Shadowrun
Shadowrun Play => Rules and such => Topic started by: Typhus on <11-13-19/1258:46>
-
For whatever reason, let's say my character wants to sit back and just try to defend the team's gear (PANs, let's assume) from enemy cyberattacks.
What am I doing each turn? If a cyber attack happens, what do I "see" in the Matrix? Can I do the technological equivalent of "counterspelling"? Or do I just have to locate the troublemaker and try to splat their gear first? What are my options?
-
The most likely thing your doing is taking the Full Matrix Defense action which let's you add you Firewall (this usually means you get it twice)
-
Mechanically, what you're doing is using your superior mental stats/gear to roll defense tests in place of your teammates'. Proactive actions are things like trying to spot silent running personas, engaging in cybercombat with the attackers, and so on.
In-universe, what you see depends on several things. Like: whether you're in AR or VR, whether the attacker is close enough to see physically or if they're on the other side of the sprawl, and etc.
Generally, I'd narrate that the matrix defender is watching/noticing anomalies on the team's defended devices. Once you begin to detect signs of brute force or back door entry, you switch from a passive role to something reactive, or maybe even proactive if and when you spot the attacker.
-
Can you "see" the attack signal in any way? Other than a device starting to act up (which I assume you notice due to linking team PANs to your deck), you wouldn't be able to detect the attacker themselves.
So I get that the mechanic to "find an icon" is Matrix Perception. Fine and dandy, but how do you know who/what to search for? Would that be the Trace Icon action? How do I detect and locate the specific device hassling my crew? Trace Icon action? Or just that Matrix Perception process, regardless of meatspace location?
-
Matrix Perception is the game equivalent of a "google search". Geographical location is irrelevant for Matrix Perception (indeed ANY matrix action), barring of course potential Noise penalties.
Data Spikes (and Technomancer analogues) can normally be seen in AR/VR- those are the lightning bolts, blown kisses, or whatever fits the attacking persona's personal motif.
Now the more subtle stuff, that usually doesn't give off simsense visuals. That's kind of the point in being subtle, afterall! In 5e, you'd examine the MARK(s) placed by a hostile hacker, and you'd then begin your Matrix Perception based on what you saw from the MARK icon(s). Since 6we dispenses with the MARK concept, it gets a little fuzzy yes. It's probably for the best gameplay that once you know hacking shenanigans are afoot, you already know enough to begin your Matrix Perception for the guilty party. Assuming of course, they're both in your immediate area and not running silent, then a Matrix Perception won't even be necessary.
-
Correct, basically anything that is attack based (i.e. Brute Force and Data Spikes for example) are not subtle so if you're actively aware you should see them coming without much trouble. Subtle Sleaze based actions may not get noticed until something gets triggered or goes wrong then there is no reason you can't attempt at Perception check at that point to identify the source.
-
Where does a Spoof Command attempt fall in that spectrum? Obvious or subtle? Where should the dividing line be?
-
Where does a Spoof Command attempt fall in that spectrum? Obvious or subtle? Where should the dividing line be?
Spoof Command is sleaze based I believe (or at least was during design) so would be subtle but but may have obvious results
-
So maybe, "attack" = obvious "sleaze" = subtle, meaning it needs to be traced?
-
So maybe, "attack" = obvious "sleaze" = subtle, meaning it needs to be traced?
Yep, thought I said that earlier. Sorry if I didn't... I should probably be working instead of watching the forum on my phone. 😎
-
Nah, you did. My bad. Same distraction issue. ;D
-
In SR5 an attack action was obvious and it was enough to be "aware" of the attacker which meant you could take a perception test to spot it. If the offender was running silent then it would get to oppose the test to be found. If not and also in physical proximity or within the same host then you would automatically spot it.
Translated to SR6 it seem as if you would automatically spot an attacker unless the network the offender is hiding behind is running silent in which case you first need to take an opposed matrix perception test to spot the silent running network.
-
I still don't think I have this clear, but I feel like I am probably closer. There's two levels of awareness we're talking about here. Hack Detection and Seeing the Icon.
There's no text on how to detect an attack/sleaze attempt (successful or not). Its not even clear what's happening when I am making a defense roll. Am I aware something is happening or is this a passive event that my system is dealing with? Or is that the difference between Full Matrix Defense and not?
The text in 5e says I become aware of a sleaze attempt if it fails, but only an attack attempt if it succeeds (which seems backwards to me). Regardless of that, would this still be a valid interpretation in the world of 6e? Since the editor's pen has altered the RAI, maybe there is not "right answer" here, which, well, there we are.
