Does Dracula need an African troll factory?
Probably not … but ...
If you've been following the news, then you may have noticed Russian troll factories popping up again, as Facebook has closed down accounts linked to inauthentic Russian accounts across central Africa. These accounts were being used to influence leadership and political contests, and allegedly are linked to Russian troll magnate Yevgeny Prigozhin, who includes involvement with a PMC, Wagner Group, among his many hobbies. Wagner may, or may not, be a deniable branch of Russia's Ministry of Defense; the MoD and agencies like GRU have been very helpful to Wagner in the past. Prigozhin himself is a good friend of Vladimir Putin - so far as anyone can be said to be friends with Putin.
Troll factories are part of modern political and social life, now. Anything that pops up in your social media feed could be bait, or chum spread by those anonymous thousands of workers who get paid to tell lies.
At about the same time the Facebook story broke, a Polish journalist came out with their own version of life on the troll farm, and the kind of people who work in those misinformation factories:
'A majority of Cat@Net’s employees are understood to be disabled,
allowing the company to derive substantial public subsidies from
Poland’s National Disabled Rehabilitation Fund. According to the
Reporters Foundation, the company has received about 1.5 million zloty
(£300,000) from the fund since November 2015.
“Many of them are really good people – they are compassionate, they do
charity work and engage in social activism in their spare time, but
their disabilities mean that their employment opportunities are
limited,” Pruszkiewicz told the Guardian. “For them it was just work and
that’s it.”'
So, what would the Conspiracy do with a troll factory? What would Dracula want with one?
The answer's twofold, and part of it's obvious. The Conspiracy, and Dracula, need troll farms because they operate in the real world, and need to get influence over public figures, even governments. They're in it for the same reason Putin is - they want to make sure the right people are in power, and those opposed to them are publicly crushed. Is that journalist or political figure getting too close to the truth? Is this government getting a little too bolshy, or is that President displaying an unwelcome independent streak? Time to unleash the dogs of social war.
That's the level of operation which won't really affect the agents, at least not directly. It does affect their bosses, though. Any Network ally or agency contact could get badly bruised or broken by the factories. Imagine what might happen if the Mr. Johnson the agents have been working with up till now suddenly has to deal with troll-inspired internet outrage!
But what about the agents, I hear you ask? How can I, a mere Director, get them with trolls?
Well, consider this: the agents work in the real world too. The high-level bring-down-governments stuff isn't for them, but there's plenty of other ways to troll people into submission, as the internet proves on a daily, even hourly basis. Ask yourself: what does it really mean to have pool points in Law, Occult Studies, Research, and especially High Society?
Ahh, High Society … that entrée into James Bond's shaken-not-stirred world. Anyone with points in High Society exists within High Society. At the very least, they have a milliWheaton's worth of followers on social media accounts. They are seen. Maybe they don't merit a full-color spread in the red tops, or an interview in Vogue, but if some Instagrammer's snapping candids at the club opening, there's a decent chance the agent will be in the background. Or even be the one taking the candids.
A similar but not identical case can be made for those with points in many of the academic abilities. Research is a small world. Anyone with points in that pool probably knows people in that world; they may even have been published in obscure academic journals. Military Science implies military experience, possibly at rank. Law suggests a former career as a lawyer, maybe even in an institution like the JAG or Crown Court. Remember how everyone seems to know James Bond, no matter where he goes? This is why.
If the agents have status, however they have it, that means they have something to lose.
As gamification, consider having Troll Attack as one of the Row One responses on the Conspyramid response sheet. It could be very applicable in Dust games in particular, where the emphasis is on nitty-gritty realism. As an effect, convert the characters' pool in the applicable Investigative ability into the equivalent in Heat gain. So an agent with 2 points High Society immediately gains 2 points Heat, which will remain so long as the internet furor is active. Putting a stop to the attack could provide the agent with Cherry-level Digital Intrusion a chance to shine!
As per p88 of the main book, the Director has the option of increasing this Heat gain depending on circumstances. Is the troll attack the equivalent of informing on the agents with the local law? That's a +1 gain. Did it reach the attention of the equivalent of the national media - ie. is it trending on Twitter or Facebook? That's a further +1 heat - and so on.
The troll attack could also be a very useful clue trail to somewhere the Director wants the agents to go next. 'Funny how all those troll attacks came from Wroclaw, Poland … I wonder if we should check into that.'
So, does the Conspiracy have a troll factory as a full-fledged Node? Eh … probably not. That's too much expensive talent to keep on the payroll for only occasional use. However troll factories are notoriously mercenary, and if there's one thing the Conspiracy's got a lot of, it's cash. It's not like the trolls will be asking questions either. The Poles looking to boost their income rather than survive on disability benefit definitely aren't asking questions.
Plus, the troll factory could link in nicely with the Conspiracy's ultimate goals. Does Dracula intend to gain control over Vladimir Putin, for instance? Then Dracula might choose to get at Putin through his dear friend Prigozhin ...
Enjoy!
Showing posts with label hacking. Show all posts
Showing posts with label hacking. Show all posts
Sunday, 3 November 2019
Sunday, 25 August 2019
The Last Suit You'll Ever Wear (Gumshoe, Night's Black Agents)
I've been tangentially aware of DEF Con for a while, but I began dipping into some of the video panels over the past few weeks. This one is worth watching if you have any interest whatsoever in cyber security. If you don't want to watch it all the way through, scoot to about 30 minutes in. That's the bit I want to talk about today.
This stuff fascinates me. You may have seen the speaker elsewhere, or read his work. He's Jayson E. Street, and he's had articles in Forbes as well as talkathons in Las Vegas. He's an ongoing (if that's the right word) speaker at DEF Con, and there are several videos of his on YouTube. I'm going to quote one sentence from the Forbes article, because it ought to be engraved in words of fire on the beating heart of every IT professional: 'it appears ease of use will once again trump security.'
Now, let's talk about that suit.
"If I am in this suit, I am out to screw you over terribly," says Street. Well, so are your Night's Black Agents. So what is it about the suit?
It does two things.
First, it fits in. Look at that conservative cut. He wouldn't be out of place in any North American business environment, and probably not in most places in Europe. He'd melt here in Bermuda - the waistcoat (vest o'doom) is not your friend in our climate.
Second, it allows him to transport any number of Trojans, horses and otherwise, without suspicion. USB pens, a flashlight that is also a video recorder, you name it. "When I walk into your facility, I am a walking, talking Google street car." Except this street car can leave things behind, like those pens, so he can pick up on your conversation later. Or plug in an external hard drive, if he wants a chunk of data. Bring along a tablet packed with useful apps. Who knows? But it's all hidden there in that vest o'doom, detectable if he goes through some form of X-ray security, or is just plain given a pat-down, but otherwise unseen.
The key to his entire talk, but especially this section, is this: anyone can do what he does. Most of the tools in his vest o'doom are commercially available, particularly in the US. Street bought some of his gear from Think Geek, for crying out loud. I shop at Think Geek (or I used to, anyway). Admittedly I wasn't buying USBs packed with keyloggers, but still ...
So how can we gamify this?
You could treat it as a simple Electronic Surveillance spend, where every 1 point spent buys 2 points Digital Intrusion. That seems a little bland. You could make it a combined spend, by saying that the agent can spend Bureaucracy or Flattery as well as Electronic Surveillance, each point adding to the pool, provided at least 1 point Electronic Surveillance is spent. So 1 point Bureaucracy plus 1 point Electronic Surveillance equals 4 points Digital Intrusion. That's probably enough to crack most OPFOR installations.
As a Cooperative task (p50 main book), assuming the agent with Electronic Surveillance is not at her best dealing with people, it could be: lead character (the one with Flattery/Flirting/Reassurance and Disguise) goes in, and secondary (with Electronic Surveillance) talks the lead through the technical stuff, presumably using an earpiece. So the secondary spends Electronic Surveillance to give the lead a Digital Intrusion pool. Or, using broadly the same trick but with Preparedness, reduce the Difficulty of future Digital Intrusion checks, or reduce the opposition's defensive pools. "Yeah, we thought of that. Which is why I sent Billy in during the day with my special vest o'doom, posing as one of the external audit team. Boy, are they going to be pissed when they find that nasty data stick of mine, plugged into the CFO's desktop!"
Or you could chain it to some Technothriller Monologue, to refresh 4 points Digital Intrusion. This may require some Disguise spends, mind you. "What they don't know will hurt 'em, I think to myself, as I dip into the vest o'doom for another of my specialty pens. This one goes in the CFO's office, this one for the CEO, and, oh, look, is that the exchange server? Let me just pop my tainted data stick in that little beauty."
Or it could be a great way to drop a clue. The agents find a nerdy-looking corpse stuffed behind a dumpster, but whichever goon did the deed didn't search the body thoroughly. Here's this funny vest, and it's stuffed full of data, or maybe it's still receiving output from those special little pens. The agents have to get to the data somehow, but that's their problem.
That's it for now. Enjoy!
This stuff fascinates me. You may have seen the speaker elsewhere, or read his work. He's Jayson E. Street, and he's had articles in Forbes as well as talkathons in Las Vegas. He's an ongoing (if that's the right word) speaker at DEF Con, and there are several videos of his on YouTube. I'm going to quote one sentence from the Forbes article, because it ought to be engraved in words of fire on the beating heart of every IT professional: 'it appears ease of use will once again trump security.'
Now, let's talk about that suit.
"If I am in this suit, I am out to screw you over terribly," says Street. Well, so are your Night's Black Agents. So what is it about the suit?
It does two things.
First, it fits in. Look at that conservative cut. He wouldn't be out of place in any North American business environment, and probably not in most places in Europe. He'd melt here in Bermuda - the waistcoat (vest o'doom) is not your friend in our climate.
Second, it allows him to transport any number of Trojans, horses and otherwise, without suspicion. USB pens, a flashlight that is also a video recorder, you name it. "When I walk into your facility, I am a walking, talking Google street car." Except this street car can leave things behind, like those pens, so he can pick up on your conversation later. Or plug in an external hard drive, if he wants a chunk of data. Bring along a tablet packed with useful apps. Who knows? But it's all hidden there in that vest o'doom, detectable if he goes through some form of X-ray security, or is just plain given a pat-down, but otherwise unseen.
The key to his entire talk, but especially this section, is this: anyone can do what he does. Most of the tools in his vest o'doom are commercially available, particularly in the US. Street bought some of his gear from Think Geek, for crying out loud. I shop at Think Geek (or I used to, anyway). Admittedly I wasn't buying USBs packed with keyloggers, but still ...
So how can we gamify this?
You could treat it as a simple Electronic Surveillance spend, where every 1 point spent buys 2 points Digital Intrusion. That seems a little bland. You could make it a combined spend, by saying that the agent can spend Bureaucracy or Flattery as well as Electronic Surveillance, each point adding to the pool, provided at least 1 point Electronic Surveillance is spent. So 1 point Bureaucracy plus 1 point Electronic Surveillance equals 4 points Digital Intrusion. That's probably enough to crack most OPFOR installations.
As a Cooperative task (p50 main book), assuming the agent with Electronic Surveillance is not at her best dealing with people, it could be: lead character (the one with Flattery/Flirting/Reassurance and Disguise) goes in, and secondary (with Electronic Surveillance) talks the lead through the technical stuff, presumably using an earpiece. So the secondary spends Electronic Surveillance to give the lead a Digital Intrusion pool. Or, using broadly the same trick but with Preparedness, reduce the Difficulty of future Digital Intrusion checks, or reduce the opposition's defensive pools. "Yeah, we thought of that. Which is why I sent Billy in during the day with my special vest o'doom, posing as one of the external audit team. Boy, are they going to be pissed when they find that nasty data stick of mine, plugged into the CFO's desktop!"
Or you could chain it to some Technothriller Monologue, to refresh 4 points Digital Intrusion. This may require some Disguise spends, mind you. "What they don't know will hurt 'em, I think to myself, as I dip into the vest o'doom for another of my specialty pens. This one goes in the CFO's office, this one for the CEO, and, oh, look, is that the exchange server? Let me just pop my tainted data stick in that little beauty."
Or it could be a great way to drop a clue. The agents find a nerdy-looking corpse stuffed behind a dumpster, but whichever goon did the deed didn't search the body thoroughly. Here's this funny vest, and it's stuffed full of data, or maybe it's still receiving output from those special little pens. The agents have to get to the data somehow, but that's their problem.
That's it for now. Enjoy!
Sunday, 21 July 2019
Car Hacking (Night's Black Agents, Dracula Dossier, Esoterrorists)
"By definition, a connected car has more control units, computing power,
lines of code and wireless connections than a “non-connected” car – all
of which make it more susceptible to attacks. By exploiting a weakness, a
hacker could take control of the brake or steering systems, show
incorrect information on the dashboard dials, or grab driver data."
From IIoT World, author Simon Hartley, The State of Auto Cybersecurity: Current Vulnerabilities of Connected Vehicles.
In 2015, Chris Valasek and Charlie Miller grabbed the world's attention by hacking, and gaining control over, a Jeep's dashboard functions from ten miles away. In 2018, the situation hasn't gotten any better. If a vehicle's autonomous or semi-autonomous, it's a cinch it can be controlled remotely. If it can be unlocked and operated via a smartphone app, it's a cinch someone's devised a way to spoof the app and steal the car.
Again, from the article, we're talking about devices that will require code somewhere in the 200 to 300 million line range - basically, a long, long, *long*, technical document. Or, if you like comparing it to literary works, Hamlet to the power of 837,988. That's a lot of stabbings and poison.
Code without mistakes or bugs, of course. Each bug introduces vulnerability. Vulnerabilities can and will be exploited.
That's before you consider that allowing third party software - apps - to have any degree of control over the vehicle means that the app, with all its vulnerabilities, is also a risk factor.
So, for example:
From IIoT World, author Simon Hartley, The State of Auto Cybersecurity: Current Vulnerabilities of Connected Vehicles.
