comStar Firewall alert - PhaseThrough

Pistons is researching the NeoNET Aegis-II Armor
program (a Rating 2 armor program). She rolls her 4
Hacking dice and 4 Logic dice against a threshold of 12;
in six days she has discovered a new exploit that applies to
that particular program. Pistons will enjoy a 2 dice bonus
to her Cybercombat Skill Test to crash that particular
armor program.
Hacked accoUntS
Just because a hacker has bypassed a Firewall once doesn’t
mean he has an open pass to access the node whenever he pleases,
or that he can share that access with all of his hacker buddies.
Several factors must be taken into consideration first (each subject
to gamemaster review).
If a node has been hacked on-the-fly, the hacker has found
some gaping hole in the system security that allows him to access
an account on that node. The hacker has not actually acquired
the passcode for the account, however, and the exploit is likely
to be noticed in a security audit and/or patched in the immediate
future. This means that if the hacker wants to access the node
again, he will have to hack in again. There is no way for the hacker
to share the hacked account with another hacker or Matrix entity,
even while the hacker is accessing the account.
If the target node was carefully probed before the hack,
however, there is a better chance that the hacker can use the same
method to regain access at a later point. Either the hacker has
ascertained a passcode that will allow him to access the account
legitimately in the future, or he has discovered a re-usable exploit
(p. 96)—the gamemaster determines which. In either case, this
access may be shared with others, allowing them to use the account
or re-usable exploit. Eventually, however, passcodes may expire or
be changed, and exploits may be discovered and patched. Nothing
lasts forever.
No matter how access was obtained, if a hacker triggers an
alert, their method for accessing the node will likely be closed off
in the future, to prevent future intrusions.
Hackers may of course make arrangements while within a
node to ensure that they can access it at a later point. Options include
inserting a re-usable exploit, creating a “legitimate” account,
or creating a hidden account or access point. These methods are
referred to as backdoors.
BackdoorS
A backdoor is a means for a hacker or technomancer to
gain repeated access to a node with less effort than hacking their
way in every time; this means it is typically hidden from the site
administrators, though in the case of repeated use of legitimate
accounts this might mean hiding in plain sight. Before leaving
a node they’re likely to come back to, some hackers will take the
time to code in an account or exploit that will let them access
the node again. In general there are four types of backdoors:
reusable exploits, legitimate accounts, hidden accounts, and
hidden access points.
reusable exploits
As noted under Probing the Target (p. 221, SR4), some
probed exploits may be used repeatedly if the hacker doesn’t do
something to give them away or it they aren’t discovered. The
Unwired
drawback to this “open hole” sort of backdoor is that the system
gets an Analyze + Firewall Test every time you use it.
Hackers who have hacked their way into the node can also
create their own reusable exploit; a specially crafted flaw in the
node’s firewall that allows those who know about it to hack the
node with extreme ease. Creating a reusable exploit requires a
successful Extended Software + Exploit (Firewall + System, 1
Initiative Pass) Test if you have at least security-level access on the
node—otherwise replace Software with Hacking. Once created,
this provides a hidden exploit that gives the hacker a +6 dice pool
modifier to gain access to that node using the Exploit program.
The details of a known exploit like this may also be traded/
sold to other hackers, who will also receive the +6 dice pool
bonus until the exploit is discovered and removed (see Detecting
Backdoors, below)
Legitimate accounts
Nodes expect a certain amount of traffic from normal users,
and for many work-related nodes even some off-hours access from
home or private terminals is typical or expected. A hacker who
steals the passcode to a legitimate account can, with care, continue
to make use of that account for some time before a spider notices
anything, if they ever do.
A hacker who has hacked the node may also create a “legit”
account on the system (see Hackers & Editing, p. 225, SR4) and
then hide the fact that they created it. This requires a successful
Software + Editing Test if you have at least security privileges on
the node, or a Hacking + Edit (2) Test if you do not. For securitylevel
access, increase the threshold to 3; for admin access, increase
it to 4. New accounts of course show up on security audits and
are usually carefully scrutinized for legitimacy. All of the account’s
actions are also logged—it’s not hidden, as it was created with the
façade of a legitimate account. A verifiable account on a corporate
system combined with a fake SIN and/or records that the hacker
is employed by that corporation can make a very convincing cover
story for an infiltration.
Hidden accounts
A hidden account is not visible to spiders or administrators,
being discernible only by the system. While this account
allows the hacker to access the node freely, it is still subject to
account privilege limitations and spiders who perceive the character
will assume them to be trespassing as they will not appear
to have an account.
To create a hidden account, you must already have access to
the node (either legit or hacked) and must follow the procedure
for creating a legitimate account noted above. On the next action,
the legitimate account must then be hidden with a Hacking +
Stealth (Firewall, 10 minutes) Extended Test. As with any other
account, this hidden account has a unique passcode; anyone with
that passcode may access that account. Previously existing legitimate
accounts may also be transformed into hidden accounts this
way, but the access log must also be modified or a security audit
will show an account mysteriously disappeared.
Hidden access points
A hidden access point is similar to a reusable exploit, except
the hacker exploits a software flaw that allows him access to a node
Simon Wentworth (order #1132857) 9
97
hacker’s handbook . . . . . . . . . . . . . . . . . . . . . . . . . .