Seeing the icon responsible for the hack is also not really described. Per Banshee's statement, an attack action is meant to be obvious. I'm rolling with that for now as the closest statement I can find to authoritative. Per that, iconography is even assumed to accompany it the attack in theory. So, in VR or AR overwatch mode, regardless of my rolls, I would "see" the attacking persona appear next to the icon and try to Brute Force it. I can now target that attacker without needing to roll to "find" them. If they were Running Silent before the BF action pretty much spoils that effect? Or are they still not visible in AR unless I use MP to find them normally?
However, if they try to sleaze their way in, and are running silent (and why wouldn't they be?), I wouldn't see anything in AR/VR in that moment. However, I would be making a defense test, so I am detecting a hack just on that action alone, no? However (assuming they are running silent) I don't have a visual cue yet (my deck hasn't "seen" the source device). I defend the hack attempt, but then what? Do I know someone attempted a hack or not?
Once I know I was hacked, to locate the attacker, do I ever use the Trace Icon action or just Matrix Perception to find the offender? Or does Trace Icon only apply if I want to see where their device is in meatspace? MP shows me the device I want to go revenge mode on, but not where the body is that's connected to it, IIUC?
Assuming the more logical takes on the answers here, this is my working theory:
Enemy Hacker, Running Silent, decides to hit my team's gear. I'm in VR. I see nothing yet.
(1) I make my defense test against the hack (whatever type it is) with Full Matrix Defense in play since that was my plan to defend the gear.
(A) If the hack was a BF attack, it's an Attack-linked action. I detect it happen in VR, because my deck (Per Banshee I guess it autodetects attack actions?). It shows me an attack occurring with whatever iconography the user has running. I still can't target his icon (nor even see it) because he is running silent. I use MP to find the bugger and start to fight back once i spot him. I still don't know where he is in meatspace without the Trace Icon action.
(B) If the attack was a Probe attack, it's a Sleaze-linked action. I do not detect it (even though my character is rolling against it) because they are running silent. If they make the roll against me, they get the access they wanted. Am I aware a new user has joined the network even, or was that part of the successful sleaze effort and I don't know drek until they take an action I do successfully defend against, or I see a Convergence event descend on them for holding the hack open too long?
This also brings up that Full Matrix Defense as published is confusing as well. It's a Major Action, but is that what "prevents you from attacking"? Also, "the next time you are attacked" would appear to make this read that I can go on FMD for one Major action, and then regardless of what I do afterwards, my next defense test gets the Firewall benefit, even if it's 10 rounds later. The only limitation might be that I can't take attack actions myself during this time with any other actions I want to spend. It's got zero details on how to play this out, that I can see so far. It also doesn't say how long this effect lasts. In 5E, it was specifically like a full defense in combat, which would be the more sensible interpretation. That just leaves the "can't attack" rider in question. If I am running hot sim VR, should I be able to use my second Major on that same turn to attack or not? Also, in 6, FMD is not a reaction effect (ie an "anytime action"), even though Full Defense is. You would have to play it before things happen to you, by RAW. Seems like an error there. I would allow it as an AA, since that's it's legacy.
LAST NIT TO PICK:
Data Spike is not tagged as an Attack-linked action in the text. Is that on purpose, or an errata item?
It would be awesome to somehow see the original Banshee draft. :D
-
Ok, trying to be concise but still answer your questions.
Scenario A: yep, you're right.
Scenario B: yeah, pretty much. The whole point of a Sleaze attack is remaining undetected, so as long as they are successful and don't force an action that triggers an obvious threat you're kind of screwed.
Yes, MP let's spot the Icon, Trace Icon let's you find where physical location is.
Full Matrix Defense at least needs somecFAQ work ... yes it's basically just the matrix version of Full Defense for Combat so any ambiguity can be cleared up if you look at FD.
Data Spike should be attack linked.
Sorry, that would violate my NDA to post .. plus it's kind of ugly since I'm not that good of a type. 😎
-
OK, sounds like I worked out enough then. That's enough for me to roll with for now I think. Thank you very much for your insights. An elf can dream though. :)
-
The text in 5e says I become aware of a sleaze attempt if it fails, but only an attack attempt if it succeeds (which seems backwards to me).
Compare a stealthy matrix action with a stealthy physical action:
If someone successfully palm an item from your pocket then you will not notice it. If someone fail to palm an item from your pocket then you will not only notice it, you will automatically spot whoever is the guilty one (even if the thief was trying to hide in the shadows - doesn't matter).
If someone successfully snoop your communication then you will not notice it. If someone fail to snoop your communication then you will not only notice it, you will automatically spot whoever is the guilty one (even if the snooper was trying to hide - doesn't matter).
