections to other nodes. Hackers sometimes
use Vector trojans as a clandestine method to sneak an agent
onto a target node. Agents and worms downloaded this way operate
with the activating user’s access privileges.
tacticaL ar Software
Tactical AR software features sophisticated expert programs
designed to analyze a situation, evaluate threats, incorporate sensor
data from networked team members, calculate probabilities,
run background simulations, and suggest courses of action. Based
on previous generations of implanted tactical computers and new
systems designed for biodrones (see p. 152, Augmentation), these
programs incorporate augmented reality, mobile wireless devices,
simsense, and advanced sensor technology to maximize tactical
capabilities and threat response. Tacnets are commonly used by
Malware Availability Cost (up to Rating 3) Cost (up to Rating 6)
Trojan (Rating x 4)F Rating x 1,000¥ Rating x 2,000¥
Virus (Rating x 3)F Rating x 500¥ Rating x 1,000¥
Worm (Rating x 5)F Rating x 2,000¥ Rating x 5,000¥
Unwired
Simon Wentworth (order #1132857) 9