Quote from: jibbajibba;443058Why? If the PCs are smart and have the skills let them download the plans to the warehouse. Let them hack into the alarm system. Shit if they make the roles and have the nous let them kill the big bad guy by luring him into his primary Data centre tirggering the Halon firesystem then locking all the doors.

I fully agree with you.

I was just pointing out that GMs should remember the enemy may have the same resources and perhaps more time to use them and thus plan accordingly.

My example was from a Shadowrun game I played in a few years ago.  Our PCs ran into a trap set by counterhackers working for the Big Bad, but fortunately at the last minute the PC hacker detected waay too much high tech happening for the warehouse as described and they were able to vamoose before the TPK came down on them.  

We got our revenge though, Godfather style.  We knew the Big Bad was going to be shaking it a fancy new club and we set up a fake emergency roadblock on his path and blew his car to kingdom come.   Nothing says no witnesses like a well planned ambush.  

...and we coordinated our attack via cellphones.  Freshly bought Stuffer Shack total cheapos and our language was all coded in unrelated street slang of club goers.

One of the best ways to learn what to do about smart phones in RPGs is to go read real accounts of police actions and spies. Neuromancer is dated - you can't run a game using his assumptions about what tech will be like.

One of my favorite cyberpunk scenarios is post ww3 where low earth orbit was filled so much scrap that no one can put up a satellite or shuttle safely anymore. This alone knocks half of all the peoblem tech back down to 1995.

Quote from: RPGPundit;4431801. Technology proved to be a fantastic boon for the type of adventure I wanted to run.  [...] What having the internet does is basically speed everything up (potentially, see below) so you can get to the actual blowing shit up and people going nuts and world-ending-horror.

Absolutely. We've noticed this playing Masks of Nyarlathotep, and I'm growing more and more convinced that you can port this campaign to the 21st century and make it even better.

Couple of thoughts:

D20 features "Gather Information". The only thing smartphones really do is reduce the time required to make the check from hours to minutes. (And maybe bump up the DC; eyes on the ground are always going to be better at sussing out some information.)

9 times out of 10, if the players want to look something up I tell them to look it up on their own smartphones. Found something? Great. Didn't? Guess it's not on the 'net. (The exception would be things like prospectuses on fictional companies.)

Thanks for a lot of good advice fellas!

Quote from: Flying MiceReally, you need to build acces to information in at the start. ASsume  the characters can get info, and the research/whateverrolls mean *do the  get what they are looking for* rather than *can they find the means to  get their info*. In any information rich age, the problem is sorting the  wheat from the chaff. In an information poor age, the problem is  getting access to the wheat, because nobody would bother storing the  chaff. It would be winnowed first.

I think this hit my particular nail on the head. I really don't prep much for disseminating information to the players (I don't prep much at all actually ). Especially the "chaff" you mention.

I not really looking for foils (although I will definitely tinker with some of the ideas above). I was looking for ideas where smartphones remain as effective and useful as they are in real life but also yield interesting results/scenarios. Prepping interesting information beforehand may help with this, not to mention prepping some sporadic NPC communication (i.e. families checking up on them, banks calling, anonymous text messages etc.).


As for some of the foils I've used? Some of my group are pretty tech savvy and are well aware of what hacked Smartphones with custom software are capable of. So here's some interesting foils I came up with for certain scenarios I had with a very smart hardware hacker:

How many garbage, inneffectual and hidden wifi networks are they going to have to sort through to find the one they're trying to hack?

How many terribly written, opinionated blog articles do they have to read on a subject before they find some actual information?

Criminals are probably using cloned Sim cards. Trying to track them with GPS will yield possibly hundreds of results nationwide.

Their Facebook profile is set to private.

Quote from: Koltar;443125Jibba,

 When I first got a cell phone around 5 or 6 years ago, several of my close friends joked that it was one of the early signs of the oncoming apocalypse.

("Ed got a cellphone? Quick someone check if Jerusalem has a blizzard this week .")


- Ed C.

I don't even HAVE a cellphone...sellout...

Quote from: Koltar;443125Jibba,

 When I first got a cell phone around 5 or 6 years ago, several of my close friends joked that it was one of the early signs of the oncoming apocalypse.