Compare an offensive matrix action with a offensive physical action:
If someone successfully shoot you then you will automatically be aware that you were attacked and if the attacker is not trying to hide then you will also automatically spot him (to spot an attacker that is trying to hide require an opposed perception test). If someone fail to hit you then you will not even be aware that you were attacked in the first place... OK, maybe not best of examples but you get the idea :-)
If someone successfully land a data spike then you will be automatically aware that you were attacked and if the attacker is not trying to hide then you will automatically spot it (to spot an attacker that is trying to hide require an opposed matrix perception test). If someone fail to land a data spike then you will not even be aware that you were attacked in the first place.
Note that the above relates to SR5. In this edition it depend on the action you are taking if the sleaze action will be noticed or not. Probe, for example, will not be noticed on a failed attempt (unless perhaps the hacker glitch) while Backdoor Entry will always not only be detected on a failed attempt, the backdoor will also be deleted and hacker need to start over with a new Probe attempt.
And also that in this edition it seem as if individual devices does not run silent. Either the entire network they are hiding behind is running silent or it isn't. If the network is running silent then it seem as if you take an opposed matrix perception test to spot it. Once you spot the network it seem as if you no longer have to also spot individual devices that belong to the network....
Same as in this edition it seem as if you don't need access on individual devices. Either you have access on the entire network they are hiding behind or you don't have access. Once you have access on the network you no longer have to also gain access to individual devices that belong to then network...
I would "see" the attacking persona appear next to the icon and try to Brute Force it. I can now target that attacker without needing to roll to "find" them. If they were Running Silent before the BF action pretty much spoils that effect? Or are they still not visible in AR unless I use MP to find them normally?
Not sure about the "next to the icon" part since distance in the matrix is a bit funky, but yes, if you are obviously attacked by a PAN then you can attack back. Unless perhaps if the PAN is currently running silent, in which case you first need to take an opposed matrix perception test to spot the PAN.
Once I know I was hacked, to locate the attacker, do I ever use the Trace Icon action or just Matrix Perception to find the offender?
If your target is trying to hide then you resolve it with an opposed matrix perception test, otherwise you don't.
If you also wish to know the physical location you first need to gain admin access and then take an Electronics test to get the real life location....
because they are running silent...
No, not because the network the hacker belong to is running silent....
Reason target don't notice is because the Probe action explicitly state that: Probing a device does not raise an alarm automatically. Even if your attempt initially fails, it will not trigger an alarm unless major mistakes are made.
Target will also not notice a successful Backdoor Entry attempt.
However(!) on a failed Backdoor Entry attempt the hacker will be detected. But this have also nothing to do with running silent or not. Reason why target notice is because the Backdoor Entry action explicitly state that: If this test fails, the backdoor you have made was detected and removed, and you cannot attempt Backdoor Entry again with the same host until a new backdoor is made through the Probe Action.
This also brings up that Full Matrix Defense as published is confusing as well.
You spend a major action on full matrix defense. If you are attacked before it is your turn to act again then you add firewall to your defense. Repeat until you need to use your actions on your turn on something other than full matrix defense. Not really more complicated than that.
Data Spike is not tagged as an Attack-linked action in the text. Is that on purpose, or an errata item?
This was addressed in the Aug hot-fix errata.
-
If someone successfully palm an item from your pocket then you will not notice it. If someone fail to palm an item from your pocket then you will not only notice it, you will automatically spot whoever is the guilty one (even if the thief was trying to hide in the shadows - doesn't matter).
I think your post is useful, don't get me wrong, but this seems like only one possible fictional outcome of failure in this case. For example, maybe failure means you had to abort before reaching into the target's pocket?
I raise this simply to say I think viewing all of this as a binary is maybe the wrong way to look at it. Maybe better to consider as a spectrum. For example, maybe a stealthy action in the Matrix DOES leave traces that can be seen sometimes. Maybe a data spike fails so badly it might as well have targeted a different system and therefore is unnoticed.
I say this because I think this is a place where glitches and critical glitches can be worked out, and beyond that where the GM can get creative with the consequence of failure.
But I admit I haven't processed the matrix section of the rules in any detail, so maybe it really is presented as a true dichotomy.
-
Compare a stealthy matrix action with a stealthy physical action:
Very helpful analogy.
