Besides, I dont have time and oportunity to consult the rules, How do you strip admin from his privileges.
Last sentence is almost greatest WTF ever?
Interrupt IC action - analyze newly arrived icon: What the fuck? The node didnt even noted that Im loged in, that is how flawless exploit worked, but IC was aware of new icon? That means I raised the alarm? This throws whole hacking rules to thrash bin and becomes GMs wish to roll another handfull of dices.
from the unwired - a security example - playing the way exactly the way I did it.:
Security Example (unwired pg 79)[...]
The node is running Analyze, Encrypt, and a Kitsune IC program. Additionally, the IC is running its own Analyze program, for a total of four programs, well below the sixteenprogram limit of the node.
A hacker has broken the Lair’s encryption,
probed the system, and enters the node.
The node is running Analyze, and makes a single Analyze + Firewall Test to detect the intrusion.
The gamemaster rolls eight dice for the node and gets four hits, missing the hacker’s Stealth by one hit.
The hacker enters the node with a hacked admin account.The Kitsune IC running on the node is
programmed to check out new icons, and it does so. The Kitsune icon greets the intruder and performs a
Matrix Perception Test using its own Analyze program, rolling eight dice in an Opposed Test
against the hacker’s Stealth + Hacking, which is a dice pool of 12. The IC rolls four hits, and the hacker rolls four; with zero net hits, the Kitsune finds nothing suspicious about this new icon, and allows the hacker to operate within the node.
The only difference is that this IC has actually found you.
as for the stripping priviledges:
Al erts (Uniwred pg. 67)[...]A node on alert gains a +4 bonus to its Firewall against the
intruder specified in the alert.
Additionally, all privileges involving
the node itself (such as deactivating programs or agents, rebooting,
editing files, etc.) are no longer automatically allowed to the
trespasser, who must either use the Hacking skill to perform such
actions or Spoof a command from a legitimate user that still has
her permissions intact.