So I only started working on this only a few hours ago but I really got in to it and wrote a LOT. So I think I have something that might be interesting to read and comment on. I put this forward as a starting point for the more experienced people to think about and rework or help me rework as needed.
Computer Rules For House Gaming
Most of this describes the computer systems in fairly general terms. However I have included my thoughts of possible die roll mechanics in parens occasionally. The mechanics section covers some discussion on how abilities are used for computer work and how combat rounds and initiative might be used. Text in italics is examples and contains techy speak. So if you don't understand it don't worry. If your character has the abilities to do it they do.
This system may need to be trimmed down because not everyone will want a representation of computer systems even at this rough level of detail. So some things maybe should be removed so that cracking does not take too much time while other players wait. Another possibly better way to deal with that would be to say that at the GMs discretion they can combine rolls. So you do not have to do 3 rolls to get through 3 layers but instead you just do one at a somewhat higher difficulty (or not higher, if you would have time to reattempt cracks that failed). However in cases where the cracking is going on as part of combat or other action (like a character trying to stop a group of tanks by modifying their engine computers, or a character trying to take control of a car so they can use it to run over enemies). This allows the cracking actions to be interlaced reasonably with the combat.
Computer Systems
A computer system is any computer or group of computers that can be thought of as a unit. For instance, your desktop computer, your cell phone, or one of Google's huge web server clusters are all computer systems. In any of these cases the system is made of a series of layers. These are as follows, from least secure to most:
- No Access (Layer 3)
- This is where everyone starts. You have no usernames or passwords and you cannot access any part of the system except those parts that are public.
You are browsing the web and you access a web page that you were supposed to be able to access and does not require any authentication. - User Access (Layer 2)
- This is where you are if you have a username and password (or equivalent) to access the system but only to do things that the administrators what you to do. You will however often be able to tell who is currently logged in and what programs they are running, but you will probably not be able read their data. You can also of course run any programs you like so you could use the computing power or network access of the computer. There are probably limitations on how much disk space and network bandwidth you can use before your account is disabled automatically.
You are remotely logged into an on-line banking site. You are logged into your desktop computer at home. You are logged into a web server to upload changes to your website. - Root (Layer 1)
- You are a super admin. You can access any data on the system at all (whether it is in RAM or on disk or flowing over the network). You may still be observed by admins. You can create new users and delete users and change what users are allowed to do. You can also change the configuration of the system. You cannot prevent other Root users from logging in. The limitations that apply to users to not apply to you. You can use as much of the resources of the system as you like.
You are the head of IT at a business and have root access to all the servers. You are a Linux hacker and have root on your own home machine. You are tracking the behavior of another cracker that happens to be an admin on this machine.
Take secret data and make it accessible on the web. Reconfigure a car control system to inverse the steering wheel.
DOSing (Denial Of Service Attacking) another computer using the high-bandwidth Internet connection of a computer you have admin access to. - Ring 0 (Layer 0)
- You can do anything at all with the software and data on the system. And you can hide those actions from other people using the computer as long as they are on higher layer (You can hide from Root or higher).
You are the kernel of the operating system. You are a very sneaky cracker who is observing and manipulating the system without anyone else knowing. - Ring -1 (Layer -1)
- You have actually modified the underlying hardware or firmware (including microcode). This means that even people at Ring 0 will not necessarily be able to see what you are doing. Also you can get the hardware to do things it was never designed to do. You can also cause physical damage to the hardware at this level (you cannot at any higher level because the hardware would automatically shutdown if you tried).
You are a really smart hardware designer. You are a cracker who is instead of watching people from inside the kernel you are watching them from the GPU on the graphics card. You could get a CRT monitor to act as a FM radio transmitter.
This structure parallel both the real design of systems and the difficulty of access. Many systems would not have all of these layers, but most network servers or similar systems that must be used by untrusted people (like banking systems or web server or military systems) will have them all. However here are some thoughts on how simpler systems would be built.
- A cars engine control computer would only have: No Access, Ring 0, and Ring -1.
- A Windows XP desktop computer would only have: No Access, Root, Ring 0, and Ring -1.
- A Windows 7, Linux or Mac OSX computer would have at least: No Access, User, Root, Ring 0, and Ring -1.