In 2015, Chris Valasek and Charlie Miller grabbed the world's attention by hacking, and gaining control over, a Jeep's dashboard functions from ten miles away. In 2018, the situation hasn't gotten any better. If a vehicle's autonomous or semi-autonomous, it's a cinch it can be controlled remotely. If it can be unlocked and operated via a smartphone app, it's a cinch someone's devised a way to spoof the app and steal the car.
Again, from the article, we're talking about devices that will require code somewhere in the 200 to 300 million line range - basically, a long, long, *long*, technical document. Or, if you like comparing it to literary works, Hamlet to the power of 837,988. That's a lot of stabbings and poison.
Code without mistakes or bugs, of course. Each bug introduces vulnerability. Vulnerabilities can and will be exploited.
That's before you consider that allowing third party software - apps - to have any degree of control over the vehicle means that the app, with all its vulnerabilities, is also a risk factor.
So, for example:
- I need to know where that vampire's been. She always drives that sporty Tesla. OK, spending a point of Digital Intrusion or Electronic Surveillance, whichever the Director thinks suits the task. I'm going to crack the car's GPS with this smartphone app, and see where the Tesla's been for, say, the past week.
- An infotainment system, you say? With a huge touchscreen right in the dash that controls every non-driving function? Well color me impressed. Let's just play with that satellite mapping software … oh, gee, looks like the route you wanted to take is blocked by a car wreck. Best take that recommended detour. No, we haven't set up an ambush there, honest, Hey! I can play videos! Has he got passengers? Cue up that blackmail material, and let's hope his wife is watching.
- No, no, I don't need to have any pools in Digital Intrusion or Electronic Surveillance. I just need to make a Preparedness check, and boom! Here's a sneaky little app I bought off the dark web. Shall we say, a 3-point dedicated Digital Intrusion pool? Why, yes, I think we shall.
- It probably goes without saying, but all these shiny toys need to be updated regularly, a task many users avoid. So known bugs and weaknesses still sneak through, because the necessary defenses weren't installed. Plus, anything that relies on passwords is only as safe as the user lets it be - which often isn't safe at all.
- Oh! I can use this smartphone app to lock and unlock the car, send destination information to the GPS, remotely stop or start the car, send its current location to the app, and run real-time diagnostics. I wonder if that power can be abused in some cunning way …
Of course, all this assumes someone's driving the vehicle. A self-driving car is a different story. This might seem a boon for those bloodsuckers who have to sleep during the day; just add tinted windows and some grave soil, and all your worries drift away. Except if someone's hacked the guidance software then they can tell your car to go, well, anywhere they want. Imagine being delivered to your slayer like a giftwrapped package!
Of course, what's sauce for the goose is good for the gander. Just what are the agents driving these days? A top-of-the-line sportscar, all the better for those thrilling chases? Well, that could be a problem, if the Conspiracy has some half-decent hackers on its side. Maybe it's time to get into vintage muscle cars. It can be tricky to get the parts for a '67 Thunderbird, but at least it won't freak out when someone waves a smartphone at it.
Enjoy!
Sunday, 7 July 2019
Hotel Wi-Fi Horror (Night's Black Agents)
Inspired by this article in the Guardian.
Short version: hotel wi-fi is incredibly insecure. This is partly because the people charged with protecting it are hotel people, who put service before security.
“Hospitality companies,” writes Bloomberg's Patrick Clark, “long saw technology as antithetical to the human touch that represented good service. The industry’s admirable habit of promoting from the bottom up means it’s not uncommon to find IT executives who started their careers toting luggage. Former bellboys might understand how a hotel works better than a software engineer, but that doesn’t mean they understand network architecture.”
Hackers love hotels because that's where people spend money. That means everything's vulnerable, including their credit cards, passport numbers, personal details - pretty much everything guests might have wanted kept secret. Moreover it doesn't stop at one hotel. Hack, say, Marriott in Ohio, and you probably have access to every Marriott in the chain.
The aftershock can be brutal. When Marriott did get hacked, it put at risk 383 million guest records, as well as more than 5 million unencrypted passport numbers and more than 9 million encrypted payment cards.
I imagine most of you reading this have been to at least one sci fi or fantasy convention in your lives. Perhaps you go to several each year. Consider this a warning: you, too, could become a sad statistic in some future article about identity theft. You do have a Virtual Private Network, right?
It doesn't help that most hotels, anxious to keep expenses low, don't bother to upgrade out-of-date systems. Nor do their staff get trained on the best way to avoid trouble. If a customer asks to charge his phone, does the server plug it into the wall, or into the office computer? Are there unsecured, unwatched ports - say, in the bar?
With all that in mind, a scenario seed:
Puttin' On The Ritz
The agents are hired to infiltrate a high-profile hotel IT system, say one of the hotels in the Ritz-Carlton chain. That gives the Director plenty of options, from Washington DC to Tokyo. The client wants any and all data that can be retrieved about guests arriving and departing between a set of dates. Nothing's too trivial; if the hotel records how the guest likes her eggs, then the client wants to know about it.
The agents may believe they're being hired as deniable cut-outs for a major intelligence service, or by a mafia don on the make. If the target is somewhere high-profile, like the Ritz-Carlton Macau, then the agents may be able to work up full profiles about the guests' gambling habits as well.
The job ought to be simple, but there are two problems:
First, there's a guest in the penthouse suite who's very paranoid about security. Her machines are VPN protected, and she takes care not to let her guard down. Her personal assistant seems to be the one in charge; perhaps if the PA could be dealt with, it would be easier to get the data.
Second, Heat jumps through the roof shortly before the hack ends. The agents gain 3 points Heat, with no idea why. Turns out there's a VIP, a Saudi royal, who recently arrived at the hotel, and the VIP's complaining about everything from the olives in his martini to the laughable internet security. The VIP's particularly hot on internet security, because six months ago his identity was stolen and large purchases made with his credit card. The hotel's jumping like a flea on a hot griddle, which is why Heat spiked. If the VIP could be satisfied, things would go back to normal.
One of these two - the penthouse guest or the Saudi royal - has Conspiracy links, but the agents won't find that out until their plotlines have been dealt with. The question is, which?
Or are the agents' mysterious paymasters the ones with Conspiracy links?
Enjoy!
Short version: hotel wi-fi is incredibly insecure. This is partly because the people charged with protecting it are hotel people, who put service before security.
“Hospitality companies,” writes Bloomberg's Patrick Clark, “long saw technology as antithetical to the human touch that represented good service. The industry’s admirable habit of promoting from the bottom up means it’s not uncommon to find IT executives who started their careers toting luggage. Former bellboys might understand how a hotel works better than a software engineer, but that doesn’t mean they understand network architecture.”
Hackers love hotels because that's where people spend money. That means everything's vulnerable, including their credit cards, passport numbers, personal details - pretty much everything guests might have wanted kept secret. Moreover it doesn't stop at one hotel. Hack, say, Marriott in Ohio, and you probably have access to every Marriott in the chain.
The aftershock can be brutal. When Marriott did get hacked, it put at risk 383 million guest records, as well as more than 5 million unencrypted passport numbers and more than 9 million encrypted payment cards.
I imagine most of you reading this have been to at least one sci fi or fantasy convention in your lives. Perhaps you go to several each year. Consider this a warning: you, too, could become a sad statistic in some future article about identity theft. You do have a Virtual Private Network, right?
It doesn't help that most hotels, anxious to keep expenses low, don't bother to upgrade out-of-date systems. Nor do their staff get trained on the best way to avoid trouble. If a customer asks to charge his phone, does the server plug it into the wall, or into the office computer? Are there unsecured, unwatched ports - say, in the bar?
With all that in mind, a scenario seed:
Puttin' On The Ritz
The agents are hired to infiltrate a high-profile hotel IT system, say one of the hotels in the Ritz-Carlton chain. That gives the Director plenty of options, from Washington DC to Tokyo. The client wants any and all data that can be retrieved about guests arriving and departing between a set of dates. Nothing's too trivial; if the hotel records how the guest likes her eggs, then the client wants to know about it.
The agents may believe they're being hired as deniable cut-outs for a major intelligence service, or by a mafia don on the make. If the target is somewhere high-profile, like the Ritz-Carlton Macau, then the agents may be able to work up full profiles about the guests' gambling habits as well.
The job ought to be simple, but there are two problems:
First, there's a guest in the penthouse suite who's very paranoid about security. Her machines are VPN protected, and she takes care not to let her guard down. Her personal assistant seems to be the one in charge; perhaps if the PA could be dealt with, it would be easier to get the data.
Second, Heat jumps through the roof shortly before the hack ends. The agents gain 3 points Heat, with no idea why. Turns out there's a VIP, a Saudi royal, who recently arrived at the hotel, and the VIP's complaining about everything from the olives in his martini to the laughable internet security. The VIP's particularly hot on internet security, because six months ago his identity was stolen and large purchases made with his credit card. The hotel's jumping like a flea on a hot griddle, which is why Heat spiked. If the VIP could be satisfied, things would go back to normal.
One of these two - the penthouse guest or the Saudi royal - has Conspiracy links, but the agents won't find that out until their plotlines have been dealt with. The question is, which?
Or are the agents' mysterious paymasters the ones with Conspiracy links?
Enjoy!
Sunday, 14 April 2019
Espionage FUBAR (GUMSHOE, Night's Black Agents).
This week's post is inspired by recent events in Florida, at the President's member's club Mar-a-Lago.
You've almost certainly seen the reports by now, but a brief recap: a Chinese national was caught by Secret Service agents on Sat 30th March, as she attempted to infiltrate the club with two passports, four cell phones, malware on a data stick, and a laptop with an external hard drive. It's not clear why she was there. The theory being passed around in the papers is that she wanted to infiltrate an event organized by a "spa owner" (alleged whorehouse madam and human trafficker) which was to take place that evening.
It seems remarkably amateurish, especially for China. Given that Mar-a-Lago probably isn't the most secure installation in the world, I'd have thought it'd be much, much easier to suborn a senior staff member at the resort, and keep them on permanent payroll for moments like this. Or even get one of China's people hired as full-time staff. Heck, if all you want to do is put malware on the system, given that Mar-a-Lago's cyber security is probably even shakier than its front door policy, sneaking malware in via someone's Facebook page seems the better bet. Frankly, it sounds more like something North Korea would indulge in, given its penchant for wacky schemes and ambitious hacking.
Gamification coming right up.
Compromised
The Night's Black Agents hear, via Network - so before the media gets it, but only just - that a security breach at a Conspiracy-friendly government locale was foiled by alert security, and that the person responsible was captured, along with a quantity of suspicious items. Director's choice as to what, exactly, was on the agent when they were captured, but suggested kit includes assassination tools (particularly those known to work on vampires), data sticks chock-full of malware, mini cameras and similar surveillance tools. There's enough information for the agents, particularly anyone with Vampirology, to realize that, whoever it was, they knew enough about vampires to take effective countermeasures against them.
The precise location is going to depend on your campaign, but suggested locales are the House of Parliament in London, a high-profile event venue like the British Museum, the Berlaymont Building in Brussels, the Federal Chancellery in Berlin, or the Victoria Palace in Romania.
This raises two red flags for the agents. First: does this mean there's a Node of the Conspiracy operating at that location? Second: who is this luckless infiltrator, and what do they know about the Conspiracy?
To answer that question, the agents are going to have to rescue the infiltrator, or at least take possession of any notes taken from the infiltrator's interrogation. Both will involve sneaking into a National-level installation at the very least, with all the chicanery that implies. However there's a potential big reward on offer, because apart from anything else, whoever sent that infiltrator in will want them back. That means the agents could earn themselves Excessive Funds, or at least one big, fat, favor from a Vampire program like China's Room 452. The agents will need to move very quickly to pull this off, since it's only a matter of time before the infiltrator is put somewhere even the agents can't break into.
For a Dracula Dossier variant, the agent is from Edom, and might even be a Prince. Pearl is the obvious choice, but Tyler and Elvis are strong contenders. If this happened, then Edom will be very eager to get them back. However it raises a third red flag: was the Prince betrayed by a mole within Edom, or is this an elaborate attempt to defect?
Enjoy!
You've almost certainly seen the reports by now, but a brief recap: a Chinese national was caught by Secret Service agents on Sat 30th March, as she attempted to infiltrate the club with two passports, four cell phones, malware on a data stick, and a laptop with an external hard drive. It's not clear why she was there. The theory being passed around in the papers is that she wanted to infiltrate an event organized by a "spa owner" (alleged whorehouse madam and human trafficker) which was to take place that evening.
It seems remarkably amateurish, especially for China. Given that Mar-a-Lago probably isn't the most secure installation in the world, I'd have thought it'd be much, much easier to suborn a senior staff member at the resort, and keep them on permanent payroll for moments like this. Or even get one of China's people hired as full-time staff. Heck, if all you want to do is put malware on the system, given that Mar-a-Lago's cyber security is probably even shakier than its front door policy, sneaking malware in via someone's Facebook page seems the better bet. Frankly, it sounds more like something North Korea would indulge in, given its penchant for wacky schemes and ambitious hacking.
Gamification coming right up.
Compromised
The Night's Black Agents hear, via Network - so before the media gets it, but only just - that a security breach at a Conspiracy-friendly government locale was foiled by alert security, and that the person responsible was captured, along with a quantity of suspicious items. Director's choice as to what, exactly, was on the agent when they were captured, but suggested kit includes assassination tools (particularly those known to work on vampires), data sticks chock-full of malware, mini cameras and similar surveillance tools. There's enough information for the agents, particularly anyone with Vampirology, to realize that, whoever it was, they knew enough about vampires to take effective countermeasures against them.
The precise location is going to depend on your campaign, but suggested locales are the House of Parliament in London, a high-profile event venue like the British Museum, the Berlaymont Building in Brussels, the Federal Chancellery in Berlin, or the Victoria Palace in Romania.
This raises two red flags for the agents. First: does this mean there's a Node of the Conspiracy operating at that location? Second: who is this luckless infiltrator, and what do they know about the Conspiracy?
