NEWS

[4e] Trace User against multiple private hidden nodes (retransmit or repeater)

  • 7 Replies
  • 3431 Views

Riggerjhadred

  • *
  • Newb
  • *
  • Posts: 4
« on: <02-04-14/0225:54> »
I'm having some trouble understanding various parts of Matrix... or at least... non-matrix, wireless security.  This particular question has to do with how Trace User works.  On the public matrix itself, it's easier to see how a trace can be done, since you're essentially tracing across several public nodes that allow you to check the path (I imagine like a tracert).
Say that a hacker or rigger has several slaved  (or non-slaved) re-transmitting drones or repeater drones which are all hidden, with signals and wireless links chained together at max range until they reach some imaginary point.    And at this imaginary point,  a corp spider has managed to locate the final hidden node, manages to hack into it and tries to do a Trace User.  How does this work?  Does it trace all the way back to the originating comm link/nexus?  Or does it trace to the next hidden/secure node that the spider would then have to hack into, and then continue the trace until it reaches the next one and so on?  And wouldn't it be better if this was the case to analyze the enemy node, and then spoof one of these re-transmitter drones to break signal contact and cause dumpshock?

RHat

  • *
  • Prime Runner
  • *****
  • Posts: 6317
« Reply #1 on: <02-04-14/0242:25> »
I might need to recheck Unwired, but as I recall Slaving has no impact on normal routing - that is, how connections are made between different devices.  If they're in Mutual Signal Range, they'll connect directly, but otherwise - regardless of any slaving or similar - the connection will route through any and all available wireless devices.  Just because the device won't accept a connection originating from a given device doesn't mean it rejects connections routed over that device in whole or in part.

Basically, this configuration doesn't help you at all against tracing and the like.
"Speech"
Thoughts
Matrix <<Text>> "Speech"
Spirits and Sprites

Riggerjhadred

  • *
  • Newb
  • *
  • Posts: 4
« Reply #2 on: <02-05-14/0001:47> »
In regards to slaving.... I'm actually thinking it does something like the opposite.  It states that it forwards all connection attempts to the master.  I'm sort of thinking in this situation that if anything, the trace would be rerouted directly to the hacker.

Are you referring to a public matrix?  Because I am not.  Regarding the automatic routing through all and any, is that the devices aren't necessarily set as fully available.  Use a layered approach, and that each node will require it's own authentication method.  We're not talking public matrix here that allows you to directly route public access across, but a private network.   I see the matrix like a chain of public access servers like modern day servers and the internet backbone.  However this doesn't mean I have any access to a private home network, or each workstation on that network.

Single user, or admin/security users.  And the other nodes are (at first) out of the range of the defender, only the end of the chain is in range.  Let us also state that in the original example, none of the other chains of drones are broadcasting a signal but are all laser linked.  Once you break into one, you can find the signal of the other, but even with the Access ID it's not going to let you subscribe and the previous authentication/password is different. 

Building corp security for example, the primary security node shouldn't be so easily traced and without public access to ping the next server in line or down the line, how can you tell the location?

p73 of unwired:
Layered Access
A spider can use an “onionskin” approach to security. In this
method, the network is configured to have multiple gateways, each
leading to the next. Unless the attacker can access the target node
directly, she will be forced to work her way into a desired target
one node at a time, slowing the attack and giving the system a
chance to defend itself.

Would track work over a system like this?


DeathStrobe

  • *
  • Omae
  • ***
  • Posts: 888
  • Front Range Free Decker
« Reply #3 on: <02-05-14/0205:45> »
In SR4 (and probably SR5) all devices are routers and forward Matrix traffic to the next device down the line until the data reaches its intended destination.

If you roll trace, you are sending packets that are slowly analyzing the packets of data to find their origin. Stealth will make this harder by masking the hacker's data trail, and spoof can add hits to the threshold test by sending false data for the trace test.

Basically, this all works by magic.

RHat

  • *
  • Prime Runner
  • *****
  • Posts: 6317
« Reply #4 on: <02-05-14/0209:55> »
As written, that doesn't impact routing, just what you have to do to hack in.  Given what it's meant to be mirroring, you'd think it should impact that stuff - but realistically, that would take an extremely large, robust, and decentralized network.
"Speech"
Thoughts
Matrix <<Text>> "Speech"
Spirits and Sprites

Riggerjhadred

  • *
  • Newb
  • *
  • Posts: 4
« Reply #5 on: <02-05-14/2215:19> »
Cool thanks.  Looks like it'll be up to my group in how we want to work out these things then.  There certainly is a lot of ...I believe I had read it as  handwavium.. and things that just don't seem to be considered.   While I didn't think it had stated that it worked one way or the other, there were so many scattered bits and pieces I never can tell if I'm missing something.
And yeah, pretty much in the ways of fairly decent hidden networks, since hidden nodes do state that they're invisible to other nodes, but never states if other nodes can route information through them if they don't know they're there, so we've taken it as that it doesn't. 
There's quite a bit that they never describe, or at least I can't find, like decreasing the power to signal so even if you have a signal 6, it can be lower, or just off.  Nor does it say anything about what the difference between multiple retransmitters are versus just routing your path through a private series of nodes on one path (different than your typical data split).  Wanted to make sure were were't getting "oh actually because of this and this, there's a penalty to your perception unless the tigerform is backflipping through fire hoops at the hours of 5 and 12."

RHat

  • *
  • Prime Runner
  • *****
  • Posts: 6317
« Reply #6 on: <02-05-14/2217:24> »
And yeah, pretty much in the ways of fairly decent hidden networks, since hidden nodes do state that they're invisible to other nodes, but never states if other nodes can route information through them if they don't know they're there, so we've taken it as that it doesn't. 

Actually, I'd assuming such routing is how you pick up on hidden nodes you don't know to look for (possible only with the Extended Test version of Detect Hidden Node).  Analysis of traffic patterns seem to be the way something like that would be accomplished.
"Speech"
Thoughts
Matrix <<Text>> "Speech"
Spirits and Sprites

Riggerjhadred

  • *
  • Newb
  • *
  • Posts: 4
« Reply #7 on: <02-06-14/2117:23> »
Ahh, I finally found what you were referring to. Completely separated from the other parts about what a hidden node is: p217  "The routing functions of a device are handled by a separate component of hardware than the other functions of the device.  This makes the routing process invisible to the user and allows the devices's node to connect to the Matrix even when it's operating in Hidden mode."

Been looking for two weeks for that information.  What I was going by was p 54 of Unwired which states
"Every wireless node can function as a router and will do so if not in passive or hidden mode"

Seems really silly from a security standpoint where you don't want things routing to the matrix, and it makes me wonder if there's a way to disable or remove that hardware since it doesn't mention that.  Instead, I guess that's why they use so much faraday cage designs.  Guess that's going to eventually be houseruled one way or the other, but I can now see that due to that module, there's no way not to route, even if you have everything down on Defcon 1 lockdown.

So now I think I have to ask....  What the heck is a retrans unit even for?  What benefit does it even give if you could just stick a few... or even just one high signal device to connect two other nodes?
« Last Edit: <02-06-14/2213:15> by Riggerjhadred »