comStar Firewall alert - PhaseThrough

drivers on my commlink before I turn it off for the night; most
people don’t think to disinfect immediately when they boot up,
and anybody trying to jack my shit lets the virus spread through
their PAN to their implants.
Worms are specialized malware agents with an emphasis on
stealth instead of brute force. As long as you keep the agent from
running the entire payload at once, a good worm can last for days
or weeks on a node without being discovered. Corporate hackers
and law enforcement tend to favor worms, especially dataworms,
to keep track of hackers or limit their capabilities. One really nasty
combination is to load a worm with a pacifist virus that infects
the hacker’s combat proggies and prevents them from frying the
worm outright. On the other
hand, worms themselves have
few defenses against viruses. I
usually stick with an inertiainfected
autosoft to jam their
replicate ability.
> Kinda sucks for riggers
though, huh?
> Sticks
> The best defense for a drone
is simply not to get hacked to
begin with, but a good back-up
for riggers is strong encryption—stymies
most worms.
In a pinch, a rigger that can’t
deal with a worm or a virus immediately
is best off cutting it
out of their network before the
infection spreads.
> Rigger X
> Or shut the infected drone down and leave it as an effective boobytrap
for somebody. I got burned like that once.
> Turbo Bunny
Viruses and worms are both straight forward and proactive
programs designed to weaken a node or device in some way. By
contrast, trojans are more like scouts that go in and pave the way
for a later hack.
> Of course, there’s nothing to stop you from combining different
types of malware. You can have a worm with a virus and a trojan in
its payload that moves in, smoothes your entry, and unleashes the
virus to cover your tracks when you leave. It’s almost like creating
genetic chimerae in its elegance.
> The Smiling Bandit
agentS
Agents are essential to the function of the modern Matrix,
and many hackers have at least one to help them with background
tasks they don’t have time to do themselves. An agent is really a
presence multiplier for hackers, letting them expand the number
of places that they can be in and what they can do. No surprise,
then, that some hackers go for agents in a big way.
from: Clockwork
Subject: Re: Ergonomic Malware
Whether or not to load your malware with ergonomic
programs depends on the purpose of the malware agent. If
you want to slow down or crash the system, loading the malware
with regular programs is a good way to go. On the other
hand, if you want your malware to be undetected, I’d go with
the ergonomic program option: less program load means it’s
less likely to be noticed. Sometimes you might even want to
combine the two ideas. For example, maybe you want a worm
to spread throughout a system (using ergonomic stealth programs
to stay undetected), and then when the signal is given
(or timer clocks down, whatever), the agent de-activates its
ergonomic program and runs its regular programs to slow the
system down. The only catch, of course, is that there’s a period
of time between activating and de-activating programs
where the worm is particularly vulnerable.
Unwired
> Some hackers frown on the use of agents, especially when some
brainless ape that knows jack-all about hacking uses a mook instead
of figuring out how to do things themselves.
> The Smiling Bandit
> Mook?
> Sticks
> A high-end agent that does everything in the Matrix for the user,
even the most basic tasks. Instead of learning how to hack, the
user commands the mook to do it for him. Most MSPs provide basic
agents to make the user’s life easier, and lazy users just order them
to do everything. Of course, commercial mooks have built-in limitations
against breaking
the law. To build a mook
capable of hacking, you
need a real hacker.
> The Smiling Bandit
Another advantage
agents can provide is
that they are eminently
disposable—if the agent
gets crashed, the hacker can
just re-load it. Still, hackers
should be wary about feeding
their agents to IC and
spiders: unless you load
it onto the node (which
requires privileges most
hackers don’t have), the
agent can be traced directly
back to you. If you do load
an agent on a node, you’d
better be sure it doesn’t have any incriminating data on it, because if it’s
found and dissected it can lead straight back to you—or the spider can
research exploits to use specifically against that type of agent or the programs
it carries, giving them an advantage over you in cybercombat.
The major limitations on agents are the number of active subscriptions
they take up and the number of programs they can have
running before seeing lag. Having two agents running at the same
time can slow your commlink down something fierce. You can get
around the lag by not running any programs yourself—only really
an option if you’re letting your commlink run overnight while you’re
not connected to it or something—or you can load the agent onto
another node and let their system lag. When you upload an agent
to run on another node, though, you still have to keep an active subscription
to it to receive data and give it orders in real time. When
you want to use more agents than your commlink could handle on
its own, the next step up is a botnet.
> Note the key word there is “in real time.” Hackers that don’t mind
the snail’s pace and uncertainty of knowing whether or not their agent
is still active and running can sever the active subscription and let
the agent just run on its own until the hacker re-establishes contact,
or a hacker and agent can forward their communications through an
e-mail account or use other non-real-time communication methods.
> Glitch
Simon Wentworth (order #1132857) 9
87
hacker’s handbook . . . . . . . . . . . . . . . . . . . . . . . . . .