comStar Firewall alert - PhaseThrough

hacker’s handbook . . . . . . . . . . . . . . . . . . . . . . . . . .
96
coUnterfeiting otHer cUrrencieS
There are other kinds of electronic money in
the Sixth World besides nuyen, and hackers can
counterfeit those too. Typical examples include
national currencies (UCAS dollars) and corpscrip
(Aztechnology corporate pesos). These monies
are usually easier to counterfeit than nuyen but
are much more difficult to pass as authentic (verification
systems get +4 dice on Opposed Tests to
detect counterfeits). Player characters can also
generate game currencies such as those used
in Matrix games to buy virtual equipment (pikucredu);
game cred can be purchased with nuyen
inside the game but cannot (legally) be exchanged
for nuyen after purchase.
A very few backward places in the Sixth World
even rely on physical mediums of exchange in
the form of coins or bills (see Using Forgery, p.
124, SR4).
optional rule: forging Sins and ids
Creating a fake system identification number (SIN) requires
extensive resources that most shadowrunners just don’t have; the
forger must generate and insert corroborating data into a number
of government and corporate databases, the names and addresses
of which are not available to the general public. The fixers and
syndicates who deal in false SINs and IDs have established channels
and contacts that work in the issuing institutions and have
multiple backdoors into the necessary databanks. Even then it
can be a tedious, expensive process to produce a high-rating false
SIN, and also a very personal one involving increasing degrees of
personal information and biometric data depending on the rating
of the fake SIN. Solo hackers and technomancers can forge their
own SINs, but without the apparatus of contacts and backdoors
in place the process is much longer and more difficult than buying
a fake SIN. Gamemasters should think very carefully before
allowing their player character hackers to dabble in forging SINs,
as it can prove unbalancing. The following rules are for use at the
gamemaster’s discretion.
Creating a fake SIN or fake license (see Legality, p. 303, SR4)
requires Matrix access (through a commlink, terminal, or a technomancer’s
innate ability) and an Extended Forgery + Edit Test (see
the Forgery Table, p. 95, for Interval and Threshold). Fake SINs
and licenses have a rating from 1 to 6 that determines how well
they stand up to verification systems (see Fake ID, p. 260, SR4).
Once created, the fake SIN or license and its corroborating data
must be accepted by official databases, which requires a series of
system intrusions and Hacking + Edit (System, 1 hour) Extended
Tests on challenging nodes; the gamemaster decides on the target
system ratings and can choose to play these out or summarize them
quickly with an Extended Hacking + Edit (Rating of fake SIN x
System, 1 hour) Extended Test.
Burnt and Stripped Sins
When a SIN is exposed as a fake or is no longer usable because
of crimes connected to it, it is said the SIN is burnt. A SIN
contains biometric and identifying data that a character doesn’t
want to fall into the wrong hands, and can only be stripped of
such incriminating data. Fixers and fences who buy fake SINs (see
Fencing Goods, p. 303, SR4) typically strip them automatically,
but some characters might not want to take the chance that their
personal data is recorded first. A character can strip a SIN with a
series of system intrusions and Hacking + Edit (System, 1 hour)
Tests on challenging nodes; the gamemaster decides the target system
ratings and can choose to play these out or summarize them
quickly with an Extended Hacking + Edit (Rating of fake SIN x
System, 1 hour) Test.
When a SIN is burnt or stripped, the character loses all online
accounts, licenses, DocWagon contracts, rental agreements,
deeds for property, and legal debts tied to that SIN.
optional rule: forging passkeys
A passkey (see Passkeys, p. 64) contains an encrypted code
that, combined with a valid passcode, allows a user access to a
system. The encrypted code is incremented or scrambled every
time it accesses the system, which means the code changes with
every use. A dedicated character could forge a copy of a passkey,
but it would require at least a schematic of the passkey and a copy
of its firmware. The forged passkey (if made correctly) would be
good for one use only—and it would have to be used before the
actual passkey is used, or the code won’t work. If someone uses
a forged passkey to access an account, the original passkey no
longer functions correctly, and spiders or admin users will know
that the last time the account was activated, it was done with a
forged passkey.
Given these limitations, most shadowrunners choose to steal
or “borrow” passkeys; especially more advanced nanotech and alchemical
passkeys, which require special facilities and equipment
to manufacture.
expLoitS
Not to be confused with the Exploit program, an exploit is
a loophole, a code flaw, or other software error that a hacker can
take advantage of (in other words, an exploit is what the Exploit
program is designed to find, from a built-in database of security
flaws, and take advantage of ). A hacker that discovers a new exploit
(i.e., one that software and security vendors don’t know
about and haven’t plugged yet, and that hasn’t even circulated
through the hacker underground) has a decided advantage when
dealing with the subject of that exploit. The hacker gains a +2 dice
pool modifier for a Hacking or Cybercombat Test targeting that
specific exploitable software (a particular brand of agent, program,
firewall, or operating system).
Finding a new exploit requires research into the already existing
exploits available for that piece of code and detailed analysis
of the code itself, while also requiring a successful Extended Logic
+ Hacking (10 + rating, 1 day) Test. Every time the new exploit
is used, there is a chance that the exploit is plugged and no longer
works—the hacker won’t know for sure until they try to use the
exploit and it fails.
Exploits aren’t restricted to a single system, so even if an exploit
is plugged in one system, there’s a chance it will still work on other
systems, until news of its existence spreads at least. Known new exploits
are always plugged when a new patch arrives for the software.
Unwired
Simon Wentworth (order #1132857) 9