If someone successfully shoot you then you will automatically be aware that you were attacked and if the attacker is not trying to hide then you will also automatically spot him (to spot an attacker that is trying to hide require an opposed perception test). If someone fail to hit you then you will not even be aware that you were attacked in the first place... OK, maybe not best of examples but you get the idea :-)
See that's the baffling part to me, I feel like I surely would notice. Pew goes the bullet past my head, thunk goes the knife into the wall near me. Would my Firewall not also say "hey buddy, I just stopped an attack"? Today, I believe most malicious stuff gets logged. Seems like your system should have that basic ability. shrug
If someone successfully land a data spike then you will be automatically aware that you were attacked and if the attacker is not trying to hide then you will automatically spot it (to spot an attacker that is trying to hide require an opposed matrix perception test). If someone fail to land a data spike then you will not even be aware that you were attacked in the first place.
Seems like the corps are overlooking some old school functionality there. The best logical I can conjure is that systems get swiped at so often, the corps don't care to follow up on failed attempts. Script kiddies and bots might be the bulk of such efforts, so they just ignore it? Seems like a decker would not want to do that though.
Note that the above relates to SR5. In this edition it depend on the action you are taking if the sleaze action will be noticed or not. Probe, for example, will not be noticed on a failed attempt (unless perhaps the hacker glitch) while Backdoor Entry will always not only be detected on a failed attempt, the backdoor will also be deleted and hacker need to start over with a new Probe attempt.
And that makes sense enough, for sure.
And also that in this edition
Yep, all that I gleaned. Nicer way to go, really.
Not sure about the "next to the icon" part since distance in the matrix is a bit funky, but yes, if you are obviously attacked by a PAN then you can attack back. Unless perhaps if the PAN is currently running silent, in which case you first need to take an opposed matrix perception test to spot the PAN.
I'm thinking of it as a GM here. If the hacker is on overwatch, what do they "see" in VR when they would detect a hack? Would it reasonably look like an icon materializing out of nowhere? If so, that icon needs a position relative to the target icon. So, I assume "next to me from my perspective" would be the relative position, since they are attempting to interact with the network I am defending. If they are not detectable to me at first, and use some sort of attack action, I see the attack animation, but not their icon. When I roll well enough spot them, the icon sort of shimmers into visibility in VR or something I suppose (?).
If your target is trying to hide then you resolve it with an opposed matrix perception test, otherwise you don't. If you also wish to know the physical location you first need to gain admin access and then take an Electronics test to get the real life location....
That is what I was gathering. Makes sense enough.
Reason target don't notice is because the Probe action explicitly state that: Probing a device does not raise an alarm automatically. Even if your attempt initially fails, it will not trigger an alarm unless major mistakes are made.
Target will also not notice a successful Backdoor Entry attempt.
"raise an alarm" brings up another point. That's not a ideal choice of wording to describe it, since "alarms" are not a thing by the rules as such. This line introduces a new term that doesn't connect to anything specific in the rest of the text. It should probably simply read "does not alert the target to the attempt".
However(!) on a failed Backdoor Entry attempt the hacker will be detected. But this have also nothing to do with running silent or not. Reason why target notice is because the Backdoor Entry action explicitly state that: If this test fails, the backdoor you have made was detected and removed, and you cannot attempt Backdoor Entry again with the same host until a new backdoor is made through the Probe Action.
I'm talking about becoming aware of the hacker's icon due to the hack attempt itself, vs becoming aware of just the hack action.
You spend a major action on full matrix defense. If you are attacked before it is your turn to act again then you add firewall to your defense. Repeat until you need to use your actions on your turn on something other than full matrix defense. Not really more complicated than that.
Seems like it is more complicated though. So each round you are using a Major action, fine. Not clearly written, but there's no other precedent in the book that suggests actions carry over longer than one turn unless they are Extended tests. That's fine.
However, it also says you are prevented from attacking. I feel like most games have any sort of Full Defense preclude making attacks, so it would make sense. However, Full Defense has no such limitation. Is that an oversight or intentionally different?
Also, it seems like it should be an Anytime action, like FD is. I don't see any other Matrix actions that seem like candidates for that, so I think that would be the only one. The rest would be Initiative actions, I assume. If there's supposed to be parity, there isn't currently, and Matrix actions aren't tagged either way.
I hope at the least this helps for further FAQ or errata. Looks like I have a choice to make as the GM to either treat FD and MFD differently (closer to RAW) or go more traditional and treat them equally (picking one or the other to use for the baseline - Initiative Action with no attack or Anytime Action and allow attacks). At least until some errata is ever dropped.
Would one "break the game" more than another to choose? Seems like allowing the parity with FD is the more favorable option, but I can't conjure any downstream effects that would be an issue.
-
I think your post is useful, don't get me wrong, but this seems like only one possible fictional outcome of failure in this case. For example, maybe failure means you had to abort before reaching into the target's pocket?
Just to clarify (if it wasn't clear enough from the post I made). Here he was asking about how it worked in SR5. Rules changed in SR6. The example you just quoted were to illustrate how it worked in SR5, not SR6.