("Ed got a cellphone? Quick someone check if Jerusalem has a blizzard this week .")


- Ed C.

Fair enough, but in real life I would expect a group of half a dozen or so comprising of students, housewives and teachers to have at least a couple of smartphones between them. The market penetration is much greater than I think you realise.

For $150 and $25/mo in service, I can get an LG Optimus V from Virgin Mobile.

This is an Android device, which is essentially a Java-heavy version of Linux running on a handheld.  A simple rooting will give me access to it's command line and thus allow me to run the full suite of Unix tools with a quick internet download, which means a real hacker who knows how to work magic with the command line can get a long way.

However, he first needs access to the server.  That means one of two routes: Local, or remote.

Local means he's in pr near the building, and the only way to connect to a local area network via a smartphone is through Wi-Fi, there's no Cat-5 plug on a smartphone, and that's a problem.  Any corporate or government office that isn't retarded is gonna be running TKIP WPA2 Enterprise encryption, which is pretty much uncrackable.  It's a temporary key system that even the employees don't know because it's all been preconfigured for them by IT.  You might be able to get in via smaller satellite offices of your target organization though, who might be using weaker encryption on an under-used machine.  Here, you're going to be doing old fashioned legwork, social engineering as the hackers say, that means phishing scams, impersonations, dumpster diving, whatever it takes to get the password.  You could also try stealing an employee's corporate issued phone, which is more legwork, not computer magic.

Remote means Internet, which is a crap shoot.  It could take weeks of research and social engineering to find an open vulnerability on a target server.  The newsmedia makes big deals out of guys like Anonymous, but the truth is most of their work is done with Denial of Service attacks, which are primitive as hell and only serve to bring down web servers.  A smart company has that cordoned off from their mission-critical systems, so all it is is a nuisance.

More nasty hacks like the HBGary situation involved careful research of the company's component systems to find the right vulnerability on the right server, and tunnel into the rest of the server from there.  That takes time, you might pull it off in a day and a half with a dedicated distributed team like Anonymous, but a lone PC with a cheap smartphone isn't going to just whipping it out and tapping out a few commands and be in in under 10 minutes, like you see in the movies.

And another important thing to remember too is that a smartphone has a fraction the power and speed of a full desktop unit, which is why serious cracks are going to be done on at least a proper laptop.  Dictionary cracks are going to take ages on a smartphone device, and the interface and speed of the device is going to make anything more than simple tricks painful and slow.

As for information access, well, that's all over the place.  Spend some time in a local cellphone store or Best Buy poking around online.  The size of the screen and the reduced performance makes it really, really, really fucking annoying for time-sensitive research.  These things are built for casual browsing, and there's a reason so much gets offloaded to dedicated apps put out by websites.  It's better now than it was even 5 years ago, but it still will never compete with a full computer or a tablet (which is why I bought an iPad and sold my Nexus One).

Smartphones aren't magic bullets.  They're handy devices for consumer level use and occasional minor network management tasks if you have the knowhow to get them rooted and opened up to run the right apps.  Otherwise, they're for casual websurfing and checking Facebook status and playing Angry Birds on the bus.  It's what they're made for.

Nice post, J Arcane.

Thank you J Arcane!

Would you assume hacking vs. IT defense will continue in its present balance of power as you move forward in tech levels, say into cyberpunk games or into Traveller?

Also, what about those hacker PCs are espionage agents or equivalent training and resources?  How much computer firepower exists on the high end and how do the commercial IT defenses stand against them?

Another point to consider is genre emulation vs. realism.  In a cinematic, James Bond setting where hackers can hack corporate databases with their smartphones, what kinds of IT defenses would villains bring to bear against them?

The HBGary Federal hack relied on social engineering, which is something drastically under-rated in most hacking systems in games, but which has played an important role in almost every big real hack and online scam I've ever read about.

IIRC, Anon spent most of its technical effort getting into Barr's email, and then just emailed a tech for the password to the rest of the system, which he provided without question.

The most useful thing your smartphone can do to get into a secure system is call someone who knows the password so they can give it to you.

Pseudo is dead on. At the end of the day, the weakest point in any system is people.

The smart hackers are the ones that know social engineering, know how to run a good con, know how to take advantage of trust or people's assumptions about things. As the saying goes, you can get almost anywhere you want with a clipboard and a name on your jacket.