To answer that question, the agents are going to have to rescue the infiltrator, or at least take possession of any notes taken from the infiltrator's interrogation. Both will involve sneaking into a National-level installation at the very least, with all the chicanery that implies. However there's a potential big reward on offer, because apart from anything else, whoever sent that infiltrator in will want them back. That means the agents could earn themselves Excessive Funds, or at least one big, fat, favor from a Vampire program like China's Room 452. The agents will need to move very quickly to pull this off, since it's only a matter of time before the infiltrator is put somewhere even the agents can't break into.
For a Dracula Dossier variant, the agent is from Edom, and might even be a Prince. Pearl is the obvious choice, but Tyler and Elvis are strong contenders. If this happened, then Edom will be very eager to get them back. However it raises a third red flag: was the Prince betrayed by a mole within Edom, or is this an elaborate attempt to defect?
Enjoy!
Sunday, 23 September 2018
A Nation State Robbing Banks: 80 Million and a Spelling Error (Night's Black Agents)
This post is inspired in part by Kento Bento's video about the biggest bank heist in modern history:
You may remember me mentioning this bank heist before, back in 2016 when not all the facts were in.
A couple quick points before I dive into Lazarus. Night's Black Agents Directors and agents wondering if Human Terrain is useful, wonder no more. Think about how cleverly this whole thing had to be coordinated: the thieves knew if they hit this particular bank on this particular day, and then transferred the stolen money to a bank in the Philippines, they'd be in the clear. Bangladesh, being Muslim majority, had its weekend on Friday and Saturday. The hack starts Friday. They come in on Sunday to sort out their problems, but they can't talk to their colleagues in New York because, on Sunday, their Christian colleagues are all off for the day. Monday works, but the bank in the Philippines, where the money is sent, is celebrating Chinese New Year, so it can't be contacted. That was fiendishly clever timing on someone's part.
Two, you may remember me mentioning a missing IT expert in the previous post. That expert, Tanveer Hassan Zoha, did turn up eventually. Detectives found him wandering near the airport and took him home, six days after he went missing. The IT expert claimed he could discover the identity of some of the culprits, and went with special police to the Bangladesh bank to have a look at the bank's records. Two days after that he was abducted from an auto rickshaw, and his family claimed the police were no help finding him. As far as I can determine his abductors were not caught. If he ever issued a public statement about his abduction, he didn't make it in an English language publication, as far as I know.
Bangladesh Airport connects to Hong Kong via Cathay Dragon, and Hong Kong is only a ferry ride away from Macau. That's where the alleged thieves went - it was a stopping point on their journey to North Korea, according to Kento Bento.
Which brings me to Lazarus Group, an entity that has been committing cybercrime since the early 2000s. Its earliest known attacks targeted South Korea, and it's alleged that the group has links to the North Korean government. This is difficult to prove, and might be a fake-out to throw blame on a believable straw man. That said, if anyone's going to think it's a good idea to back a group of crooks on a cybercrime spree, it's the dictator who may have poisoned his half-brother at an airport shopping concourse.
Lazarus has hit banks before, but banks aren't its only focus. It likes to hit South Korean targets, and allegedly was responsible for the Sony hack in 2014. The group demanded Sony withdraw its film The Interview, a comedy about an attempt on Kim Jong-un's life.
The Interview had so-so reviews and according to IMDB lost a ton of money - budget $44 million, worldwide gross something in the region of $12 million. Sony pulled the film from theatres in December 2014, allowing only a limited independent cinema release, and that after President Obama criticized Sony for giving in to terrorist threats.
Cybercrime experts Kaspersky Labs analyzed the Bangladesh hack, and give Kaspersky praise because it has nailed down the perfect hacking mini-scenario for Night's Black Agents Directors.
Initial Compromise. A single system inside the bank is breached with remotely accessible vulnerable code, perhaps through a webserver or a watering hole on a seemingly trustworthy website. The premise is simple: find a site you know the target visits, like a Chinese takeaway. The security on that site is bound to be less robust than the target's IT. Break it, infect it, wait for your target to visit - and the mouse takes the cheese. Snap!
Foothold Established. The group establishes persistent backdoors so they can come and go as they like.
Internal Reconnaissance. The groups spends days, weeks, learning the network and identifying useful resources, like a backup server with vital information or an email server that can let the hackers into anything connected to that server. With the Bangladesh hack, Lazarus was particularly interested in SWIFT authentication, so it went after any server that might contain SWIFT authorization codes as well as IT admin systems.
Deliver and Steal. The great hack begins. Presumably followed by a scene Kaspersky does not mention, tentatively titled RUN AWAY!
This is the perfect breakdown for scenes in a game. What's more, they don't have to be about Digital Intrusion and nothing else. Human Terrain, Surveillance, Infiltration, Electronic Surveillance, potentially Flattery, Bureaucracy - all these will be useful, particularly in the early stages of the hack.
I see this as a potential Thrilling Digital Intrusion contest, starting with the initial compromise and moving through to final execution. The technothriller dialogue opportunities, particularly in the Initial Compromise or Internal Reconnaissance, are fascinating. It's a reminder that a Thrilling Contest doesn't have to be over in a few minutes. This one takes months - though at the table on the day the whole thing might take an hour's game time at most.
As for North Korea, well … it'd make a hell of a Node.
Enjoy!
You may remember me mentioning this bank heist before, back in 2016 when not all the facts were in.
A couple quick points before I dive into Lazarus. Night's Black Agents Directors and agents wondering if Human Terrain is useful, wonder no more. Think about how cleverly this whole thing had to be coordinated: the thieves knew if they hit this particular bank on this particular day, and then transferred the stolen money to a bank in the Philippines, they'd be in the clear. Bangladesh, being Muslim majority, had its weekend on Friday and Saturday. The hack starts Friday. They come in on Sunday to sort out their problems, but they can't talk to their colleagues in New York because, on Sunday, their Christian colleagues are all off for the day. Monday works, but the bank in the Philippines, where the money is sent, is celebrating Chinese New Year, so it can't be contacted. That was fiendishly clever timing on someone's part.
Two, you may remember me mentioning a missing IT expert in the previous post. That expert, Tanveer Hassan Zoha, did turn up eventually. Detectives found him wandering near the airport and took him home, six days after he went missing. The IT expert claimed he could discover the identity of some of the culprits, and went with special police to the Bangladesh bank to have a look at the bank's records. Two days after that he was abducted from an auto rickshaw, and his family claimed the police were no help finding him. As far as I can determine his abductors were not caught. If he ever issued a public statement about his abduction, he didn't make it in an English language publication, as far as I know.
Bangladesh Airport connects to Hong Kong via Cathay Dragon, and Hong Kong is only a ferry ride away from Macau. That's where the alleged thieves went - it was a stopping point on their journey to North Korea, according to Kento Bento.
Which brings me to Lazarus Group, an entity that has been committing cybercrime since the early 2000s. Its earliest known attacks targeted South Korea, and it's alleged that the group has links to the North Korean government. This is difficult to prove, and might be a fake-out to throw blame on a believable straw man. That said, if anyone's going to think it's a good idea to back a group of crooks on a cybercrime spree, it's the dictator who may have poisoned his half-brother at an airport shopping concourse.
Lazarus has hit banks before, but banks aren't its only focus. It likes to hit South Korean targets, and allegedly was responsible for the Sony hack in 2014. The group demanded Sony withdraw its film The Interview, a comedy about an attempt on Kim Jong-un's life.
The Interview had so-so reviews and according to IMDB lost a ton of money - budget $44 million, worldwide gross something in the region of $12 million. Sony pulled the film from theatres in December 2014, allowing only a limited independent cinema release, and that after President Obama criticized Sony for giving in to terrorist threats.
Cybercrime experts Kaspersky Labs analyzed the Bangladesh hack, and give Kaspersky praise because it has nailed down the perfect hacking mini-scenario for Night's Black Agents Directors.
Initial Compromise. A single system inside the bank is breached with remotely accessible vulnerable code, perhaps through a webserver or a watering hole on a seemingly trustworthy website. The premise is simple: find a site you know the target visits, like a Chinese takeaway. The security on that site is bound to be less robust than the target's IT. Break it, infect it, wait for your target to visit - and the mouse takes the cheese. Snap!
Foothold Established. The group establishes persistent backdoors so they can come and go as they like.
Internal Reconnaissance. The groups spends days, weeks, learning the network and identifying useful resources, like a backup server with vital information or an email server that can let the hackers into anything connected to that server. With the Bangladesh hack, Lazarus was particularly interested in SWIFT authentication, so it went after any server that might contain SWIFT authorization codes as well as IT admin systems.
Deliver and Steal. The great hack begins. Presumably followed by a scene Kaspersky does not mention, tentatively titled RUN AWAY!
This is the perfect breakdown for scenes in a game. What's more, they don't have to be about Digital Intrusion and nothing else. Human Terrain, Surveillance, Infiltration, Electronic Surveillance, potentially Flattery, Bureaucracy - all these will be useful, particularly in the early stages of the hack.
I see this as a potential Thrilling Digital Intrusion contest, starting with the initial compromise and moving through to final execution. The technothriller dialogue opportunities, particularly in the Initial Compromise or Internal Reconnaissance, are fascinating. It's a reminder that a Thrilling Contest doesn't have to be over in a few minutes. This one takes months - though at the table on the day the whole thing might take an hour's game time at most.
As for North Korea, well … it'd make a hell of a Node.
Enjoy!
Sunday, 5 June 2016
Secure Correspondence (Night's Black Agents, Dracula Dossier)
Just a quick one this week, to give Night's Black Agents Directors a nifty new way to correspond with agents in the field.
This is based on Stephen Leather's book Black Ops. One of these days I'm going to have to do a Not Quite Book Review on Leather; he's a lot of fun. British, used to be a journo for the Daily Mirror, been writing novel length fiction (meow) since 1997, and he's good at it, in a mannered and clever kind of way. Stephen King once said of horror maestro James Herbert that Herbert's work had a 'raw urgency,' the kind that grabbed you by the lapels and screamed in your face. By that scale, Leather stands in your way and speaks both loudly and firm, but doesn't quite reach the same level of urgency.
From a Night's Black Agents perspective Leather's most useful quality is that he writes both spy fiction and horror. Black Ops is pure spy fiction, starring Leather's recurring not-Bond, 'Spider' Shepherd, former SAS and policeman turned spy. What I want to talk about today is a neat little trick used by some of the characters in that novel to communicate, and how easy it would be to use that trick in game.
Secure communication via email is always a problem. Experts say that email is by its very nature insecure. Companies like Lavabit or SilentCircle used to say they could secure their transmissions, but they don't make that claim any more. SilentCircle went so far as to smash its own servers rather than hand them over to the authorities. The metadata - who sent the email, when, and to whom - is always vulnerable, SilentCircle's CEO pointed out as the servers went silent.
But what if there was no metadata?
Black Ops' spy handler has a simple procedure. Create an email identity - let's say cushing1913 - on a service like outlook. Make sure both the handler and the agent knows the identity and the password. Then, when messages need to be delivered, create an email, but don't send it; save it to drafts instead. Alert the other party that there's a message, say by text message. The other party logs on to the email address, checks drafts, reads the message and then deletes it.
Nothing was ever sent, therefore there is no metadata. By saving it in drafts you don't even need to specify a receiving email addy. Theoretically the email client can be hacked, but so long as the sender and receiver promptly check and destroy messages as soon as they can, there's a very small window of opportunity for hackers to intercept messages.
I very much doubt it's foolproof, but it's a fascinating glimpse into workable tradecraft. One of Leather's greatest strength is that he bothers to find out how things work, and then weaves that knowledge into the narrative without being too obvious about it. No long lectures, no technobabble, just a quick but thought-provoking glimpse into a working system, and then on with the show.
From a Director's perspective the utility is obvious. Anyone can create an outlook identity. It costs no money and very little time to set one up. Once you've done that, cushing1913 - it might be Dracula Dossier's Harker, Hopkins, or someone else - can send messages to agents in the field in real time. It's the perfect means of sending scanned documents, like anything from the Hawkins Papers, to the players. Or bits of the Dossier itself, or instructions, or what-have-you.
It's ingenious, simple, and free. What's not to like?
This is based on Stephen Leather's book Black Ops. One of these days I'm going to have to do a Not Quite Book Review on Leather; he's a lot of fun. British, used to be a journo for the Daily Mirror, been writing novel length fiction (meow) since 1997, and he's good at it, in a mannered and clever kind of way. Stephen King once said of horror maestro James Herbert that Herbert's work had a 'raw urgency,' the kind that grabbed you by the lapels and screamed in your face. By that scale, Leather stands in your way and speaks both loudly and firm, but doesn't quite reach the same level of urgency.
From a Night's Black Agents perspective Leather's most useful quality is that he writes both spy fiction and horror. Black Ops is pure spy fiction, starring Leather's recurring not-Bond, 'Spider' Shepherd, former SAS and policeman turned spy. What I want to talk about today is a neat little trick used by some of the characters in that novel to communicate, and how easy it would be to use that trick in game.
Secure communication via email is always a problem. Experts say that email is by its very nature insecure. Companies like Lavabit or SilentCircle used to say they could secure their transmissions, but they don't make that claim any more. SilentCircle went so far as to smash its own servers rather than hand them over to the authorities. The metadata - who sent the email, when, and to whom - is always vulnerable, SilentCircle's CEO pointed out as the servers went silent.
But what if there was no metadata?
Black Ops' spy handler has a simple procedure. Create an email identity - let's say cushing1913 - on a service like outlook. Make sure both the handler and the agent knows the identity and the password. Then, when messages need to be delivered, create an email, but don't send it; save it to drafts instead. Alert the other party that there's a message, say by text message. The other party logs on to the email address, checks drafts, reads the message and then deletes it.
Nothing was ever sent, therefore there is no metadata. By saving it in drafts you don't even need to specify a receiving email addy. Theoretically the email client can be hacked, but so long as the sender and receiver promptly check and destroy messages as soon as they can, there's a very small window of opportunity for hackers to intercept messages.
I very much doubt it's foolproof, but it's a fascinating glimpse into workable tradecraft. One of Leather's greatest strength is that he bothers to find out how things work, and then weaves that knowledge into the narrative without being too obvious about it. No long lectures, no technobabble, just a quick but thought-provoking glimpse into a working system, and then on with the show.
