[Fatespinner]

Hi all,

I have a question about a hacking strategy and if I understand it right.

Assume that your decker does have Log 6, Int 5 and Cracking Group 6. He also runs a deck with 2 program slots and for simplicity all attributes at 5. The goal is to find a file in a host.

1. Hack on the Fly against the host using teamwork rules. Decker and agent are not running silent.
2. Decker and agent go silent after success.
3. Decker enters the host and invites the agent.
4. Decker and agent search for the file.
5. Patrol IC detects silent icons and tries to find them.

So now the following might happen.

6. Patrol IC detects either decker or agent.
7. Decker and agent both attack Patrol IC with Hammer. The IC is probably killed, if both hit. This is even more effective if there is another decker. After this the discovered icon goes silent again.

So now the host could launch another Patrol IC. The IC would probably be killed again. Would the host be able to do something against the intruders? Am I missing something? It seems to be a very effective approach against lower rating hosts (4 or less).

[Xenon]

1. Hack on the Fly against the host using teamwork rules. Decker and agent are not running silent.

I would allow this.

2. Decker and agent go silent after success.

Sure.
But note that in many cases running silent might cause more questions than just change your icon and just blend in...

3. Decker enters the host and invites the agent.

You can not invite someone to place a mark on an icon you are not the legit owner of.

Your Agent and you also don't share marks or spotting information.
If you wish your Agent to gain access to the host then you could teamwork with your Agent as it tries to place its own mark on the host...

Your agent need to have its own mark on the host in order to take the Enter Host action.

4. Decker and agent search for the file.

If you are both inside the host then I would allow that your Agent teamwork to help you find the correct file a bit quicker (but the base time inside a host is normally just 1 minute anyway).

So now the host could launch another Patrol IC. The IC would probably be killed again. Would the host be able to do something against the intruders? Am I missing something? It seems to be a very effective approach against lower rating hosts (4 or less).

Trying to fight it out inside a host is an uphill battle. Host will just continue to launch IC every combat turn. Your overwatch score will just go higher and higher. Host may also alert security spider which might join the fight after a few combat turns unless he was already in the host from the start.

If spider (or IC) notice you then you need to successfully take the Hide action to become unspotted. If spider (or IC) have mark on you then you first need to erase mark before you can take the hide action against them.

Your overwatch score will increase with each hit IC get when defending against your illegal Data Spike attacks and your illegal Hide sleaze attempts. Eventually your (or your agents) overwatch score will hit 40 which will trigger Host Convergence.

Host Convergence mean that the host get 3 marks on the icon (which mean it will also automatically spot the icon, the Icon also cant take the illegal Hide sleaze action to become unspotted while host have marks on the Icon) and the physical location of your cyberdeck is reported to the Grid owner you were just using as well as the owner of the Host. Expect real-life security.

[Fatespinner]

Ok. Thanks for the reply. I forget about host convergence. That would put a fast end to the tactic. I am not sure if the agent needs a mark to enter the host. If I shut it down before entering the host and then restart it, then it should be also inside the host, because it runs on the same cyberdeck. Otherwise I would be able to take action outside of the host through the agent.

[Michael Chandra]

At my table I also houseruled that teamwork on mark-getting was allowed, but only the lead gets the mark.

[Fatespinner]

Would I need to run silent at all? If I get a mark and log into the host. Wouldn't I then be a legit user of the system until I do an attack or sleaze action? So I could search for the file and would only have watch for IC if I hack the file after I found it.

The rulebook states, that getting a mark is illegal, but not the owning of a mark. So patrol IC should not be alerted unless I do something strange.

[Michael Chandra]

It depends on whether you match the scenery. If your icon is steampunk and they're expecting corporate suit icons, or you log in at a time where nobody should be working so Patrol IC will distrust you..

[Xenon]

Your physical cyberdeck is connected to a grid. When you use it you will start at the 'entrance' of said grid. From there your matrix persona can move into hosts or to other grids. Your agent is a persona of its own. When your agent is booting up it will form its persona of its own and it will also start at the 'entrance' of the grid your cyberdeck is connected to. It doesn't share your spotting information and it don't share your marks. If your agent wish to enter a host it need to place its own mark on the host.


As long as you change your icon so you appear to belong in the host and as long as you don't take any illegal matrix actions (matrix search is a legal Data Processing action) while inside the host (patrol IC can check what your last used matrix action was) there is often no need to run silent at all.

SR5 p. 69
Knowing the emphasis security places on perception makes it all the more important to adopt the infiltration techniques that work in the meatworld. Most importantly, look like you belong. If you’re going into a crowded host, for example, why run silent? That’s a great way to call attention to yourself, oddly enough. Just let your icons move with the crowd of others, and make sure your actions are so smooth that they don’t call attention to you. Conversely, are you going to a host predicated on secrecy? Like, say, you decided to run into MI-5 because you’re tired of breathing? Then run silent. Spies are slipping in and out of those places all the time, so the demiGODs won’t be automatically alerted to another silent icon.