For systems that are even more secure than banks and military you can duplicate the User and Admin levels as needed. Having more than one of the other layers doesn't make much sense. Also a character may not know exactly what layer they are on all the time. The following can be confused with each other: User, Admin and Root. The lower Rings are easy to identify, so if you are there you will know. Also the farther 2 layers are apart in the stack the less likely they are to be confused. Also in many systems it would be easy to figure out the entire layer structure from the User Layer. Once the player has this they basically have a map and will not get confused unless the system is tricking them in some way.
System Cracking
When you want to get from one layer to the next you must make a roll. These rolls get harder as you go up in layers. Also the abilities needed change.
- No Access → User Access
- This can be done a number of ways, not all will be applicable in call cases: Stealing a username and password from someone, convincing someone to tell you one (Man+something), dumpster diving a password, getting access to a system that is already logged in, password guessing attempts (Int+Comp), using a bug in a public server (this is usually harder). These methods can also be combined. These are mostly around diff. 6.
You sneak into a bank pretending to be a copier repair man but instead of fixing the copier you plug your computer into their network and watch for password and usernames to float by on the wire. You go through the trash looking for a sticky-note with a username and password on it.
You sit in a coffee shop running a fake wireless access point and snooping password from all access. - User Access → Root
- This requires real computer skill. You must find a bug in some piece of software on the system (so you can trick it into giving you root access) (Int+Comp). This is something that people will be watching for you may well set off alarms if you are not very careful. This will be around diff. 8.
You know about a bug in the print server that allows you to run an arbitrary program. This program sets another program in your home directory automatically run as root. Then you run that program to get root access. - Root → Ring 0
- This is similar to the above but you must find a bug specifically in the Operating System Kernel so it is harder to find one. This will be around diff. 9 and cannot even be attempted without at least a Computer of 4.
You know that if a packet is received at the exact same time as a packet is sent, part of the packet that is sent will be executed by the kernel. So you use another computer to send packets in as you send special packets out and after a few million tries (maybe 2 minutes) the send and receive line up in time and the kernel runs your special code that allows you access. - Ring 0 → Ring -1
- This is very different from the others. It actually requires low-level understanding of the hardware not just the software. It requires knowing the hardware better than most hardware designers. That being said it is not actually harder than the previous step. It will be around diff. 8 with Int+Comp limited by Eng (or a specialization of computers in hardware) and cannot even be attempted without at least a Computer of 5.
You use your kernel access to learn exactly what kind of CPU you are running on and you already know exactly how this CPU works. So you send a special command to the CPU and replace a special bit of code that tells it how to execute the kernel and then you load another operating system onto the CPU next to the current one. Your new operating system can see everything that happens on the machine but the old operating system continues to execute never knowing it exists.
You load a program onto the network card allowing you to watch all packets that go in and out without having to run anything on the real CPU. This means that no matter how hard they look no one will see you on the main CPU because you are not there and you covered your tracks.
Computer systems may have a global difficulty that would make all cracking harder on that system because it is better in some way. However in systems that are missing layer (for instance an engine computer) then getting to a given layer will be easier because there are fewer layers to go through (for instance you can go directly from No Access to Ring 0 on an engine computer because there are no layers in between). The difficulty of the moves that go through the missing layers would be GM discretion but two reasonable ways to do it would be to use the move from the table out of the current layer or to use the move from the table into the target layer (the former for easy systems, the latter for harder ones).
Protecting Systems
There are counter attacks for most of the attacks above. The following are a few things that someone could do to protect a system. Some may take time to setup others could be done in a moment. These are just ideas and you would have to in a layer that gives you enough access to do them.
Instant actions (a round or two):
- Cut someones connection to your system. (Wits+Comp or Int+Comp depending on how fast things are moving)
- Setup an out of band connection that cannot is hard to find and hard to cut off. (Int+Comp)
- Search for out of band connections. (Perc+Alert)
- Search for other people on the machine. (Perc+Alert)
- Watch exactly what someone else is doing on the machine. (Perc+Comp or maybe Alert)
- Remove all record of yourself from the computer (Int+Comp).
- Search for traps that might notify someone or something to evict you from the system. (Perc+Alert)
All the search and hide actions (hiding a connection to the computer and looking for connections for instance) are rolled against each other like Perc+Alert vs. Dex+Stealth.
Long term actions (may take from a couple minutes up to a few days):
- Setup a trap that will boot anyone that tries to crack in and will notify you. It will take them some time to reconnect and by then you will be ready to defend against them "in person". (Int+Comp, diff. ~8)
- Set a silent alarm that will alert you when someone cracks into the system. (Int+Comp, diff. 6)
- Set a trap that will counter attack the intruder. (Int+Comp, diff. ~8)
- Audit the system for bugs that could be exploited. (Increase the diff to crack into the system at every level)
- Run a timing attack to see if the system you are on is in a virtual machine and possible crack out of it (Perc+Comp diff. 8). This might even be usable to figure out you are in a virtual environment (like a holodeck or similar) if you also had some science and engineering.