From a Director's perspective the utility is obvious. Anyone can create an outlook identity. It costs no money and very little time to set one up. Once you've done that, cushing1913 - it might be Dracula Dossier's Harker, Hopkins, or someone else - can send messages to agents in the field in real time. It's the perfect means of sending scanned documents, like anything from the Hawkins Papers, to the players. Or bits of the Dossier itself, or instructions, or what-have-you.
It's ingenious, simple, and free. What's not to like?
Sunday, 20 March 2016
80 Million and a Spelling Error: Hacking (Night's Black Agents)
When I was just starting out as a low level employee for a financial institution I shall not name, a senior staff member was caught with his fingers in the electronic till. He rigged the system so that, every so often, dormant accounts or trust funds would deposit a trifling amount of money in his personal account. It was never much more than a few dollars, even cents, at a time, but spread over many accounts and over a long period of time those small sums added up to one big payout. He was caught when he went to lunch one day and forgot to lock his machine. Someone came into his office to drop something off, noticed the suspicious activity on his monitor, and passed it on to the higher-ups. It became a police matter very soon after that.
I was reminded of him when I read about the $80 million heist carried out electronically via the Bangladesh Bank. His scheme wasn't original, but it paid off big time, and he would have gotten clean away had he not made a very simple mistake, the kind of error we all make every day. Not quite cautious enough, not quite careful or suspicious enough, and it's game over. It's stories like these that have me paying cash rather than electronic POS whenever I can.
If you haven't already read this one: sophisticated criminals ripped off the central bank of Bangladesh, breaching its systems and then sending requests for money transfer to the US Fed, where Bangladesh Bank had billions stored. Several transfers took place, only for the whole thing to come crashing to a halt when someone misspelled the word Foundation as Fandation on one of the request forms. If that request had gone through the gang - and given the level of preparation it probably was a gang - would have made off with at least a billion, and probably more, since there's no reason to think they would have stopped until Bangladesh's accounts were empty. An IT expert who publicly voiced suspicion that apathetic bank officials had, at the very least, contributed to the caper through their negligence has gone missing. The bank's governor resigned; apparently his employees failed to tell him what had happened, and he only found out about the heist when it hit the papers. Though the bank has said it expects to recover some of the money it seems likely that the bandits will make a clean getaway. Most of it went to casinos in the Philippines, presumably so it could be efficiently laundered, and as a consequence the Philippines may once again be blacklisted by the Money Laundering Task Force. This is all the more important for the Philippines because there are elections coming in May; this kind of news is the last thing the ruling Liberal party needs. At least $30 million in cash ended up in the hands of an ethnic Chinese in Manila, but as for the rest, it could be anywhere.
So what does this story tell us about what it takes to be a hacker in Night's Black Agents?
To begin with, as discussed in last week's post on black baggers, you have to know a lot about human nature and how organizations work. Whoever did this had to know how Bangladesh Bank operated. They probably studied the habits of bank employees for some time before making a move, both in the real world and via keylogger virus or similar on their work machines. They knew when to strike, and how, for maximum impact.
This has been the case since time immemorial, which in computer terms goes back all the way to last week Tuesday. I have on my bookshelf Secrets of a Super Hacker by someone writing under the pseudonym Knightmare. It's hopelessly out of date from a technical perspective - if ever I want to know how to cut up an 8 inch floppy, Knightmare has me covered - but its lessons on interpersonal interaction and information finding are still very relevant. One chapter's devoted to social engineering, another to reverse social engineering, and he spends a remarkable amount of time discussing the joys of dumpster diving and how information found in the trash can help you pillage companies' accounts.
Speaking of, I wonder what Bangladesh Bank did with its trash. Even today banks generate so much paper, reams of physical data. You'd like to think it was all shredded, pulped or otherwise rendered unreadable. But maybe not; after all, Kapersky Labs has a very beautiful interactive map that claims Bangladesh is, at time of writing, the 41st most attacked country in the world. These things don't happen by chance. That same map says Russia is #1 - not an award to be proud of, hope those nuclear silos are doing just fine - Vietnam is #3, the US is #2, and most of Europe seems to be hovering in the 10s and 20s. Apart from Norway, Sweden and Finland, which are #133, #87 and #149. Come on, guys, Finland's not that bad. I know some great Finns. Don't be shy. Bear in mind this is real time data, so by the time you read this everything will have changed, with the possible exception of the top 2.
Incidentally, Kapersky, I notice Bermuda doesn't even feature on the map. Way to hurt my feelings, fellas.
So we're looking at Bureaucracy, Human Terrain, and probably Reassurance to reflect social engineering, and Urban Survival for those dumpster diving expeditions. The hacker is an urban animal; no hiking through the piney woods and living off fresh caught fish or beef jerky for this bunch. A decent Infiltration pool might also be helpful, for breaking into installations and making off with the contents of the shredder. With enough dedication almost anything can be pieced back together. It isn't about whether it can be done, but rather if it's worth the effort. Research is a must, as is Traffic Analysis. Depending on whether or not the hacker makes a dishonest crust by, say, fleecing banks in Bangladesh, or catching those who do, points in Streetwise or Criminology might be in order.
While the hacker is probably the least athletically inclined of all the Night's Black Agents types, it would be a very foolish player who didn't put some points in self defense. However pools in Mechanics and Surveillance are more likely. You're the one who watches, not the one who goes in with a cosh and a black bag.
With all that in mind, consider this example:
Kayo
One sentence: Former Nollywood actor and con artist shooting for the big leagues.
Investigative: Accounting 1, Bureaucracy 1, Bullshit Detector 3, Cryptography 1, Data Recovery 2, Electronic Surveillance 2, Human Terrain 2, High Society 1, Research 1, Traffic Analysis 1, Reassurance 2, Languages 2, Streetwise 1, Urban Survival 1
General: Athletics 8, Cover 10, Digital Intrusion 15, Disguise 6, Health 8, Infiltration 10, Mechanics 4, Network 15, Shooting 8 (base 14, with special weapons training), Stability 7, Surveillance 5, Sense Trouble 1.
MOS: Digital Intrusion (silly not to, really).
Cherries: Athletics (Parkour), Digital Intrusion (cracker's cryptid), Infiltration (open sesame), with special weapons training in the AK47. I picture this as an actor's conceit, for when Kayo decides to relive his glory days in Mafia Soldiers or the like.
As has become traditional, let's end this with a scenario seed:
A not for profit has announced a competition, the Shreddathon Challenge, to see who can be the first to piece together five sets of shredded documents, with $50,000 going to the winner. One team, the Hatfall Brigade, was coming very close to this goal with its specially designed computer program, but just as the final pieces were coming together three of the five programmers were brutally murdered, and the program was stolen. Shortly afterward the hacking community discovers that the not for profit hosting the challenge only ever existed in cyberspace; its backers have disappeared. What happened to the team, and what was the Shreddathon Challenge really all about?
I was reminded of him when I read about the $80 million heist carried out electronically via the Bangladesh Bank. His scheme wasn't original, but it paid off big time, and he would have gotten clean away had he not made a very simple mistake, the kind of error we all make every day. Not quite cautious enough, not quite careful or suspicious enough, and it's game over. It's stories like these that have me paying cash rather than electronic POS whenever I can.
If you haven't already read this one: sophisticated criminals ripped off the central bank of Bangladesh, breaching its systems and then sending requests for money transfer to the US Fed, where Bangladesh Bank had billions stored. Several transfers took place, only for the whole thing to come crashing to a halt when someone misspelled the word Foundation as Fandation on one of the request forms. If that request had gone through the gang - and given the level of preparation it probably was a gang - would have made off with at least a billion, and probably more, since there's no reason to think they would have stopped until Bangladesh's accounts were empty. An IT expert who publicly voiced suspicion that apathetic bank officials had, at the very least, contributed to the caper through their negligence has gone missing. The bank's governor resigned; apparently his employees failed to tell him what had happened, and he only found out about the heist when it hit the papers. Though the bank has said it expects to recover some of the money it seems likely that the bandits will make a clean getaway. Most of it went to casinos in the Philippines, presumably so it could be efficiently laundered, and as a consequence the Philippines may once again be blacklisted by the Money Laundering Task Force. This is all the more important for the Philippines because there are elections coming in May; this kind of news is the last thing the ruling Liberal party needs. At least $30 million in cash ended up in the hands of an ethnic Chinese in Manila, but as for the rest, it could be anywhere.
So what does this story tell us about what it takes to be a hacker in Night's Black Agents?
To begin with, as discussed in last week's post on black baggers, you have to know a lot about human nature and how organizations work. Whoever did this had to know how Bangladesh Bank operated. They probably studied the habits of bank employees for some time before making a move, both in the real world and via keylogger virus or similar on their work machines. They knew when to strike, and how, for maximum impact.
This has been the case since time immemorial, which in computer terms goes back all the way to last week Tuesday. I have on my bookshelf Secrets of a Super Hacker by someone writing under the pseudonym Knightmare. It's hopelessly out of date from a technical perspective - if ever I want to know how to cut up an 8 inch floppy, Knightmare has me covered - but its lessons on interpersonal interaction and information finding are still very relevant. One chapter's devoted to social engineering, another to reverse social engineering, and he spends a remarkable amount of time discussing the joys of dumpster diving and how information found in the trash can help you pillage companies' accounts.
Speaking of, I wonder what Bangladesh Bank did with its trash. Even today banks generate so much paper, reams of physical data. You'd like to think it was all shredded, pulped or otherwise rendered unreadable. But maybe not; after all, Kapersky Labs has a very beautiful interactive map that claims Bangladesh is, at time of writing, the 41st most attacked country in the world. These things don't happen by chance. That same map says Russia is #1 - not an award to be proud of, hope those nuclear silos are doing just fine - Vietnam is #3, the US is #2, and most of Europe seems to be hovering in the 10s and 20s. Apart from Norway, Sweden and Finland, which are #133, #87 and #149. Come on, guys, Finland's not that bad. I know some great Finns. Don't be shy. Bear in mind this is real time data, so by the time you read this everything will have changed, with the possible exception of the top 2.
Incidentally, Kapersky, I notice Bermuda doesn't even feature on the map. Way to hurt my feelings, fellas.
So we're looking at Bureaucracy, Human Terrain, and probably Reassurance to reflect social engineering, and Urban Survival for those dumpster diving expeditions. The hacker is an urban animal; no hiking through the piney woods and living off fresh caught fish or beef jerky for this bunch. A decent Infiltration pool might also be helpful, for breaking into installations and making off with the contents of the shredder. With enough dedication almost anything can be pieced back together. It isn't about whether it can be done, but rather if it's worth the effort. Research is a must, as is Traffic Analysis. Depending on whether or not the hacker makes a dishonest crust by, say, fleecing banks in Bangladesh, or catching those who do, points in Streetwise or Criminology might be in order.
While the hacker is probably the least athletically inclined of all the Night's Black Agents types, it would be a very foolish player who didn't put some points in self defense. However pools in Mechanics and Surveillance are more likely. You're the one who watches, not the one who goes in with a cosh and a black bag.
With all that in mind, consider this example:
Kayo
One sentence: Former Nollywood actor and con artist shooting for the big leagues.
Investigative: Accounting 1, Bureaucracy 1, Bullshit Detector 3, Cryptography 1, Data Recovery 2, Electronic Surveillance 2, Human Terrain 2, High Society 1, Research 1, Traffic Analysis 1, Reassurance 2, Languages 2, Streetwise 1, Urban Survival 1
General: Athletics 8, Cover 10, Digital Intrusion 15, Disguise 6, Health 8, Infiltration 10, Mechanics 4, Network 15, Shooting 8 (base 14, with special weapons training), Stability 7, Surveillance 5, Sense Trouble 1.
MOS: Digital Intrusion (silly not to, really).
Cherries: Athletics (Parkour), Digital Intrusion (cracker's cryptid), Infiltration (open sesame), with special weapons training in the AK47. I picture this as an actor's conceit, for when Kayo decides to relive his glory days in Mafia Soldiers or the like.
As has become traditional, let's end this with a scenario seed:
A not for profit has announced a competition, the Shreddathon Challenge, to see who can be the first to piece together five sets of shredded documents, with $50,000 going to the winner. One team, the Hatfall Brigade, was coming very close to this goal with its specially designed computer program, but just as the final pieces were coming together three of the five programmers were brutally murdered, and the program was stolen. Shortly afterward the hacking community discovers that the not for profit hosting the challenge only ever existed in cyberspace; its backers have disappeared. What happened to the team, and what was the Shreddathon Challenge really all about?
Sunday, 31 January 2016
Hacking Invisible Inc (Klei)
I was going to talk about something else this week, but I've been ambushed by Klei's stealth roguelike Invisible Inc. I don't know what to think about what just happened. I'm not even sure it happened. So I'm going to write about it here in hope I'll get a better understanding by explaining it.
Bear in mind that a large chunk of this post is going to be blocked out because it contains spoilers. I'm sorry about that, but there's no other way. Also, I'm not going to go over the gameplay, since I covered all that in Not Quite Review Corner.
This relates to the DLC release Contingency Plan.
I'm playing through on Expert, and have finished the midway extra mission, where the objective is to recover a McGuffin from the field to keep AI Incognita alive. Breathe a sigh of relief, since this is way more difficult than I had anticipated, and on to the missions after that.
The story adds a further 48 hours to your search, and requires you to recover an extra piece of special loot each mission before you can escape. So I'm already on a tight deadline, and now I have something else to worry about. Oh goody!
One of the next missions I tackled was a Cybernetics Lab, Sankaku, level 4 difficulty. The team that went in was Sharp, Banks (my starting team) and Shalem 11 (rescued). I don't know if that makes a difference or not, but I mention it for what it's worth.
Spoilers incoming!
Early in the mission I discover a special computer terminal. That terminal, Mother informs me, has information that the corps looted from Invisible Inc when we were raided. There are three terminals on the level, and I need to hack and download the data from all three to complete this side mission. Not a problem, I think to myself. So Shalem starts tackling the first, and Sharp and Banks go off looking for the other two.