Having said that, you should probably always run silent before you take an attack action (like Crack File to be able to copy a protected file icon) since if you are not running silent by then you would be automatically spotted...

[Stainless Steel Devil Rat]

I'm curious why you'd bother to go silent in step 2.  You have a mark on the host, whether it's illicitly put there or not it now makes you in the eyes of the host an authorized user.  Running Silent inside a host just means Patrol IC and/or a Spider only needs to ask "Are there any Silent Running icons in the host right now?" and the jig begins to be up: they only need 1 hit on their matrix perception test and it's not opposed.  That doesn't spot you, but it does alert the IC/Spider that there's someone here who probably shouldn't be, and they can respond accordingly. And you have no way to prevent or delay that from happening... other than not running silent in the first place.

[Fatespinner]

Well the idea was to be already silent, when the spider or patrol ic starts to scan, because they can only unhide one icon per roll. So for a short go in and steal data run it might buy you one or two turns.

[Stainless Steel Devil Rat]

Right, but again why bother going silent to do your search?  It's not an illegal action.  They can see your icon if you're not running silent, but if you're not doing anything illegal, what are you afraid they'll see? Why suffer the -2 dice penalty if you don't have to?

Ok, granted, if you don't make your icon look like what other employees' or users' icons look like you might stand out... so change your icon. it takes a single simple action   If you know what form your icon should take to look like it belongs, you can even do that prior to entering the host.

[Fatespinner]

That is some solid advice.

I am playing a decker for the first time and I find it difficult to know how to hack correctly. Most hosts have a high rating by the book and if I roll about 12-14 dice then there is a high failure rate. Which is not so critical for attack action, but if you fail at a sleaze, then thibgs get dangerous fast.

[Fatespinner]

Right, but again why bother going silent to do your search?  It's not an illegal action.  They can see your icon if you're not running silent, but if you're not doing anything illegal, what are you afraid they'll see? Why suffer the -2 dice penalty if you don't have to?

Ok, granted, if you don't make your icon look like what other employees' or users' icons look like you might stand out... so change your icon. it takes a single simple action   If you know what form your icon should take to look like it belongs, you can even do that prior to entering the host.

So Impersonation, Disguise and Con are good complementary skills for a hacker to get past modern system defense software.

Hack to enter, then disguise as a normal user and do legal stuff. When you need to do an illegal operation, then try to do it, when no patrol IC is around (if it is a sleaze action) or go silent and do your stuff fast (if it is an attack action).

[Xenon]

So Impersonation, Disguise and Con are good complementary skills for a hacker to get past modern system defense software.

Social skills will have zero effect on Patrol IC.

Hack to enter, then disguise as a normal user and do legal stuff. When you need to do an illegal operation, then try to do it, when no patrol IC is around (if it is a sleaze action) or go silent and do your stuff fast (if it is an attack action).

The "disguise" part here is just the Change Icon legal matrix action. It will have no effect at all on a matrix perception test, but at least it will look like you belong on a first glance.

[Fatespinner]

Well Disguise and Impersonate would help you to change your icon better (or can you simply copy an icon that you see?) and to look like you belong there and do normal work (fake matrix actions and stuff like that). But unless you are in a part of the host, where only a limited number of people are allowed to go, there would be no need for a perfect disguise. After all there will also be subcontractors, home office workers and other people be running around.

Is identity theft possible? Could you simply pose as a legit user by simply having a mark and a know persona icon? Can you check somebodies SIN via the Comlink? After all a mark is similar to an account+password and the number of marks are your permission level. But IRL an account is often linked to some information and in the future it will probably be the same. So could you use your Hack on the Fly to "get a mark" of a specific user? That would allow you to pose as that person in the host.

[Stainless Steel Devil Rat]

Xenon is right in that the Social skills won't help against IC.  Mechanically, IC makes Matrix Perception tests.  See the sidebar on pg. 235 regarding the sorts of things IC can learn by inspecting your icon. The last action you performed (if it was illegal) and programs you're actively running can tip the Host off that you're probably a Hacker, although in certain contexts other things may also be suspicious (maybe the IC notices that your commcode is Hackerman3000@Shadohack.horizon and that really doesn't look like what the company employees' commcodes would look like, even though you made your Persona Icon conform with employee Icon standards..)

However, social skills ARE absolutely useable on Spiders: they're people too, afterall.  And technically, you can't even tell the difference between IC and a Spider until you inspect their Persona anyway and ask that question on a Matrix Perception test. 

All that being said, hackers have ABSOLUTELY good reasons to take Disguise/Con/etc. If you know anything about real life hacking, the primary skill in most hacking is social engineering.  You talk to authorized users, get them to give you their legit credentials, and you use them.  In game terms, tricking an employee to give you their credentials (or, lol, finding them written down on a sticky inside their desk) essentially replaces the Hack on the Fly/Brute Force stage of the hack:  You just log in as the employee, gaining however many Mark(s) the employee is supposed to have (probably just the 1).  Even better, you'll also already have whatever marks on files/devices the employee would have.  You can also use social engineering to find out passcodes the employee uses to bypass File Protection.