There's lots of technical tools out there on both sides, but they're only as good as the people using it. If they've got a weak password, or can easily be distracted or conned, or they aren't running their updates promptly, it doesn't matter if they're digital Fort Knox.

Basically, think more Burn Notice and less The Net.

Quote from: J Arcane;444656For $150 and $25/mo in service, I can get an LG Optimus V from Virgin Mobile.

This is an Android device, which is essentially a Java-heavy version of Linux running on a handheld.  A simple rooting will give me access to it's command line and thus allow me to run the full suite of Unix tools with a quick internet download, which means a real hacker who knows how to work magic with the command line can get a long way.

However, he first needs access to the server.  That means one of two routes: Local, or remote.

Local means he's in pr near the building, and the only way to connect to a local area network via a smartphone is through Wi-Fi, there's no Cat-5 plug on a smartphone, and that's a problem.  Any corporate or government office that isn't retarded is gonna be running TKIP WPA2 Enterprise encryption, which is pretty much uncrackable.  It's a temporary key system that even the employees don't know because it's all been preconfigured for them by IT.  You might be able to get in via smaller satellite offices of your target organization though, who might be using weaker encryption on an under-used machine.  Here, you're going to be doing old fashioned legwork, social engineering as the hackers say, that means phishing scams, impersonations, dumpster diving, whatever it takes to get the password.  You could also try stealing an employee's corporate issued phone, which is more legwork, not computer magic.

Remote means Internet, which is a crap shoot.  It could take weeks of research and social engineering to find an open vulnerability on a target server.  The newsmedia makes big deals out of guys like Anonymous, but the truth is most of their work is done with Denial of Service attacks, which are primitive as hell and only serve to bring down web servers.  A smart company has that cordoned off from their mission-critical systems, so all it is is a nuisance.

More nasty hacks like the HBGary situation involved careful research of the company's component systems to find the right vulnerability on the right server, and tunnel into the rest of the server from there.  That takes time, you might pull it off in a day and a half with a dedicated distributed team like Anonymous, but a lone PC with a cheap smartphone isn't going to just whipping it out and tapping out a few commands and be in in under 10 minutes, like you see in the movies.

And another important thing to remember too is that a smartphone has a fraction the power and speed of a full desktop unit, which is why serious cracks are going to be done on at least a proper laptop.  Dictionary cracks are going to take ages on a smartphone device, and the interface and speed of the device is going to make anything more than simple tricks painful and slow.

As for information access, well, that's all over the place.  Spend some time in a local cellphone store or Best Buy poking around online.  The size of the screen and the reduced performance makes it really, really, really fucking annoying for time-sensitive research.  These things are built for casual browsing, and there's a reason so much gets offloaded to dedicated apps put out by websites.  It's better now than it was even 5 years ago, but it still will never compete with a full computer or a tablet (which is why I bought an iPad and sold my Nexus One).

Smartphones aren't magic bullets.  They're handy devices for consumer level use and occasional minor network management tasks if you have the knowhow to get them rooted and opened up to run the right apps.  Otherwise, they're for casual websurfing and checking Facebook status and playing Angry Birds on the bus.  It's what they're made for.

Good post but ... you don't run the hack from your smart phone you run the hack from your server or from the server someplace with no security that you trojaned a couple of months back or even an array of servers that you mashed into some sort of botnet device. You just use the smartphone to access your server and maybe update a couple of scripts to identify the target or whatever.

Quote from: RPGPundit;443180(...) In real life, I can't fucking stand cellphones. I seriously think I may be one of the last adults left in the entire country without a cellphone.

I also don't own a cell phone and may just be in the same position as you in the country I live in. I can't stand the retarded need for continuous long-distance empty communication and the fact that people expect to be able to contact you everywhere and at any time. (The only way people are guaranteed to contact me is by email, by the way, since my home phone line is also shut off most of the time.)

As for the use of internet (be it on a smartphone or through another device) in modern time scenarios, I don't have a problem with it. Library Use or Internet Use, it basically comes down to the same: research skills and getting access to the information.

And remember, the bad guys can be doing all the same stuff; they could be googling the PCs even as the PCs are googling them.

RPGPundit