Bear in mind, though this is early in the mission, it's taken me a couple turns to get to this point. I'm still on alarm level 0, mind you, but the point is that time has passed. It's been maybe 3 to 8 minutes since I booted the game.
Shalem begins the hack. Sharp finds the second terminal soon afterward, and starts work on it. Then Mother tells me that, after I hack each terminal, she'll insert a worm onto Sankaku's systems.
And then the game starts singing to me.
I nigh on flipped. I don't know what it was; some generic triumphal rock, I think, with cheers and so on. At first I thought I'd somehow left YouTube on and it was playing in the background. But that made no sense; remember, it had been several minutes since I booted the game, and if it was YouTube I would have expected it to kick in much sooner.
Then I decide it's the game itself. I didn't recognize the music it was playing, and I convinced myself that this was because it was some work for hire stuff that Klei bought specially. OK, funny, heart attack over; Banks, go find the third terminal.
That's when I hear a voice stab from Valve's Team Fortress 2, the Soldier. I'm pretty sure he said Maggot! which is his favorite voice stab; it caught me completely off guard. Then the music changes to I'll Make A Man Out of You, from Disney's Mulan.
By this point I am utterly, utterly baffled. A work for hire might explain the earlier music, but persuading Disney to part with its tunes is no easy thing, and would probably cost more money than Klei has ever had. I know there's at least one YouTube short that mashes Valve's TF2 with that particular Mulan tune, and there may well be others for all I know, but this particular combination isn't one I recognize.
I'm also laughing like a hyena on crack, but that's just by the by.
Once Banks cracks the third terminal and takes the data, the music stops. Down to business! Where's the cybernetics lab? Found it. Where's the exit? Found it! Job done?
No, of course it isn't bloody done, because with all this theme tune business I've completely forgotten the special loot. It's hidden way off in a corner of the map I can't easily get to, and now I'm on alarm level 4. Sod! Sod sod monkey bollocks, run run run!
OK, now I have the special loot and am making my way back. Shalem is moving very slowly because he's carrying a very heavy weapon, so he's back near the exit. Sharp and Banks are the ones out in the field, but they're about as far away from the exit as it is possible to be.
I hit alarm level 6.
The bloody game starts playing the Beatles, Hey Jude.
Talk about take a sad song and make it better. 'Hey Jude, don't let me down'? You cheeky bastard. I'm dying over here. I've never had to play so skillfully to get my people to the exit, trying not to hack the big tank drone since it has a Validate daemon on it, which means if it goes down yet another guard will be summoned to the level and I'm up to my armpits in guards anyway ... it all gets very messy. I prefer not to kill the guards if I can help it but this time I was positively overjoyed to shoot one of the buggers.
Hey Jude follows me all the way to the exit, and my team extracts safely.
Once I'm out, I log off. That's when I discover that there really is a pop-up, a video player, and it has been playing in the background.
I don't know what to think. Was it Klei? Was it an accident? It wasn't YouTube, that much I do know, but as for the rest of it, I'm completely and utterly in the dark.
Let's say it was Klei. Well, it implies that Klei hacked my PC. Though hacked may be too strong a word, since if that is what happened, I'd bet money I gave Klei permission. Not that I'd know it. It'd be buried somewhere in the User Agreement, right next to the bit that talks about Germany's potato exports, since Klei knows full well nobody reads those things.
I don't know where it would stand legally. All it did was open a video player, which then played some music. I could do that myself if I liked. In fact, I am; as I type this I have Hey Jude playing in the background.
If it was anyone else, I'd say it didn't happen. But this is Klei. The game is about hacking computers, and one of the achievements notoriously forces you to hack the game files to get the achievement. In fact until the DLC dropped it was the one achievement I didn't have, since I lack the skills and in any case didn't really want to mess with the game.
In short, if anyone would do this, Klei would. I'd bet anything on that. I don't know how I'd prove Klei did do it, mind you. Presumably if I went poking around in the game files I'd eventually find the code that set this up, but I don't know how to do that, and in any case doing so feels a little too much like telling the magician how the rabbit was pulled out of the hat. You don't want to do that. You go to a magic show to see magic, not to be an arse about the show.
So, Klei? If this was you, hat's off. An utterly brilliant idea, and it worked perfectly.
And if it wasn't you, I don't know what the hell happened.
Postscript: I don't know what to make of this, either.
Bear in mind that a large chunk of this post is going to be blocked out because it contains spoilers. I'm sorry about that, but there's no other way. Also, I'm not going to go over the gameplay, since I covered all that in Not Quite Review Corner.
This relates to the DLC release Contingency Plan.
I'm playing through on Expert, and have finished the midway extra mission, where the objective is to recover a McGuffin from the field to keep AI Incognita alive. Breathe a sigh of relief, since this is way more difficult than I had anticipated, and on to the missions after that.
The story adds a further 48 hours to your search, and requires you to recover an extra piece of special loot each mission before you can escape. So I'm already on a tight deadline, and now I have something else to worry about. Oh goody!
One of the next missions I tackled was a Cybernetics Lab, Sankaku, level 4 difficulty. The team that went in was Sharp, Banks (my starting team) and Shalem 11 (rescued). I don't know if that makes a difference or not, but I mention it for what it's worth.
Spoilers incoming!
Early in the mission I discover a special computer terminal. That terminal, Mother informs me, has information that the corps looted from Invisible Inc when we were raided. There are three terminals on the level, and I need to hack and download the data from all three to complete this side mission. Not a problem, I think to myself. So Shalem starts tackling the first, and Sharp and Banks go off looking for the other two.
Bear in mind, though this is early in the mission, it's taken me a couple turns to get to this point. I'm still on alarm level 0, mind you, but the point is that time has passed. It's been maybe 3 to 8 minutes since I booted the game.
Shalem begins the hack. Sharp finds the second terminal soon afterward, and starts work on it. Then Mother tells me that, after I hack each terminal, she'll insert a worm onto Sankaku's systems.
And then the game starts singing to me.
I nigh on flipped. I don't know what it was; some generic triumphal rock, I think, with cheers and so on. At first I thought I'd somehow left YouTube on and it was playing in the background. But that made no sense; remember, it had been several minutes since I booted the game, and if it was YouTube I would have expected it to kick in much sooner.
Then I decide it's the game itself. I didn't recognize the music it was playing, and I convinced myself that this was because it was some work for hire stuff that Klei bought specially. OK, funny, heart attack over; Banks, go find the third terminal.
That's when I hear a voice stab from Valve's Team Fortress 2, the Soldier. I'm pretty sure he said Maggot! which is his favorite voice stab; it caught me completely off guard. Then the music changes to I'll Make A Man Out of You, from Disney's Mulan.
By this point I am utterly, utterly baffled. A work for hire might explain the earlier music, but persuading Disney to part with its tunes is no easy thing, and would probably cost more money than Klei has ever had. I know there's at least one YouTube short that mashes Valve's TF2 with that particular Mulan tune, and there may well be others for all I know, but this particular combination isn't one I recognize.
I'm also laughing like a hyena on crack, but that's just by the by.
Once Banks cracks the third terminal and takes the data, the music stops. Down to business! Where's the cybernetics lab? Found it. Where's the exit? Found it! Job done?
No, of course it isn't bloody done, because with all this theme tune business I've completely forgotten the special loot. It's hidden way off in a corner of the map I can't easily get to, and now I'm on alarm level 4. Sod! Sod sod monkey bollocks, run run run!
OK, now I have the special loot and am making my way back. Shalem is moving very slowly because he's carrying a very heavy weapon, so he's back near the exit. Sharp and Banks are the ones out in the field, but they're about as far away from the exit as it is possible to be.
I hit alarm level 6.
The bloody game starts playing the Beatles, Hey Jude.
Talk about take a sad song and make it better. 'Hey Jude, don't let me down'? You cheeky bastard. I'm dying over here. I've never had to play so skillfully to get my people to the exit, trying not to hack the big tank drone since it has a Validate daemon on it, which means if it goes down yet another guard will be summoned to the level and I'm up to my armpits in guards anyway ... it all gets very messy. I prefer not to kill the guards if I can help it but this time I was positively overjoyed to shoot one of the buggers.
Hey Jude follows me all the way to the exit, and my team extracts safely.
Once I'm out, I log off. That's when I discover that there really is a pop-up, a video player, and it has been playing in the background.
I don't know what to think. Was it Klei? Was it an accident? It wasn't YouTube, that much I do know, but as for the rest of it, I'm completely and utterly in the dark.
Let's say it was Klei. Well, it implies that Klei hacked my PC. Though hacked may be too strong a word, since if that is what happened, I'd bet money I gave Klei permission. Not that I'd know it. It'd be buried somewhere in the User Agreement, right next to the bit that talks about Germany's potato exports, since Klei knows full well nobody reads those things.
I don't know where it would stand legally. All it did was open a video player, which then played some music. I could do that myself if I liked. In fact, I am; as I type this I have Hey Jude playing in the background.
If it was anyone else, I'd say it didn't happen. But this is Klei. The game is about hacking computers, and one of the achievements notoriously forces you to hack the game files to get the achievement. In fact until the DLC dropped it was the one achievement I didn't have, since I lack the skills and in any case didn't really want to mess with the game.
In short, if anyone would do this, Klei would. I'd bet anything on that. I don't know how I'd prove Klei did do it, mind you. Presumably if I went poking around in the game files I'd eventually find the code that set this up, but I don't know how to do that, and in any case doing so feels a little too much like telling the magician how the rabbit was pulled out of the hat. You don't want to do that. You go to a magic show to see magic, not to be an arse about the show.
So, Klei? If this was you, hat's off. An utterly brilliant idea, and it worked perfectly.
And if it wasn't you, I don't know what the hell happened.
Postscript: I don't know what to make of this, either.
Sunday, 6 December 2015
Messing with the Protagonists (Night's Black Agents, Dracula Dossier)
I'm playing through the Dracula Dossier with some friends of mine, and I thought that the Directors out there might like to know about a surprise I recently pulled on their unsuspecting IT expert.
This is a fella who does IT in real life, at a fairly high level, so he's up to date on most technical issues. His character has a very high Digital Intrusion pool, and is the one everyone turns to when Electronic Surveillance is needed. His standard response to data management is to back everything up, as often as possible, on as many devices as possible.
Now, to kick things off we started with the scenario in the main book, (S)Entries, which asks the protagonists to recover a laptop belonging to an important NATO officer. This they did, without a hitch. They proceeded to search through the data before handing it over to their contact, and the IT bod also cloned and copied it everywhere. He wanted as many copies as possible, on as many devices as possible.
Among the files on the laptop were four scanned pages of the Dracula Dossier. I let the players pick which four pages. The presumption was that someone (they hadn't met Harker yet) had passed on the Dossier pages to the NATO officer, as part of a scheme to enlist the NATO man's help. The Dossier pages were presumed to be Harker's bona-fides. That scenario led them on to several unconnected adventures which I shan't detail here.
Eventually they recovered the original Dossier, and the IT bod promptly started copying it, scanning it, whatever he could think of, so long as he had an electronic version of it somewhere. No doubt, as a canny player, he was expecting me to try to steal the Dossier at some point. However no matter what he tried he couldn't get a scan. I pointed him to page 200 of the Unredacted Dracula, and that explanation seemed to satisfy him. He believed he couldn't scan the Dossier, so he stopped trying. I think he'd forgotten about the scans in the NATO packet.
Then when things were a bit quieter he settled in with his laptop to see if he could find out what had gone wrong, and at that point with his extensive IT abilities it wasn't long before he discovered the truth.
Now, at this point I have to confess that my background is not IT, and what little I do know about hacking and viruses is at the layman level. I'm interested, certainly, and I pay attention to developments, but I couldn't write a worm to save my life. Not that I'd have to, I suppose; I could always just buy one, off of that dark net everyone's babbling about these days.
The scans in the NATO officer's folders weren't your standard .pdfs. They were .exe files, their purpose being to release a memory-resident virus onto the home system. It is encrypted with polymorphic code, making it very difficult to detect. However the mutating engine can, if the virus is traced, betray its GCHQ origins to a knowledgeable hacktivist like our IT friend.
The virus has two functions. First, if ever someone tries to scan and read Dossier files on an infected machine, those files immediately become unreadable. Second, it alerts the virus originator that a scan has been attempted, and advises the originator of the infected machine's location, current IP address, the works.
Remember, he'd been copying the NATO files everywhere, to any device the protagonists had that would take the data.
Oh dear.
The virus can be removed with a Difficulty 7 Digital Intrusion check. A success of 5 or better, but not 7, makes the protagonist think that the virus has been removed, when it really hasn't. The scan-destroying function is eliminated, but unfortunately for the protagonist the routine that lets the virus contact home is still active, and is now permanently switched on.
Failure on the DI check means that the virus' last act is to destroy the infected hard drive.
The protagonist spent so many DI pool points that success was pretty much guaranteed, and his next act - to be dealt with in an upcoming session - is to have a go at the PNC, to see if he can find out who did this to him. This should be interesting! Time for a Thriller Digital Intrusion contest, methinks ...
More later!
This is a fella who does IT in real life, at a fairly high level, so he's up to date on most technical issues. His character has a very high Digital Intrusion pool, and is the one everyone turns to when Electronic Surveillance is needed. His standard response to data management is to back everything up, as often as possible, on as many devices as possible.
Now, to kick things off we started with the scenario in the main book, (S)Entries, which asks the protagonists to recover a laptop belonging to an important NATO officer. This they did, without a hitch. They proceeded to search through the data before handing it over to their contact, and the IT bod also cloned and copied it everywhere. He wanted as many copies as possible, on as many devices as possible.
Among the files on the laptop were four scanned pages of the Dracula Dossier. I let the players pick which four pages. The presumption was that someone (they hadn't met Harker yet) had passed on the Dossier pages to the NATO officer, as part of a scheme to enlist the NATO man's help. The Dossier pages were presumed to be Harker's bona-fides. That scenario led them on to several unconnected adventures which I shan't detail here.
