Guide to Roleplaying "Hacking" on NationStates

[Yohannes]

---

____________________________________________________________________


Guide to Roleplaying “Hacking” on NationStates — Part 1


____________________________________________________________________

This guide has been written by the players behind the old International Incidents writer/resident Stoklomolvi and Yohannes for the benefit of the NationStates National and International Roleplaying community (with Stoklomolvi being the majority contributor).

__________________

Hi!

Since the new NationStates forum (i.e. this forum we are all using) was first set up in 2009 to replace the unholy Jolt, there has been the tendency on NationStates for National and International Roleplaying writers to assume that hacking is something that can be used as a kind of in-character “attack” against other roleplayers/writers participating in your RP thread — as some kind of a super elegant thing.

It is not.

And we are not just talking about whether it is unrealistic or realistic to do so. We are talking about borderline godmodding; something that should be avoided — that is, to claim that you can “hack” the other RP participants writing with you (without their permission) is just as bad as you saying “I have my nation’s soldiers in your land now; post your move.” It is something that is very bad, and should be avoided entirely unless the other players have given their full (read: clear) permission for you to make such a move.

Let us address one example of an old post that we’ve found on NationStates:

In addition to that, the botnets would be controlled via layers of proxies, denying easy identification of source countries, and be steadily expanding into various other nations via regular malware propagation methods. Given the NS world seems to be if not infinite, holding at least thousands of nations with perhaps trillions of devices among them, it would not be unreasonable to assume that blocking specific IPs at one point backfires or is unable to keep up.

The reason I have chosen the above post is because I’m not associated with the above poster, i.e. I hold no out-of-character or in-character interest for or against the poster in question (I don’t know who that person is).

What is wrong with the above “hacking” scenario post by the player Sinkretichki Kombinat?

And what can we do to avoid any such godmodding behaviour in future?

Let’s break it into half:

... In addition to that, the botnets would be controlled via layers of proxies, denying easy identification of source countries, and be steadily expanding into various other nations via regular malware propagation methods...

To start off, botnets are just remotely controlled machines. That is, they are nothing special. And people like to use “proxy” as a shield to say, “You will never find me!”

This is godmodding and should be avoided at all costs (if anyone do this to you, quickly call them out, politely, on it!), unless you (and your circle of roleplayers) like to do godmodding RPing — then that is fine. After all, NationStates has been and will always be an open world RP setting

What is a proxy? A proxy is just another node in a route from point A to point B. So if attacker sits at point A, proxy is at point B — and bot is at point C. And they want to attack location D in some country/nation. Let’s say, D is the nation “Grand World Order”. Well, the route would go from: A -> B -> C -> D, and even if they obfuscate point B, you (we, the fictional NationStates roleplayers) can still look up the chain.

But botnets are good at the thing they’re designed for — that is, large volumes of data transmission. So DDOS, or denial-of-service attack (i.e. something that fictional NationStates writers like to throw around as if it’s some kind of magic wand or magic spell) is easy. But the fact that they’re talking about proxies rather than something like P2P botnets — it will make you wonder: “What are they talking about?”

The second part of this sentence:

... regular malware propagation method...

Basically means social engineering. No need to make it too complicated in the hope of making clueless NationStates roleplayers (read: innocent players who can be fooled easily) confused. If there are government agencies trying to spread this sort of thing — stuxnet-like — then that’s basically grounds for war.

So what does that mean?

You have essentially declared war on the nation (you have targeted) preemptively. Like the Empire of Japan did with Pearl Harbour against the United States. But with technology.

Do not do this, unless you want your nation to be known as an international pariah. And if that is the case, then there is nothing wrong with this! (It’s actually a really good RP plot). But if you will then frame it as a “We will attack your nation secretly and there’s nothing that you can do about it” — then... don’t do this. This is very unethical and unfair behaviour, even for competitive roleplaying/storytelling.