For SR6::
When it comes to Probe (which is linked to sleaze) you will not alert the target on a success and you will not alert the target on a fail, either (except maybe on a glitch).
When it comes to Backdoor Entry (which is also linked to sleaze) you will not alert the target on a success but you will alert the target on a fail.
When it comes to both Brute Froce and Data Spike (which are both linked to attack) you will [at the very least] alert the target on success.
In SR6 you need to take an opposed matrix perception test to find something that is hiding. You don't need to take a matrix perception test to find something that is not hiding (or if you are already inside the network when your target tries to hide).
-
See that's the baffling part to me, I feel like I surely would notice. Pew goes the bullet past my head
As I said, the analogy was not really that good :-)
(but also it is much harder to notice a bullet going pass you than you might think - unless you apply Hollywood-realism).
Would my Firewall not also say "hey buddy, I just stopped an attack"?
In SR5 your firewall would cause matrix damage to the offender, but the owner would not be alerted (your firewall are probably fending off a lot of attacks on a daily basis without you knowing.
Don't think too much of the examples I gave in the start of the post, they were to justify how it worked in SR5. Rules might have changed in SR6.
Seems like the corps are overlooking some old school functionality there. The best logical I can conjure is that systems get swiped at so often, the corps don't care to follow up on failed attempts. Script kiddies and bots might be the bulk of such efforts, so they just ignore it?
Something like that, yes. Also remember that in SR5 the firewall would cause matrix damage to offenders - by themselves. But this is, again, how it worked back in SR5. We should probably not analyze that too deeply.
Also, it seems like it should be an Anytime action
I think the intent here is that if you for example are a rigger, then you would "by default" always use full matrix defense in your turn (no matter if you expect to get attacked or not), except in turns where you actively wish to spend spend your major action on something else.
Unlike a street samurai. He would probably not bob and weave all over the sidewalk while just walking down the street to make himself harder to get shot at. Unless perhaps he seriously suspect that he is currently being a target.
-
I guess for noticing hacking I was intending to divine how it was intended for SR6, not 5. It makes some sense to think of it like the constant barrage of attempts being ignored, I suppose.
I think the intent here is that if you for example are a rigger, then you would "by default" always use full matrix defense in your turn (no matter if you expect to get attacked or not), except in turns where you actively wish to spend spend your major action on something else.
Like an attack type action, in theory?
Is that your assumption of the intent, or based on something more concrete? I'm also not sure if you mean that it should not be an anytime action by design.
-
It is not marked as either Initiative or Anytime, but the wording of the action itself seem to imply that you take it on your turn and that it take effect "The next time you are attacked..."
Compare the wording of anytime actions, such as Avoid Incoming (A): "character can use this action when it is not their player turn to get away from an incoming Blast or Gas attack, Block (A): "The roll must happen in the same player turn in which the action is used" or Dodge (A): "The roll must happen in the same player turn in which the action is used"
You spend a major action on your turn to take the Full Matrix Defense action and if you were attacked before your next turn then you get to add firewall a second time to the defense roll.
But if it is to be treated as an Anytime action you would save a major action and then take the action out of turn if you are attacked instead.
Doesn't really matter how you resolve it since the end result is basically the same in both cases.
Also this:
SR6 p. 197 Resist Hacking
Riggers spend a significant amount of time and effort protecting their gear, and that includes liberal use of the Full Matrix Defense action (p. 182).
-
I really dislike Matrix Full Defense because it's a Major for a one-time advantage, versus normal Full Defense being against-all. But you tend to face less opposition in the Matrix, I guess?
-
and it also does not work against all matrix related aggression, only against "an action is taken that will directly cause you damage.
It seems clear that this action does not help against for example Backdoor Entry, Control Device, Crack File, Crash Program, Disarm Data Bomb, Edit File, Jump Into Rigged Device, Matrix Perception, Probe, Reboot Device, Snoop, Spoof Command...
Depending on your reading it also does not work against Brute Force attempts. But also Acid, Binder, Crash, Jammer, Marker, Patrol, Scramble, Tar Baby, Track. And Diffusion, Editor, Pulse Storm, Puppeteer, Resonanace Veil and Static Bomb.
The only actions that it is clear that it work against are the following: Data Spike and Tar Pit. And it probably also works against Black IC, Blaster, Killer and Sparky. And unless complex forms are treated differently it is also clear that it work when defending against Resonance Spike.
-
You don't want to face Full Defense on top of everything else when your PC is hacking NPCs/Hosts, do you? Makes sense to me that Full Defense has a narrow range of utility.