Software
Pieces of software are the tools of cyberspace. They can give you bonuses to any action within a computer but they must be prepared or procured in advance because it takes some time to write them. Depending on how much time and skill is used writing them they may be only usable on specific computers or types of computers or they may be quite general. Examples of tools might be:
- A virus that searches a computer for credit card number and emails then to you.
- A "rootkit" that automatically or semi-automatically cracks into a layer of a system (-1 diff.).
- A general tool kit of tools that are useful and can be used on almost any computer system (+1 die to most computer actions).
- A specialized tool kit that can literally only run on one computer in the entire world (+5 dice).
Different tools will require different skill levels and amounts of time to make. For instance to make a simple tool that sends a crafted packet to a computer would take maybe 5 minutes for someone with computer 3, where as a tool to automatically break into an on-line backing server would take more like 2 months and a computer 5 (and it might still only work sometimes).
Once a tool is written or otherwise procured it can be used as often as you like. Unless someone deletes it off all your storage media and backups (which could be some other hacker).
Basic Connectivity to the Target System
Note that not all computers will be remotely accessible but most will. For instance the computer that controls a nuclear reactor will not be connected to the Internet. However the computers they used to order and track fuel rods almost certainly is (because it needs to integrate with transport services and the like). Also many computer that are not on the Internet are still accessible from some distance. For instance many new cars have wireless tire pressure sensors that the engine computer communicates with so another device could use that channel to get access to a engine computer (although it would need to do some cracking to do more than tell the computer the pressure of the tires).
Note that any wireless or wired connection could be used to crack into a machine, though some might increase the difficulty.
Cryptography
An encrypted message can be decrypted in a few ways:
- Brute force guessing of the recipients decryption key. This requires a huge amount of computer power (trillions of times the power required to encrypt it), but sometimes this might be available and this method is really simple.
- Find a flaw in the encryption system that allows you to guess the decrypted message. This requires a lot of computing power and a lot of computer skills (rolled against the encrypter of the message).
- Getting the real recipient to decrypt it for you or steeling their decryption key. This could involve getting the decrypted message off of the computer that is decrypting it or getting the key by physical or digital theft. Or just convincing them to tell you the decrypted message.
Encrypting a message is much easier. All the you need to do is find a good encryption algorithm (Int+Comp) and run it on the message. If you want to make it extra hard to decrypt by others you could develop an encryption algorithm your self (or check another one to make sure it is good). This is mostly math so it would be Int+Comp limited by Academics and it's really hard so it would be in the diff. 9, threshold 2 range, but the result would be an algorithm that might only be attackable using brute force or non-technological means (but you can't be sure. The attacker might be smarter than you).
There is one unbreakable encryption: Quantum Encryption. But it requires a single continuous fiber optic cable from the sender to the receiver and also a bunch of big lasers and optics. Also it is still sensitive to anything that allows you to get the message either before it was encrypted or after it was decrypted.
Physical Access to a Computer System
If you have physical access to a computer you own it. There is nothing anything can do logically to stop you from getting access to it. However many of the things that you would need to do are very physical (like dropping the computer in liquid nitrogen or putting in a buss monitor) require a lot of hardware abilities. So engineering skill would be needed in addition to computer skill. Also there are still protections like sensors that set off a bomb if the computer is moved or the network is unplugged.
Physical Harm
The act of cracking into a computer is physically fairly safe (at least in the moment of doing it). This is because no computer actions can effect the "real world" directly, so you might be able to make your opponents computer fry itself but unless it already has a bomb wired into it you cannot make it explode and hurt them.
However this all changes when a headjack is used or when you are actually software running on a computer yourself (instead of being a physical being using a computer physically). In these cases you can be directly harmed by digital attacks. That is because your actual brain is now open to attack. This attack would require at least Ring 0 access and would amount to forcing the "hardware" (which could be a bag of gray matter in someones head) to hurt it's self. Obviously characters could build or buy defenses like firewalls that could provide some protection (perhaps increased difficult to "hit" you, or armor dice). Bashing damage could still be soaked with Sta.
Cracking into someones brain requires some deep knowledge of psychology or medicine because brains are quite different from most computers (checks would be limited by Psychology or Medicine). So you are better off using a headjack than uploading your whole mind as software.