In real life, it depends. Given the fictional “NationStates world” (i.e. the National and International Roleplaying and World Assembly’s General Assembly subforums) seems to be if not infinite, holding at least thousands of nations with perhaps trillions of devices among them, it would not be unreasonable to assume that blocking specific IPs at one point backfires or is unable to keep up.

The first part is true. The second part makes no sense to me — like, even an educated (and employed) tech person doesn’t understand what it means. Blocking specific IPs at one point backfires or is unable to keep up. Well, it’s not even wrong.

https://en.wikipedia.org/wiki/Not_even_wrong

The phrase "not even wrong" describes an argument or explanation that purports to be scientific but is based on invalid reasoning or speculative premises that can neither be proven correct nor falsified.

So, just how is information security handled?

How do breaches happen?

Invariably it’s because someone somewhere is being very very silly (i.e. an “idiot”).

From Google (the search engine): if you want to talk about true cracking, AES-256 is probably one of the more practical strong symmetric key encryption algorithms we have.

Out of the practical ones, is it the most secure? We’re not sure.

But for reference — breaking a symmetric 256-bit key by brute force requires 2,128 times more computational power than a 128-bit key. That is, 50 supercomputers that could check a billion billion (1018) AES keys per second (if such a device could ever be made) would, in theory, require about 3×10^51 years to exhaust the 256-bit key space.

That’s a very, very long time.

And if nations on NationStates are assumed to use one-time pads (which they should!), they are literally completely unbreakable. But we digress. For standard communication, one-time pads are not practical. So things like AES-256 is our next best thing.

And? Well... it is basically ridiculous to try to crack things.

So for now, we can’t. So as far as NationStates worldbuilding/fictional storytelling/roleplaying goes, as long as you are roleplaying as a Modern Technology nation, you’re good as far as encrypted messages go, as long as you’re not compromised or sending to the wrong target.

In NationStates Post-modern Technology setting... what if you are roleplaying as a Post-modern Technology nation?

Well... who knows?

But it is NationStates, after all.

Just make up something. “My super good encryption.... ”

And everything should be fine (i.e. nothing should happen to your nation).

[Yohannes]

---

You don’t need to describe it. We are not crypto scientists here — we are storytellers. But for any other hacking thing, social engineering is probably the number one. And well? Social engineering is just that — social. You need people for this to work. Botnets you could do internally, which would really be kind of silly, since if you have a “national botnet” (something fictional armchair generals like to throw around), and you attack someone, well they can just block your country/nation. And boom no more botnet

If you have international botnet, which is far more likely — you need permission from other players. Those zombie machines need to physically reside somewhere, and so you know whose nations have the zombies in them. And because you need people for social engineering to work, you cannot unilaterally declare someone compromised. That’s literally the equivalent of saying “I had a spy enter your castle and open your gates.”

Tell that to literally any player out there, and they will call you out on it. They are literally equally unethical and should be avoided even in a competitive RP setting. There are a variety of methods for social engineering to work. Phishing comes to mind. Or email scams. Or phone scams. Remote desktop control scams, USB attacks, and other things. Basically it boils down to “someone was being stupid.” If there are vulnerabilities in the platform being attacked, then the platform itself — being property of a NationStates player — needs to be allowed to be compromised (read: the other player must give his/her permission).

“Your programmers are all bad and they can’t make good platform” is not a valid argument/excuse for another player to be attacked successfully. Another common theme is “We have invested a lot of funding for information technology over the years, and because of that we can overpower you.”

Don’t do that...

That’s like “Your tanks suck and can’t block my super German King Tiger’s 140/L50 shots no matter what.”

But do vulnerable platforms exist? They do, and they are common in real life. But who says real life = NationStates? And if we are to assume that everything should be as close to real life situation as possible, then wouldn’t it be fair for us to assume that your mass Armageddon nationwide/international scale “hacking” would be just as unrealistic as they are in real life?

That is up for you, the player, to decide (and your friends/other writers). As we have said before, NationStates is a freeform RP “world”, and you (and your friends) are free to set up things the way you want!