Eventually they recovered the original Dossier, and the IT bod promptly started copying it, scanning it, whatever he could think of, so long as he had an electronic version of it somewhere. No doubt, as a canny player, he was expecting me to try to steal the Dossier at some point. However no matter what he tried he couldn't get a scan. I pointed him to page 200 of the Unredacted Dracula, and that explanation seemed to satisfy him. He believed he couldn't scan the Dossier, so he stopped trying. I think he'd forgotten about the scans in the NATO packet.
Then when things were a bit quieter he settled in with his laptop to see if he could find out what had gone wrong, and at that point with his extensive IT abilities it wasn't long before he discovered the truth.
Now, at this point I have to confess that my background is not IT, and what little I do know about hacking and viruses is at the layman level. I'm interested, certainly, and I pay attention to developments, but I couldn't write a worm to save my life. Not that I'd have to, I suppose; I could always just buy one, off of that dark net everyone's babbling about these days.
The scans in the NATO officer's folders weren't your standard .pdfs. They were .exe files, their purpose being to release a memory-resident virus onto the home system. It is encrypted with polymorphic code, making it very difficult to detect. However the mutating engine can, if the virus is traced, betray its GCHQ origins to a knowledgeable hacktivist like our IT friend.
The virus has two functions. First, if ever someone tries to scan and read Dossier files on an infected machine, those files immediately become unreadable. Second, it alerts the virus originator that a scan has been attempted, and advises the originator of the infected machine's location, current IP address, the works.
Remember, he'd been copying the NATO files everywhere, to any device the protagonists had that would take the data.
Oh dear.
The virus can be removed with a Difficulty 7 Digital Intrusion check. A success of 5 or better, but not 7, makes the protagonist think that the virus has been removed, when it really hasn't. The scan-destroying function is eliminated, but unfortunately for the protagonist the routine that lets the virus contact home is still active, and is now permanently switched on.
Failure on the DI check means that the virus' last act is to destroy the infected hard drive.
The protagonist spent so many DI pool points that success was pretty much guaranteed, and his next act - to be dealt with in an upcoming session - is to have a go at the PNC, to see if he can find out who did this to him. This should be interesting! Time for a Thriller Digital Intrusion contest, methinks ...
More later!
Sunday, 17 May 2015
Not Quite Review Corner: Invisible Inc (Klei)
Welcome to another installment, in which I'm going to talk about Klei Entertainment's stealthy roguelike, Invisible Inc. I just picked this up on Steam yesterday, and have been playing obsessively for the last few hours. I haven't beaten it yet (experienced level), but I am on what seems to be the final mission, and am playing through again with different characters to see if that has significant effect on my playthrough.
The story campaign is set in a William Gibson-esque cyberpunk world, and I'll go so far as to say that, unless you've been devouring cyberpunk for the last few years, many of the game concepts might confuse or irritate you. Corporations rule this dystopian world. Your rag-tag bunch of crooks and thieves has been a thorn in their side for far too long, so the corps decided to band together to take you out. Your organization is shattered, many of its members captured, and you're on the run with what's left of your super-powerful AI, Incognita. Your job is to stay alive, and find somewhere to house your AI before it degrades beyond recovery.
Incognita is one of the major gameplay elements. It's thanks to the AI that you can hack your way through the enemy defenses, and without hacking your team would be dead in the water, since the corp facilities are chock-full of security cameras, laser beams, security drones, combat drones and other, terrifying things. Plus, of course, security guards. So, so many security guards ... Your job, ultimately, is to keep Incognita alive, and the story missions revolve around you finding a new home for her, after the old one was blown up.
You begin play with two surviving agents, a small fund of credits, and not much else. The default agents are Decker, a thug with a handy-dandy invisibility cloak, and Internationale, a clever hacker who can rip systems apart wirelessly. Of the two, Internationale is probably the more useful, since Incognita needs Power to operate, and Internationale can steal that quickly and easily. There are other agents which you can unlock through play, or rescue from detention camps. Some are combat monsters, others stealthy thieves. Though each has a personality of sorts, it barely impinges on gameplay. Apart from individual character's special abilities, like Decker's chance to detect internet Daemons, each character is the same as another, increases abilities in the same way, and uses the same equipment. There are no character classes here. If you want Internationale to become a brawler, a brawler she shall be, and so on.
This is a turn-based stealth roguelike, with STEALTH writ in ten-foot high fiery letters. If stealth games frustrate you, on no account go anywhere near Invisible Inc. In many ways it's the polar opposite of XCom, despite both being turn-based strategy titles, because one of the draws of XCom is that you get to shoot, blow up and otherwise shred the things that anger you, whereas here you need to adapt to your environment, avoiding conflict if at all possible. Dishonored, another stealth title, also allowed the player to choose to blow off steam, and complete the mission, by killing everything in sight, waving a sword like Doug Fairbanks on amphetamines. Here, though, killing or indeed any aggressive action is tacitly forbidden. Each time a guard dies, or wakes up after you've knocked him unconscious, things get much more difficult, as the alarm bells start ringing and the surviving guards chase you down. At alarm level one, things are a little tricky, but at level six you might as well get in your coffin and call the undertaker.
This is a difficult game. I strongly recommend new players start at Beginner, and work your way up. Ordinarily the lowest rung of the difficulty ladder is for those who've never played this kind of game before, but this time, it's for everyone. Particularly since the game's stuffed full of concepts and terminology that aren't as clearly described as perhaps they could be. Again, it's a cyberpunk thing; especially when it comes to the hacking side of the game, you really need to be into the genre to get, say, Daemons, and how they can screw with your day. But it's also because there's a ton of stuff to take in, very little of which is going to be familiar to you.
For example: there's something called a Sound Bug on many of the levels. Presumably it's some kind of defensive mechanism, a type of trap. I have no idea what this thing does. It hasn't affected my game play - or at least, I haven't noticed it affecting my experience - but I know it's there, and I know it does something. I've been ignoring it, which seems to work so far. I'd still like to know what it is.
Many of the game's concepts are deliberately video-gamish, which can be annoying. Case in point: if you hack some of the consoles on the level, you get the option to buy new programs or tools to help you out. Think about it: you've just hacked, as in gained illicit access, to their systems. You should have complete control, so why are you spending money, your own actual cash, to do stuff? Do Chinese hackers rip apart, I don't know, Amazon, say, just so they can purchase books on Kindle? Or here's another: many of the advanced weapons require ammo packs, one-time-use items, so they can be recharged. I assumed that meant if you wanted to reload during a mission, you had to have an ammo pack. Fine, but if I empty a weapon and then finish the mission, I can reload for free at home base, right? We have bullets stashed away at HQ, surely? No? I have to use the one-use-only item that cost me several hundred credits - again, my own money, because my hacker's a bit fuzzy on the whole stealing thing - to recharge? Damn. There is a story element that explains this - you're flying around on an escape jet, and didn't have a chance to bring supplies - but it still smacks of resource management shoehorned in to make the experience more difficult.
It's not as if you can get stuff easily. There is an in-game merchant, Monst3r, but he rarely has anything to sell, in story mode at least. You can buy things from corp machines, but there's no guarantee that the corp machine will have what you want, and of course you're dodging corp security all the time, so you can't hang around. That one-use-only item can't get replaced easily, so you have to be really, really careful, husbanding your resources.
It is basically Ironman by default, unless you're playing at Beginner level. Ironman, for those not familiar with the term, is a game concept which assumes that you cannot go back to a previous save, and play again. Every choice counts. At Beginner, you have the option of Rewinding, going back in time one turn, which you can do five times. You also have the option to restart the level, which is great when you thoroughly screw the pooch and are facing down a dozen enraged guards. At Experienced, you can no longer restart, nor can you go back to a previous save, and you only have three Rewinds. Thus, while not officially Ironman, Experienced forces you to play with no take-backs, and if the mission goes straight to hell, that's the entire campaign done and dusted, with all your people dead or in custody. You don't have the option to choose who goes on a mission. The game assumes everyone goes, so if you fail and your people are wiped, there's no way to recover. Ouch! I haven't dared try anything above Experienced yet. I think it might make me cry.
Is this a good strategy title? Hell yes. You will sweat over every single decision. When you manage a successful run, sneaking through the facility and stealing what you need to survive, escaping right under the enemy's nose, you'll feel like the hero of a heist movie. The roguelike aspect of it makes it feel a little as if the corp's architects drink a bucket of scotch for breakfast, lunch and dinner - seriously guys, corridors that go nowhere, what the hell - but it does mean that the maps have near infinite variety, which really keeps you on your toes.
Has it the same replayability as XCom? Well, it does have sandbox modes for you to tool around in, after the story mode's done. You could build up a team of hardened crooks and make the corps sweat blood, forever and ever and ever. XCom doesn't offer that, and its lack of new maps does make it feel same-y after a while. Even if a roguelike's maps look as if they were put together by Salvador Dali's cousin Sherman, at least they're different each time.
However there's not a lot of actual variety in the missions. Ultimately you go to a place, do a thing, and then run away. The thing you do can vary from hacking into a system, buying new stuff, capturing enemy personnel for the information in their heads and so on, but the mechanics of it never change significantly. Whenever you do a thing, alarm bells go off, making it that much more difficult to escape. No matter how you handle the capture of a corporate officer, for instance, in hope of stealing his data card, he always, always, always summons a high-level security guard to investigate. No matter how stealthy you have been, the alarm bells always go off, and the level of alarm always increases. It doesn't matter how clever you are, if you're still there when the alarm level reaches six - and it will get there eventually - you're borked. All this can make the game feel as if you're doing the same rote task, time and again, and it's mainly the adrenaline rush of avoiding the security systems that keeps you hooked.
Is it worth the money? It's currently going for $17.99 on Steam, and is also available on Mac and PS4. Not sure of the price tag on the other platforms, but I'm going to go out on a limb and say that it's broadly comparable. At that price, it's a steal. Even if you fall out of love with it eventually, it will consume many hours of your time before that happens.
Do I recommend it? Yes, but with the great big caveat that you have to like stealth games, and must be big into cyberpunk as a setting. It is not a game for hotheads, and if you lose your temper easily, avoid like the plague.
But all that said, if you do love stealth, if you're familiar with cyberpunk as a setting, and if you're looking for a turn-based strategy title to take over where XCom left off, look no further. Klei has you covered.
Enjoy!
The story campaign is set in a William Gibson-esque cyberpunk world, and I'll go so far as to say that, unless you've been devouring cyberpunk for the last few years, many of the game concepts might confuse or irritate you. Corporations rule this dystopian world. Your rag-tag bunch of crooks and thieves has been a thorn in their side for far too long, so the corps decided to band together to take you out. Your organization is shattered, many of its members captured, and you're on the run with what's left of your super-powerful AI, Incognita. Your job is to stay alive, and find somewhere to house your AI before it degrades beyond recovery.
Incognita is one of the major gameplay elements. It's thanks to the AI that you can hack your way through the enemy defenses, and without hacking your team would be dead in the water, since the corp facilities are chock-full of security cameras, laser beams, security drones, combat drones and other, terrifying things. Plus, of course, security guards. So, so many security guards ... Your job, ultimately, is to keep Incognita alive, and the story missions revolve around you finding a new home for her, after the old one was blown up.
You begin play with two surviving agents, a small fund of credits, and not much else. The default agents are Decker, a thug with a handy-dandy invisibility cloak, and Internationale, a clever hacker who can rip systems apart wirelessly. Of the two, Internationale is probably the more useful, since Incognita needs Power to operate, and Internationale can steal that quickly and easily. There are other agents which you can unlock through play, or rescue from detention camps. Some are combat monsters, others stealthy thieves. Though each has a personality of sorts, it barely impinges on gameplay. Apart from individual character's special abilities, like Decker's chance to detect internet Daemons, each character is the same as another, increases abilities in the same way, and uses the same equipment. There are no character classes here. If you want Internationale to become a brawler, a brawler she shall be, and so on.
This is a turn-based stealth roguelike, with STEALTH writ in ten-foot high fiery letters. If stealth games frustrate you, on no account go anywhere near Invisible Inc. In many ways it's the polar opposite of XCom, despite both being turn-based strategy titles, because one of the draws of XCom is that you get to shoot, blow up and otherwise shred the things that anger you, whereas here you need to adapt to your environment, avoiding conflict if at all possible. Dishonored, another stealth title, also allowed the player to choose to blow off steam, and complete the mission, by killing everything in sight, waving a sword like Doug Fairbanks on amphetamines. Here, though, killing or indeed any aggressive action is tacitly forbidden. Each time a guard dies, or wakes up after you've knocked him unconscious, things get much more difficult, as the alarm bells start ringing and the surviving guards chase you down. At alarm level one, things are a little tricky, but at level six you might as well get in your coffin and call the undertaker.
This is a difficult game. I strongly recommend new players start at Beginner, and work your way up. Ordinarily the lowest rung of the difficulty ladder is for those who've never played this kind of game before, but this time, it's for everyone. Particularly since the game's stuffed full of concepts and terminology that aren't as clearly described as perhaps they could be. Again, it's a cyberpunk thing; especially when it comes to the hacking side of the game, you really need to be into the genre to get, say, Daemons, and how they can screw with your day. But it's also because there's a ton of stuff to take in, very little of which is going to be familiar to you.
For example: there's something called a Sound Bug on many of the levels. Presumably it's some kind of defensive mechanism, a type of trap. I have no idea what this thing does. It hasn't affected my game play - or at least, I haven't noticed it affecting my experience - but I know it's there, and I know it does something. I've been ignoring it, which seems to work so far. I'd still like to know what it is.
Many of the game's concepts are deliberately video-gamish, which can be annoying. Case in point: if you hack some of the consoles on the level, you get the option to buy new programs or tools to help you out. Think about it: you've just hacked, as in gained illicit access, to their systems. You should have complete control, so why are you spending money, your own actual cash, to do stuff? Do Chinese hackers rip apart, I don't know, Amazon, say, just so they can purchase books on Kindle? Or here's another: many of the advanced weapons require ammo packs, one-time-use items, so they can be recharged. I assumed that meant if you wanted to reload during a mission, you had to have an ammo pack. Fine, but if I empty a weapon and then finish the mission, I can reload for free at home base, right? We have bullets stashed away at HQ, surely? No? I have to use the one-use-only item that cost me several hundred credits - again, my own money, because my hacker's a bit fuzzy on the whole stealing thing - to recharge? Damn. There is a story element that explains this - you're flying around on an escape jet, and didn't have a chance to bring supplies - but it still smacks of resource management shoehorned in to make the experience more difficult.