Attack actions of this kind could include: (Wits+Comp to "hit")
- Hacking someones brain to increase their body temperature (successes bashing damage).
- Writing random bits across an AIs memory space (2+Int lethal damage)
You can "dodge" attacks using abilities such as:
- Fixing errors that the attacker introduces before they can do harm (Wits+Comp).
- Jumping your entire consciousness to another region memory before the attacker can scramble your state (Wits+Comp)
It may be possible to disconnect at will from the network the attacker is using (for instance by physically pulling your jack out) but this is a huge shock to your system (At least 1 round of stun and maybe some bashing). This applies to both humans with jacks and AIs or uploaded minds that run entirely as software.
Roleplay System Mechanics
Actions
Most computer actions are fairly specialized and very hard to do without tools. So you will have to get a maneuver or background to do them (or a power). Any action may be attempted without tools but it will be at increased difficulty and it will be slower (you cannot do it in a single round). An action that would only take 1 round with a maneuver might take a full minute by hand. This takes the place of weapons that a fighter might carry.
Abilities
The primary still for all computer use is "Computer". However there are several other abilities that are important. Obviously secondary skills could be very useful because of how many separate things have been lumped under Computer.
- Computer: Used for programming and breaking into a computer and covering your tracks once you are in.
- Alertness: Used (especially if specialized) for noticing odd things in computers like traps or triggers or other people in the system who are trying to hide.
- Endurance: If you want to do computer work for many hours on end it will wear your brain down quickly, so endurance checks might be needed. Also you will really have to pee.
- Investigation: For searching through data on a computer. Again specialization in computer forensics or similar will help.
- Culture or Persuasion: Could help getting access to other hackers resources like bot-nets or stolen passwords.
- Engineering: This is used for physical work on computers like connecting devices to the circuits of a running computer. Some things might well be Dex+Eng and not Int at all.
Any action that you have plenty of time to do will use Int, but for any action that is done in a single round of less you will use Wits (because this represents "mental" reflexes). The exceptions to this are actions that use Perc (like looking for an intruder in your system) or actions that have some other obvious attribute (like trying to stay up all night to protect a system, which would be Sta). Actions that are usually Int but are being done fast (like trying to crack from Root to Ring 0 in one round) would be changed to Wits and the character might be required to have a tool.
Combat
If there are multiple people working against each other in a system they will roll initiative and take actions in rounds just like physical combat. A computer cracker should also use an initiative when they are trying to crack during combat (concentration rolls may also be needed in this case).
Learning
A very natural (and universal) power or background for a hacker to get would be the ability to learn from hacking attempts and get a reduction to difficult to work with any system that they have work with before (this includes nearly identical systems, like all Prius from the same year will be considered the same). This power could be either just a good memory so they can always remember the tricks they used before, or it could be an implanted memory module. In the first case it might be reasonable to make the bonus go away if the previous use is more than say a year ago.
Software Maneuvers
Some of the software tools described above make sense as maneuvers. However it also makes sense to allow a character to build tools on the spot of they have a few minutes, so a common power or background might also be allowing the character to temporarily gain maneuvers on the spot (this makes some sense in reality because quickly written tools would probably be very specific to the situation at have and probably also shoddily written, so they would be of no use later).
Some tools might be very complex and hard to build (like a tool kit for cracking into someones brain and modifying their thoughts) so it might make sense to represent them as Backgrounds instead. These could be bought with XP (aka written by the character during downtime) or granted as gifts at some number of dots (software given to them by the powers that be)
Here are some ideas for maneuvers and backgrounds:
- Brain hacking (background): You may do damage to a headjacked opponent by hacking their brain. 2 bashing die per dot. Requires medicine 4.
- Code rewrite attack: You may damage a software based opponent. 5 die lethal.
- Firewall: You may put a firewall at a moments notice. +3 armor dice while you focus on it.
- Code mobility: A software character can move there code to a new machine or location in memory at will. Committed. (+3 dice to dodge)
- Aggressive code mobility: You may move your code into the middle of an opponents code. As code mobility but if you get at least 2 successes over the attacker you deal 3 die bashing damage to them.
- Decoys: You make fake decoys that look like you on the network but are actually dumb drones. +5 dice to dodge but a Perc+Alert may be able to see through it.
- Fork bomb: You sent a virus over to the opponents computer that will use up all or their system resources. Committed, 3+Int bashing damage.