As far as stealing passwords are concerned, or if someone says something like “pulling the strings hidden from view via proxies”, well — you can always just kidnap them (I mean, they have tried to pull the full scale technology play on you; why can’t you try something equally bad right?). Beat the Jefferson out of them until they confess. And then go to war.

This is a good illustration of that:



“Actual actual reality: nobody cares about his secrets. (Also, I would be hard-pressed to find that wrench for $5.)”

[Yohannes]

---

Okay, so the great Maxtopia (I hope Max Barry is not reading this... I still want to control my nation...) is about to invade my nation. Grrr... my government and people dislike Maxtopia and well honestly we think the Maxtopian government is an international bully — time to bring them down!

Say, I want to “hack” Maxtopia’s government headquarters. I say, hack the whole nation down! Well, I would outsource my hacking to someone else, if that is even possible (we are talking about “hacking” a whole nation here... I’m speechless). But that’s lame and won’t be effective.

“How about if my whole nation fires its national botnet to invade Maxtopia’s defence?”

Don’t do that...

Yup, “DDOsing” an entire nation — using some kind of centralised national infrastructure — is actually something. We have seen players tried this method before. And every time we have always smiled and played along, because why not? It is your nation, and you have the freedom to roleplay the way you want to!

But, why is “DDOSing an entire nation” bad?

Because the internet doesn’t work like that. A nation is not a single entity — that is, a nation’s internet is a collection of billions of endpoints. And we are talking about the fictional “NationStates world” here, after all! Billions upon billions of network nodes. Say, you want to turn this into a realistic real life world? I’m sorry for breaking your heart — but it doesn’t work like that.

Network infrastructure is typically robust enough to handle substantially greater than average load. For instance, if I am expecting 1 million requests to my endpoints per second, I’d probably build my infrastructure in anticipation of a possible 10 million requests, just in case. And if actual rate is 2-3 million requests per second, then I’d scale up my infrastructure again.

But what about “botnet”?

So like, if I were to use my theoretical super botnet to attack some site of the Maxtopian government (e.g. Army of Maxtopia, Bank of Maxtopia), I’d have to overpower any reserve capacity Maxtopia (army, bank, etc.) has in addition to its current capacity to start slowing it down. And I’d have to keep this up if I want to paralyse the Maxtopian official site.

Still though, how would I even do such a thing?

Say, do my bots have accounts registered with the Bank of Maxtopia?

Why would the Bank of Maxtopia allow that?

am I just accessing the Bank of Maxtopia’s official websites and not their back end servers?

In which case, all I’m doing is just inconveniencing the Bank of Maxtopia customers’ web surfing experience while doing very little economic damage — relatively speaking to, for instance, a total economic blockade. Like, “Oh no, this page took 10 seconds to load instead of 0.2 seconds.”

“What a disaster for the lad!”

If I do manage to crash the Bank of Maxtopia’s front end servers, that means that for some very weird reason the Maxtopian government has done something wrong and did not account for worst case scenarios — in which case, I would doubt the credentials of the great leader behind Maxtopia the nation (and the nation of Maxtopia is probably a third-rate nation stuck in the past).

Then, there’s also the assumption that, well, the Maxtopian government and their bank just don’t know where the botnet is coming from. If, say, I am using a botnet spread across three nations to attack the Bank of Maxtopia. And the Great Leader of Maxtopia figures it out. Well, they would immediately contact these three nations and the Great Leader of Maxtopia (and his/her government) would attempt to figure out where the attack is coordinated from. If, say, those three nations don’t want to cooperate with Maxtopia because they are friendly with me. Well... kinda SOL there but the Maxtopians can always throttle their connections with certain regions.

Physical areas. In real life, international police agencies would be hunting these types of groups down together. In the “fictional world” of NationStates, we would expect the World Assembly (or any other sensible world setting, whether open world or closed world) to have similar multilateral force/dominant nations ensuring no such thing will happen without consequences. In other words, if you have decided to employ this method, be prepared to accept that the other parties will do something equally out-of-whack.