It's not as if you can get stuff easily. There is an in-game merchant, Monst3r, but he rarely has anything to sell, in story mode at least. You can buy things from corp machines, but there's no guarantee that the corp machine will have what you want, and of course you're dodging corp security all the time, so you can't hang around. That one-use-only item can't get replaced easily, so you have to be really, really careful, husbanding your resources.
It is basically Ironman by default, unless you're playing at Beginner level. Ironman, for those not familiar with the term, is a game concept which assumes that you cannot go back to a previous save, and play again. Every choice counts. At Beginner, you have the option of Rewinding, going back in time one turn, which you can do five times. You also have the option to restart the level, which is great when you thoroughly screw the pooch and are facing down a dozen enraged guards. At Experienced, you can no longer restart, nor can you go back to a previous save, and you only have three Rewinds. Thus, while not officially Ironman, Experienced forces you to play with no take-backs, and if the mission goes straight to hell, that's the entire campaign done and dusted, with all your people dead or in custody. You don't have the option to choose who goes on a mission. The game assumes everyone goes, so if you fail and your people are wiped, there's no way to recover. Ouch! I haven't dared try anything above Experienced yet. I think it might make me cry.
Is this a good strategy title? Hell yes. You will sweat over every single decision. When you manage a successful run, sneaking through the facility and stealing what you need to survive, escaping right under the enemy's nose, you'll feel like the hero of a heist movie. The roguelike aspect of it makes it feel a little as if the corp's architects drink a bucket of scotch for breakfast, lunch and dinner - seriously guys, corridors that go nowhere, what the hell - but it does mean that the maps have near infinite variety, which really keeps you on your toes.
Has it the same replayability as XCom? Well, it does have sandbox modes for you to tool around in, after the story mode's done. You could build up a team of hardened crooks and make the corps sweat blood, forever and ever and ever. XCom doesn't offer that, and its lack of new maps does make it feel same-y after a while. Even if a roguelike's maps look as if they were put together by Salvador Dali's cousin Sherman, at least they're different each time.
However there's not a lot of actual variety in the missions. Ultimately you go to a place, do a thing, and then run away. The thing you do can vary from hacking into a system, buying new stuff, capturing enemy personnel for the information in their heads and so on, but the mechanics of it never change significantly. Whenever you do a thing, alarm bells go off, making it that much more difficult to escape. No matter how you handle the capture of a corporate officer, for instance, in hope of stealing his data card, he always, always, always summons a high-level security guard to investigate. No matter how stealthy you have been, the alarm bells always go off, and the level of alarm always increases. It doesn't matter how clever you are, if you're still there when the alarm level reaches six - and it will get there eventually - you're borked. All this can make the game feel as if you're doing the same rote task, time and again, and it's mainly the adrenaline rush of avoiding the security systems that keeps you hooked.
Is it worth the money? It's currently going for $17.99 on Steam, and is also available on Mac and PS4. Not sure of the price tag on the other platforms, but I'm going to go out on a limb and say that it's broadly comparable. At that price, it's a steal. Even if you fall out of love with it eventually, it will consume many hours of your time before that happens.
Do I recommend it? Yes, but with the great big caveat that you have to like stealth games, and must be big into cyberpunk as a setting. It is not a game for hotheads, and if you lose your temper easily, avoid like the plague.
But all that said, if you do love stealth, if you're familiar with cyberpunk as a setting, and if you're looking for a turn-based strategy title to take over where XCom left off, look no further. Klei has you covered.
Enjoy!
Wednesday, 11 February 2015
A Whole Bunch Of Pandas (Night's Black Agents)
I'm not sure what the collective noun for Pandas is - herd? pod? murder? - but if cybersecurity outfit CrowdStrike is to be believed, there's a whole heck of a lot of them out there on the internet.
CrowdStrike released a report on hacking in 2014, naming the main players, and the most serious threats, on the global network. Perhaps unsurprisingly, the vast majority call themselves some kind of Panda; GOBLIN PANDA, VIXEN PANDA, PITTY PANDA, GOTHIC PANDA, PREDATOR PANDA, DYNAMITE PANDA, SPICY PANDA ... the list goes on. Presumably this indicates a Chinese origin, or at any rate some kind of Chinese connection. Some of them are certainly run by the Chinese government, or at least hired on a freelance basis by the authorities, but your guess is as good as mine as to who did what to whom.
The whole report is well worth reading, and plugging into your Night's Black Agents game. It is free to download, so there's no reason not to give it a bash. I want to draw your attention to the Notable Activity section, from page 28 to 29, and the section on DerpTrolling. I'm going to quote that section in its entirety:
The hacking collective DerpTrolling made early 2014 media headlines after claiming a string of DDoS attacks on multiple gaming companies and online gaming servers. The group likely originated out of the Steam gaming community, where some of its suspected members engaged in early DDoS attacks on rival gaming clans and their servers. DerpTrolling’s antics were often childish and had no clear motive other than being “for the lulz” and to boost their own egos. For this reason, they cannot be classified as hacktivists. Despite their immaturity, the collective was able to consistently carry out DDoS attacks on targets of their choosing, and these attacks had a real-world effect on the victims within the gaming community.
The attacks were particularly noteworthy as their DDoS tool, dubbed the Gaben Laser Beam (GLB) after Gabe Newell, the creator of Half-Life and the Steam community, supposedly created an attack that exceeded 400 gbps of network traffic utilizing a NTP reflection attack. This suggested DerpTrolling possessed an above-average knowledge of network protocols. While NTP reflection is commonly known in the security community, most “script kiddies” or “skids” were not aware of some of these more advanced techniques involving amplification, which allows for fewer devices needed to pull off larger DDoS attacks.
DerpTrolling has reportedly had several run-ins with law enforcement, though it is unclear how much of this is verifiable versus a ploy to increase their notoriety. One supposed encounter resulted in the group going silent for several months before returning and carrying out lower-level attacks on the gaming community once again. Given the collective’s poor operational security practices, it is likely that the members are actively being tracked by law enforcement agencies and that they cannot continue to maintain high-profile attacks while evading capture.
Emphasis mine.
Let's consider what that means, from an RPG point of view. The Double Tap book gives the Keeper a list of Cameos, potential NPCs to be used as needed. Each NPC is described in three possible ways: as an Asset, a Clue, and In Play. The Cameo also includes the preferred Interpersonal method to win their cooperation.
Here we have an example of a Cameo that's all but built for gaming. Not only does this hacker have the skills a character might want to draw on, she also has a background that practically invites law enforcement involvement. As has been shown before, law enforcement is adept at turning former hackers against their friends in the collective; what could be easier, for a NBA spook, than to lean on a hacker informant for dirt on the Conspyracy?
With all that in mind:
Hacker
Conceal 4, Digital Intrusion 7, Infiltration 3, Mechanics 3
Sarah, aka R33pc33p - a reference to her favorite fictional character, Reepicheep - is one of four founding members of the hacker group LOLchat, first created on the message boards for online multiplayer shooter LeftB3hind. The group self-identified as hacktivists, but was really more interested in causing grief in online gaming communities, 'for the lulz.' It specialized in DDoS attacks, carrying out several significant coups, among them taking the PSN offline for four days, in summer 2013. Shortly after that the LOLchat group went dark, and it was believed at the time that poor security practices led to their apprehension by law enforcement. LOLchat has since made a relatively quiet comeback in 2014, engaging in minor harassment. R33pc33p is now the most active member, and seems to have graduated from lulz to more significant criminal enterprises. Several Point of Sale malware kits are thought to have been created, and distributed, by R33pc33p. In person, Sarah is a skinny, pale brunette who likes to wear colorful clothes, particularly game-related merchandise and T-shirts. She rarely comes outside any more, preferring her online identity, though she is known to attend two major game conventions each year. (Intimidation, Cop Talk, Flattery, Data Recovery)
AS ASSET: Can provide custom malware kits; keeps records on every entity she's ever hacked, or done business with, including confidential files ripped from their systems; can help create false online identities.
AS CLUE: Is harassing a Conspyracy asset; is an informant for both the Conspyracy and law enforcement, and is having trouble telling them apart; has collected a ton of evidence and files on the target her handlers wanted her to go after, but is now holding that information to ransom; is participating in the same online competitive multiplayer game as a Conspyracy asset, either in a rival gaming clan, or in the asset's clan.
IN PLAY: Flamboyant, extravagant in action and in deed. Emulates her hero Reepicheep, in that she follows a code of honor. Never pays too close attention to anything, unless it's online competitive multiplayer, or creating malware tools. Get very excited if close to victory!
CrowdStrike released a report on hacking in 2014, naming the main players, and the most serious threats, on the global network. Perhaps unsurprisingly, the vast majority call themselves some kind of Panda; GOBLIN PANDA, VIXEN PANDA, PITTY PANDA, GOTHIC PANDA, PREDATOR PANDA, DYNAMITE PANDA, SPICY PANDA ... the list goes on. Presumably this indicates a Chinese origin, or at any rate some kind of Chinese connection. Some of them are certainly run by the Chinese government, or at least hired on a freelance basis by the authorities, but your guess is as good as mine as to who did what to whom.
The whole report is well worth reading, and plugging into your Night's Black Agents game. It is free to download, so there's no reason not to give it a bash. I want to draw your attention to the Notable Activity section, from page 28 to 29, and the section on DerpTrolling. I'm going to quote that section in its entirety:
The hacking collective DerpTrolling made early 2014 media headlines after claiming a string of DDoS attacks on multiple gaming companies and online gaming servers. The group likely originated out of the Steam gaming community, where some of its suspected members engaged in early DDoS attacks on rival gaming clans and their servers. DerpTrolling’s antics were often childish and had no clear motive other than being “for the lulz” and to boost their own egos. For this reason, they cannot be classified as hacktivists. Despite their immaturity, the collective was able to consistently carry out DDoS attacks on targets of their choosing, and these attacks had a real-world effect on the victims within the gaming community.
The attacks were particularly noteworthy as their DDoS tool, dubbed the Gaben Laser Beam (GLB) after Gabe Newell, the creator of Half-Life and the Steam community, supposedly created an attack that exceeded 400 gbps of network traffic utilizing a NTP reflection attack. This suggested DerpTrolling possessed an above-average knowledge of network protocols. While NTP reflection is commonly known in the security community, most “script kiddies” or “skids” were not aware of some of these more advanced techniques involving amplification, which allows for fewer devices needed to pull off larger DDoS attacks.
DerpTrolling has reportedly had several run-ins with law enforcement, though it is unclear how much of this is verifiable versus a ploy to increase their notoriety. One supposed encounter resulted in the group going silent for several months before returning and carrying out lower-level attacks on the gaming community once again. Given the collective’s poor operational security practices, it is likely that the members are actively being tracked by law enforcement agencies and that they cannot continue to maintain high-profile attacks while evading capture.
Emphasis mine.
Let's consider what that means, from an RPG point of view. The Double Tap book gives the Keeper a list of Cameos, potential NPCs to be used as needed. Each NPC is described in three possible ways: as an Asset, a Clue, and In Play. The Cameo also includes the preferred Interpersonal method to win their cooperation.
Here we have an example of a Cameo that's all but built for gaming. Not only does this hacker have the skills a character might want to draw on, she also has a background that practically invites law enforcement involvement. As has been shown before, law enforcement is adept at turning former hackers against their friends in the collective; what could be easier, for a NBA spook, than to lean on a hacker informant for dirt on the Conspyracy?
With all that in mind:
Hacker
Conceal 4, Digital Intrusion 7, Infiltration 3, Mechanics 3
Sarah, aka R33pc33p - a reference to her favorite fictional character, Reepicheep - is one of four founding members of the hacker group LOLchat, first created on the message boards for online multiplayer shooter LeftB3hind. The group self-identified as hacktivists, but was really more interested in causing grief in online gaming communities, 'for the lulz.' It specialized in DDoS attacks, carrying out several significant coups, among them taking the PSN offline for four days, in summer 2013. Shortly after that the LOLchat group went dark, and it was believed at the time that poor security practices led to their apprehension by law enforcement. LOLchat has since made a relatively quiet comeback in 2014, engaging in minor harassment. R33pc33p is now the most active member, and seems to have graduated from lulz to more significant criminal enterprises. Several Point of Sale malware kits are thought to have been created, and distributed, by R33pc33p. In person, Sarah is a skinny, pale brunette who likes to wear colorful clothes, particularly game-related merchandise and T-shirts. She rarely comes outside any more, preferring her online identity, though she is known to attend two major game conventions each year. (Intimidation, Cop Talk, Flattery, Data Recovery)
AS ASSET: Can provide custom malware kits; keeps records on every entity she's ever hacked, or done business with, including confidential files ripped from their systems; can help create false online identities.
AS CLUE: Is harassing a Conspyracy asset; is an informant for both the Conspyracy and law enforcement, and is having trouble telling them apart; has collected a ton of evidence and files on the target her handlers wanted her to go after, but is now holding that information to ransom; is participating in the same online competitive multiplayer game as a Conspyracy asset, either in a rival gaming clan, or in the asset's clan.
IN PLAY: Flamboyant, extravagant in action and in deed. Emulates her hero Reepicheep, in that she follows a code of honor. Never pays too close attention to anything, unless it's online competitive multiplayer, or creating malware tools. Get very excited if close to victory!
Monday, 14 April 2014
Hackers and Haunted Coke Machines: Night's Black Agents
There's a couple of articles I'm going to urge you to read, and one of them can be found at the New York Times. It discusses hacking and infiltration techniques, and leads off with an intriguing story about a Chinese takeaway menu.