This is the same as using nukes. Use it for cooperative storytelling — not for competitive RPing.

Botnets typically aren’t run by governments — that is, government-run cyber weapons can be considered just like regular weapons. I would be attacking the Empire of Maxtopia in a secretive and illicit way. But I can also bomb the Empire of Maxtopia in a secretive and illicit way. And then the Empire of Maxtopia would respond in kind. This is the reason why I would use a third party, and kill him/her/them later if there is no trust. Lame, I know. And even then, DDOS is not the vector I would use. To harm the Bank of Maxtopia, I would probably stuxnet it, or at least try to do it. Possibly, I would also set up spies in the traditional way by infiltrating people into the Government of Maxtopia (watch out for your allied governments, you never know if they will do this to you!)

After that, I would try to infect any networked devices via physical objects to bridge air gaps, and attempt to compromise as much as I can without the Maxtopian government figuring it out. If there is risk — abandon ship. If things go according to plan, I could perhaps shut down some critical services for a little while. Or I will just subtly (try to) make the nation of Maxtopia less efficient like in real life stuxnet.

All-in-all I wouldn’t be using “hacking” to attack the Maxtopian army, or to siphon money from the Bank of Maxtopia, or any other (admittedly very ambitious) things — that’s balderdash. There are of course other traditional methods, for instance, social engineering. But those methods depend on a bit of gullibility.

In conclusion, hacking is not a viable method; it is not some kind of secret weapon, to be used as an endgame against other NationStates writers — unless the other writers have given the permission for you to go ahead with this (admittedly very interesting) plot. For character-driven cooperative storytelling, hacking is a very good (read: interesting) thing. But for “competitive ” RPing? Use them as your last resort only, when the other nations have used something like nuclear weapons or have done many bad things. They are like nukes — they ruin RPs unless there is a good deal of cooperative storytelling or discussion already between writers/RPers.

There is no secret formula “to win” by “hacking.” If you want to win, you are better off trying to invade the nation (or do the usual NationStates thing). Don’t bother with hacking, because it’s usually best-suited for pinpoint things — and it would fall under general espionage. For instance, masquerade as an officer involved in some mission in the nation state of Maxtopia to receive some kind of password or key, and obtain records or information.

To assist in other things, for instance, if I am planning a secret attack on some government agency/organisation in the Empire of Maxtopia, I would then social engineer some information from some silly (read: clueless) GIs who don’t know the first thing of infosec. I might be able to thwart Maxtopia’s future attack with this knowledge. But knowledge and information do not translate into readiness or preparedness.

That is, even though I have “hacked” the information from the Empire of Maxtopia, if I don’t have the manpower or resources to defend whatever that information describes — I’m still just as SOL. Electronic attacks are commonly going to be about information, disruption, or retrieval, and in that case, a possible disruption technique could be man-in-the-middle (MITM) attack.

[The Corparation]

This seems like a decent guide so far. I'm a bit busy since I just started a new job with a rather long commute but I'd be willing to offer a couple suggestions / additions in the near future once I get a little more time. I think I'd be able to write up an okayish guide to how real "action movie" style hacking attacks work in real life and the work you can do to mitigate the damage that gives a little more detail than what you have already. Something like a walk through on a hypothetical attack on infrastructure. I'm a garbage writer but I can probably do a breakdown of the steps that need to happen for it all to fall into place. Also I suggest throwing "Cyber-warfare" into the thread title somewhere. "Cyber" is the big buzzword used rather than "hacking".
t. Work for an organization that does a lot of cybersecurity stuff and I hear/see the words cyber-warfare all the time.

[Yohannes]

This seems like a decent guide so far.

Thanks The Corporation!

I'm a bit busy since I just started a new job with a rather long commute but I'd be willing to offer a couple suggestions / additions in the near future once I get a little more time. I think I'd be able to write up an okayish guide to how real "action movie" style hacking attacks work in real life and the work you can do to mitigate the damage that gives a little more detail than what you have already. Something like a walk through on a hypothetical attack on infrastructure.

That'd be lovely. I've seen heaps of out-of-character drama happening from players arguing back and forth about hacking (or cybersecurity) and they've been pretty bad (as in the argument getting out of hand/ruining the RPs/warning, etc.) - I think it would be great to see more guides out there to debunk the myth that "hacking" (or cyberwarfare in general) can be used as a sort of fancy superweapon (i.e. nation A has used it against nation B and there's nothing that nation B can do about or nation B should be very afraid because of it), the better it would be I believe to prevent future incidents like the thread I've linked/example I've quoted above from happening again in future. That said, I understand why some NationStates rpers are attracted to full scale hacking/cyberwarfare/electronic warfare scenario (there's nothing wrong with that)

Also I suggest throwing "Cyber-warfare" into the thread title somewhere. "Cyber" is the big buzzword used rather than "hacking".
t. Work for an organization that does a lot of cybersecurity stuff and I hear/see the words cyber-warfare all the time.

I'll ask Stoklomolvi first (he is co-op)and ask for his permission to change the thread title. Thank you for the suggestion!

[The Macabees]

Great guide.

IMO*, re: cyberwarfare, cyberwarfare is broader than the topic of the guide.

Edit: * My unsolicited opinion.

[New Aeyariss]

If you permit to enter my few cents...

I do admit that I have been involved in this topic before. Partially, the issue is that in RL wise, there wasn't any significant conflict between major powers where both powers used fullness of their cyberwar arsenals - the greatest operations we have been able to witness so far were either few Russian kids taking down internet in Georgia for several days, Chinese hacking of US servers or recent Russian cyber operations directed against Ukraine. Though there were incidents like when Russians have successfully shut down a power plant, Cyberwarfare provided nowhere the "alpha strike" capability many people on NS want it to have.

A lot of this problem comes from the fact that few people have knowledge necessary to successfully understand what's it all about - and I admit that I am one of those people. Few months ago, I read in a cyber-security publication during a study that a botnet of a million computers could knock down internet infrastructure of an entire fist world country. So I suggested a friend to carry it out, but I have radically overestimated effectiveness of such an attack - and shortly after it turned out that the internet would be down for a day, few at most. This mistake had made me focus a lot of attention on cyberwarfare.

People need to understand that CW is not magic. It can be very efficient when used correctly; but it will NOT under any circumstances do everything for you. On the contrary, there is a massive cybersecurity market that has millions of specialists who are just waiting for their money to solve the problems for you. As such, cyberwar will be exactly that - a contest of wills, and considerable percent of the attacks will be defeated.

My own experience, though, is that you shouldn't stop trying. You learn through your mistakes.

[Danubian Peoples]

I have to say this is a very good guide. However, can you please elaborate on the defensive side of things? Like, how do I keep my employees from giving out passwords when their being hit with 5, no 6 dollar wrenches.XD

I mean, let's say someone is going to rp hacking my nuclear program, StuxNet style. How would I know that one of my workers is actually an operative, and how do I find out that he or she has implanted malware that will break all my equipment, and how do I stop said malware?

[Stoklomolvi]

A lot of this problem comes from the fact that few people have knowledge necessary to successfully understand what's it all about...

I think this area is a point of contention, but I feel that it's absolutely unnecessary to know everything to have a good story. Nobody is actually hacking anyone, and nobody is actually attacking anything; it's all fictional, after all. As long as all parties involved in a story understand that NS is ultimately just collaborative storytelling, and there's no fundamental misunderstandings, anyone can have a good time RPing cyberwarfare. You don't need to be an infosec professional to write a compelling and immersive cyberwarfare narrative, just as you don't need to be a career military officer to write a compelling and immersive conventional war story.