Hackers discovered that their chosen target was a little too secure for comfort. Rather than bash their heads against a firewall, they decided on a watering hole trap: their malware infested the online takeaway menu of a nearby Chinese restaurant, popular with the target's staff. End result: the staff went online from their work machines, browsed the menu, and got an extra helping of virus with their sweet 'n sour. That gave the hackers a foothold into the system, and since one system is often connected to all the others, they soon were able to infect the entire network.
I'm going to go out on a limb - though not very far - and suggest that, as a plan of attack, Western military targets are probably very vulnerable to this kind of exploit. A security system is only as secure as its stupidest user, and you meet some real prize winners in the military. I can just picture a base's security network penetrated thanks to the squaddies' love of chips, curry and pizza. But that's by the way.
The article goes on to note that, in most cases, a watering hole tactic like this probably isn't necessary. Many companies sabotage their own security efforts, by bringing in Coke machines and other outside vendor equipment. Remember when I said earlier that one system is often connected to all the others? That's also the case with every single outside vendor's device. Gone are the days when a Coke machine was just a coin-operated snack dispenser; now they boast all kinds of sophisticated systems to let the supplier know when the machine's empty, broken, or otherwise needs maintenance. Except not too sophisticated, since they often run on older OS like Windows XP, or even have their security protocols switched off by default on installation. Yet the Coke machine - or more likely, projector, HVAC equipment and so on - is probably hooked up to the company's internal systems, even in instances where there's no good reason for the connection. Exploit the Coke machine, and you exploit the company.
Which, incidentally, leads straight back to a very old story, for here's an example of a Trojan that, actually and for true, relies on a Trojan Horse. But that's a joke for the classicists.
This article sparked an unusual train of thought over at Gizmodo, where an editorial pounces on the use of the word 'adversary' by one of the Times' security experts and, by linking 'adversary' with Satan, suggests that this use of one particular word means that cybersecurity experts are obsessed with cursed objects. The discussion "takes on an air of almost Catholic exorcism," according to the editorial. I'm not going to delve too far into the Gizmodo piece, except to say that I think the writer makes far too much of a meal out of 'adversary,' taking it out of context to prove a rather oddball point.
But when taken in conjunction with the core concept of Night's Black Agents, we can really have some fun with the idea. Why not have haunted hackers? Why not have possessed vending machines, projectors serving the whims of Satan, and other mechanical invaders happily passing on data to their masters?
With that in mind, here are some stats for a possessing spirit:
Creeper0741
Abilities: Digital Intrusion 8, Health 1
Special: Possession (mechanical), Hive Mind
Blocks: in a supernatural setting, holy symbols may act as a Block for the Creeper0741
Compulsion: Spread infection.
Notes: The Creeper0741 is a standard infiltration tool used by some Conspiracy-backed hackers. It can Possess anything that uses microchip technology; it cannot exist outside of a microchip. Often the hacker will carry around a small portable device with the Creeper installed, place the device against the object the hacker wishes to infect, wait a few moments and then leave, taking the device. The Creeper will have made the leap from the hacker's infecting item to the other device and, since it has the Hive Mind ability, so long as the hacker retains the original infecting item the hacker will be able to 'see' whatever the Creeper sees. The Creeper can infect as many devices as it has Digital Intrusion points. An individual Creeper is extremely weak and has no defenses, but of course as a spirit entity it cannot be damaged by bullets or knives. However an electrical overload will clean it out. Some hackers claim that 'free' Creepers exist out on the net which have grown exponentially, increasing its Digital Intrusion by leaps and bounds. Theoretically if a free Creeper were to be captured, any device it has infected will be brought under the captor's control.
Hackers discovered that their chosen target was a little too secure for comfort. Rather than bash their heads against a firewall, they decided on a watering hole trap: their malware infested the online takeaway menu of a nearby Chinese restaurant, popular with the target's staff. End result: the staff went online from their work machines, browsed the menu, and got an extra helping of virus with their sweet 'n sour. That gave the hackers a foothold into the system, and since one system is often connected to all the others, they soon were able to infect the entire network.
I'm going to go out on a limb - though not very far - and suggest that, as a plan of attack, Western military targets are probably very vulnerable to this kind of exploit. A security system is only as secure as its stupidest user, and you meet some real prize winners in the military. I can just picture a base's security network penetrated thanks to the squaddies' love of chips, curry and pizza. But that's by the way.
The article goes on to note that, in most cases, a watering hole tactic like this probably isn't necessary. Many companies sabotage their own security efforts, by bringing in Coke machines and other outside vendor equipment. Remember when I said earlier that one system is often connected to all the others? That's also the case with every single outside vendor's device. Gone are the days when a Coke machine was just a coin-operated snack dispenser; now they boast all kinds of sophisticated systems to let the supplier know when the machine's empty, broken, or otherwise needs maintenance. Except not too sophisticated, since they often run on older OS like Windows XP, or even have their security protocols switched off by default on installation. Yet the Coke machine - or more likely, projector, HVAC equipment and so on - is probably hooked up to the company's internal systems, even in instances where there's no good reason for the connection. Exploit the Coke machine, and you exploit the company.
Which, incidentally, leads straight back to a very old story, for here's an example of a Trojan that, actually and for true, relies on a Trojan Horse. But that's a joke for the classicists.
This article sparked an unusual train of thought over at Gizmodo, where an editorial pounces on the use of the word 'adversary' by one of the Times' security experts and, by linking 'adversary' with Satan, suggests that this use of one particular word means that cybersecurity experts are obsessed with cursed objects. The discussion "takes on an air of almost Catholic exorcism," according to the editorial. I'm not going to delve too far into the Gizmodo piece, except to say that I think the writer makes far too much of a meal out of 'adversary,' taking it out of context to prove a rather oddball point.
But when taken in conjunction with the core concept of Night's Black Agents, we can really have some fun with the idea. Why not have haunted hackers? Why not have possessed vending machines, projectors serving the whims of Satan, and other mechanical invaders happily passing on data to their masters?
With that in mind, here are some stats for a possessing spirit:
Creeper0741
Abilities: Digital Intrusion 8, Health 1
Special: Possession (mechanical), Hive Mind
Blocks: in a supernatural setting, holy symbols may act as a Block for the Creeper0741
Compulsion: Spread infection.
Notes: The Creeper0741 is a standard infiltration tool used by some Conspiracy-backed hackers. It can Possess anything that uses microchip technology; it cannot exist outside of a microchip. Often the hacker will carry around a small portable device with the Creeper installed, place the device against the object the hacker wishes to infect, wait a few moments and then leave, taking the device. The Creeper will have made the leap from the hacker's infecting item to the other device and, since it has the Hive Mind ability, so long as the hacker retains the original infecting item the hacker will be able to 'see' whatever the Creeper sees. The Creeper can infect as many devices as it has Digital Intrusion points. An individual Creeper is extremely weak and has no defenses, but of course as a spirit entity it cannot be damaged by bullets or knives. However an electrical overload will clean it out. Some hackers claim that 'free' Creepers exist out on the net which have grown exponentially, increasing its Digital Intrusion by leaps and bounds. Theoretically if a free Creeper were to be captured, any device it has infected will be brought under the captor's control.
Saturday, 15 February 2014
Spies vs Anonymous and Lulzec: Night's Black Agents
Recently an NBC news report, based on the Snowden expose, revealed that British spies have been waging war on Anonymous and LulzSec. According to the report, Britain's GCHQ, through its attack arm the Joint Threat Research Intelligence Group, or JTRIG, used DDoS attacks to shut down servers that the two groups were using as communication hubs. The British are, in essence, using the same tactics as the hackers to shut down the hackers.
For those of you frantically reaching for Wikipedia right now, let me elucidate:
One of the biggest worries about this kind of reveal is that it shows just how quickly a government will resort to activities it publicly condemns in order to achieve its ends. Not that this is any kind of great secret; similar scandals are breaking all the time. But it is troubling to think that, at the drop of a hat, a Western government is willing to shut down chunks of the internet on the off-chance it contains something it doesn't like.
What does this suggest for Night's Black Agents?
To begin with, it suggests that the agent's own communications could be disrupted at any time. When GCHQ went after Anonymous, it didn't worry about whether or not the server it targeted also carried other traffic. It just shut the whole thing down. Imagine what that could mean to agents currently stranded in 'bandit country', relying on the net to communicate with allies.
It also suggests that, even with security measures in place, a government agency can obtain significant user data. The NBC article uses the example of a conversation between a JTRIG agent and a hacker named p0ke, in which the agent obtained p0ke's personal data - name, address, the lot - despite p0ke having a Virtual Private Network in place that, theoretically, should have kept its data safe. It's not clear whether this means JTRIG hacked the network, or used official contacts in the network's host country to break it.
From a game mechanic point of view, it's up to the Director whether or not identifying the source of a DDoS attack is Data Recovery or Military Science. I can see a case for either, or possibly even Human Terrain. Digital Intrusion is, of course, the ability you'd use to mount a DDoS attack. The difficulty with running that kind of test in-game isn't that it can't be done; it's that the skill itself is fairly abstruse. CyberPunk 2020 did its level best to make hacking fun, but even with all the ice-cool street samurai action, watching it unfold - if you're not involved yourself - is like watching particularly dull paint dry. Say what you like about the movie Hackers, but it at least knew how to make this stuff look good. Plus it had Penn Jillette of Penn and Teller in a cameo, which is worth at least two stars on anyone's rating.
Consider the following possible story seeds:
For those of you frantically reaching for Wikipedia right now, let me elucidate:
- GCHQ: Government Communications Headquarters. Originally established after the Great War, these are the government's codebreakers du jour, the same Bletchley Park boffins that cracked Germany's Enigma. Their main focus is to provide SIGINT and information protection to the British government.
- Anonymous is a group name for an unaffiliated band of hacktivists, who use their talents for political ends. It began life as a 4chan experiment back in 2003, and has been growing in notoriety ever since. It has attacked government, religious and corporate websites with DDoS tactics many times.
- LulzSec is a group often associated with Anonymous, which uses similar tactics but often has less lofty goals in mind. It's thought to be less effective these days, since one of its founders - Sabu, aka Hector Monsegur - turned informer after capture.
- DDoS aka Denial of Service, or Distributed Denial of Service, means exactly that. It denies service - blindsides the computer server - by clogging the system with thousands upon thousands of traffic requests.
- Edward Snowden, in case you've been living under a rock this past while, is a former NSA contractor who came into possession of a great deal of embarrassing data, which he revealed to the world. He's currently dodging prosecution. Speaking personally, I find it fascinating that so much of Snowden's data seems to come from power point presentations of one kind or another, which government agencies used to brief officials and staff. Anyone who believed that data was going to stay hidden - especially when given to third parties - is, at best, hopelessly naive, and probably oughtn't to be left in charge of a baby carriage, never mind an intelligence agency.
One of the biggest worries about this kind of reveal is that it shows just how quickly a government will resort to activities it publicly condemns in order to achieve its ends. Not that this is any kind of great secret; similar scandals are breaking all the time. But it is troubling to think that, at the drop of a hat, a Western government is willing to shut down chunks of the internet on the off-chance it contains something it doesn't like.
What does this suggest for Night's Black Agents?
To begin with, it suggests that the agent's own communications could be disrupted at any time. When GCHQ went after Anonymous, it didn't worry about whether or not the server it targeted also carried other traffic. It just shut the whole thing down. Imagine what that could mean to agents currently stranded in 'bandit country', relying on the net to communicate with allies.
It also suggests that, even with security measures in place, a government agency can obtain significant user data. The NBC article uses the example of a conversation between a JTRIG agent and a hacker named p0ke, in which the agent obtained p0ke's personal data - name, address, the lot - despite p0ke having a Virtual Private Network in place that, theoretically, should have kept its data safe. It's not clear whether this means JTRIG hacked the network, or used official contacts in the network's host country to break it.
From a game mechanic point of view, it's up to the Director whether or not identifying the source of a DDoS attack is Data Recovery or Military Science. I can see a case for either, or possibly even Human Terrain. Digital Intrusion is, of course, the ability you'd use to mount a DDoS attack. The difficulty with running that kind of test in-game isn't that it can't be done; it's that the skill itself is fairly abstruse. CyberPunk 2020 did its level best to make hacking fun, but even with all the ice-cool street samurai action, watching it unfold - if you're not involved yourself - is like watching particularly dull paint dry. Say what you like about the movie Hackers, but it at least knew how to make this stuff look good. Plus it had Penn Jillette of Penn and Teller in a cameo, which is worth at least two stars on anyone's rating.
Consider the following possible story seeds:
- What the hell? Every time I go online I gain Heat. It's almost as if someone has their hooks in my data, and is either tracking me themselves or passing on my information to people intent on hunting me down. The protagonist has been identified - falsely or not - as a member of Anonymous, LulzSec or a similar group. GCHQ, or a similar official organization, is cooperating with other agencies - possibly including the conspyramid, though whether GCHQ realizes who it's dealing with is a different matter - to expose the hacktivist, and arrange his or her capture.
- Oh sweet mother of mercy. Someone's bombarding me with tweets and chat messages. 'We know who you are'? Bullshit you do, but how did you get my data? The protagonist's personal information, or at least the information attached to his or her current identity, has been revealed by the VPN, acting under pressure from local authorities. But the real question is, are those messages coming from clueless government spooks, or someone else?
- Okay, who sent me that file? It's got a lot of juicy data in it, but can I trust it? In the course of carrying out an investigation, JTRIG - or the equivalent - came up with a lot of information on a hacker group that it thought was linked to Anonymous. It was ordered to back down and destroy all the files, but one of the JTRIG people, out of a misguided sense of outrage, decided to pass on the data to someone who might have a use for it. But things like that never stay secret, and now the higher authority that ordered JTRIG to back down is very interested in the protagonists.
- What!? What is this data doing up on the internet for everyone to see? LulzSec, or a similar group, picked up a lot of interesting stuff when it hacked a government site, and decided to publish. Among the data is a lot of very compromising stuff about the protagonists. Have they been cutting clandestine deals, dabbling in things they weren't supposed to touch? Whoops. Now the cat's out of the bag, and here comes the cat-catchers; GCHQ is very keen to find out who these people are and what they're up to. This can also work as part of a Snowden-inspired plotline.
Subscribe to:
Posts (Atom)