I mean, let's say someone is going to rp hacking my nuclear program, StuxNet style. How would I know that one of my workers is actually an operative, and how do I find out that he or she has implanted malware that will break all my equipment, and how do I stop said malware?

Emphasis my own. You're misunderstanding how Stuxnet works. It did not require a malicious operative. In fact, it operated under the assumption that it should be indiscriminately infecting and proliferating on any machine it touched. However, with some prior knowledge in its design, it was inactive unless some very specific conditions were met, since its target was centrifuges and mechanical devices, not personal computers. It spread from computer to computer either via USB to cross physical barriers (note that the originator of the worm could've been a victim himself; he may not have known his media devices were compromised) or via network between computers. It was more or less an "intelligent" worm that spread itself and did not require a handler.

[Danubian Peoples]

Well it looks like I was misinformed. i always thought whoever had his devices compromised was in on it, and that this worm required external action.

[Valentine Z]

As someone who is currently studying programming (but I'm not going into cybersecurity; more of AI), this guide pleases me so much.

For the hacking part, to add on a little that hacking is not someone bashing on the keyboard all the time that Hollywood shows you a lot. It's more of fire and forget. Even for sorting algorithms, simulations, or SAT (Boolean Satisfiability Problem), after you do the coding, all you need to do is wait. And wait... and maybe grab some coffee, and wait even more.

Granted, I am far from being an experienced programmer (just started, in fact), but hey, I do understand the realism that you need, unlike Hollywood most of the time.

And yup, just like most professions, it's okay if you don't know much about the computers themselves. Heck, I'm still learning as aforementioned, and that's why there're guides like this. I'm sure movies like Jurassic Park has scientists (zoologists, biologists, etc) telling the creative crew about the bunch of things that they need for the exposition or the sciency bit.

[New Aeyariss]

I think this area is a point of contention, but I feel that it's absolutely unnecessary to know everything to have a good story. Nobody is actually hacking anyone, and nobody is actually attacking anything; it's all fictional, after all. As long as all parties involved in a story understand that NS is ultimately just collaborative storytelling, and there's no fundamental misunderstandings, anyone can have a good time RPing cyberwarfare. You don't need to be an infosec professional to write a compelling and immersive cyberwarfare narrative, just as you don't need to be a career military officer to write a compelling and immersive conventional war story.

I have to disagree as well. No one needs to learn anything, that is right - but you can't deny that learning helps. I for once try to aim for maximum realism in everything I write about, at least in Hard MT sphere. Some of us simply want to keep our matters that way, and if others don't, then it's their right and they are free to do so.

[Stoklomolvi]

I have to disagree as well. No one needs to learn anything, that is right - but you can't deny that learning helps. I for once try to aim for maximum realism in everything I write about, at least in Hard MT sphere. Some of us simply want to keep our matters that way, and if others don't, then it's their right and they are free to do so.

You misread my post. I wrote "...unnecessary to know everything...", not "...unnecessary to know anything..." Learning is fine and all but the priority should not be on anything other than telling a story that everyone enjoys reading and participating in writing. Fun for all should be the primary goal of any roleplaying, as I'm sure you would agree.

[New Aeyariss]

I have to disagree as well. No one needs to learn anything, that is right - but you can't deny that learning helps. I for once try to aim for maximum realism in everything I write about, at least in Hard MT sphere. Some of us simply want to keep our matters that way, and if others don't, then it's their right and they are free to do so.

You misread my post. I wrote "...unnecessary to know everything[/i]...", not "...unnecessary to know [u]anything..." Learning is fine and all but the priority should not be on anything other than telling a story that everyone enjoys reading and participating in writing. Fun for all should be the primary goal of any roleplaying, as I'm sure you would agree.

While I believe that we should move this discussion elsewhere, there are those of us who like writing stories about military manoueveres. I don't see a reason how understanding what's happening in a story would have adverse effect on it.

Anyways, this is not the topic of the thread, so maybe we ought to move it elsewhere.

[Ardoki]

A really great idea to make this guide!