How can I simulate fun and challenging computer hacking in a LARP?

Question

Occasionally, I like to do CTFs. For the uninitiated, a CTF is a computer security challenge in which a bunch of computer systems are left deliberately vulnerable, and participants exploit those vulnerabilities to recover information. Aside from being educational, it's a whole load of fun.

There's a real joy in taking a piece of software that you've never seen before, spotting that it behaves a bit oddly in certain situations, figuring out how you can turn it into an exploit, and then weaponizing it to recover that sweet data that you were after.

I am a crew member and ref with a sci-fi LARP system. Because of the sci-fi setting, hackers occasionally need to steal some data from a server or something. Unfortunately, the actual roleplay associated with it is a bit lame. The player usually sits down in front of a keyboard and box we've got set up, and they technobabble at it whilst mashing the keys for the requisite amount of time. The other players defend them from waves of monsters whilst the hacker is busy.

This smacks of those video games with "hold x to hack" prompts, and it feels underwhelming. I'd like for these sequences to involve some kind of challenge, that'd be able to bring about the same "feel" as these CTFs, with some actual interaction and challenge to them. I want players to feel like they're investigating and unravelling a system, but I don't want the players to have to all get bachelors degrees to be able to understand the actual real-world technobabble. I've no idea how I'd design such an encounter.

How could we improve our hacking roleplay?

Answer 1

The LARP I participate in uses a similar system (act out doing a thing for a certain time) in order to handle things like hacking, but we also sometimes uses puzzle boxes and devices to simulate situations that are either more complicated or just the writer had more resources available. Players will still need appropriate in-game skills to even attempt the task (i.e. read the instructions for how it works), but after that point it's entirely up to the character to complete the puzzle in however long it takes.

We don't have refs, but certain NPCs can adjudicate situations on the spot (writer, scene leader caster members).

Potential low-cost ideas you could use might be:

• Breadboard puzzle (get all the lights lit up - http://www.inversegenius.com/gsl-blog/2018/5/3/webbys-challenge-breadboard-puzzle)
• Horseshoe puzzle (get the rings off or on - https://www2.palomar.edu/users/warmstrong/trjuly98.htm)
• 3-d puzzle (I can't seem to find a good, cheap one, but they are out there. In general, avoid more than 10 pieces or something's going to get lost)
• Slide puzzles (make a picture - https://www.amazon.com/slp/slide-puzzles/bcpskfrqjhko62k)
• Smartphone puzzles (too many to list, but you can find one you like and just make the phone available for players to interact with)

In general, anything tactile can be used for this purpose as you're trying to instill a physical component to your LARP. The things I listed above could be used for hacking, but could just as easily be used for something like hot-wiring a car, solving a puzzle lock, or picking a lock.

One thing I will warn you about is to keep your puzzles EASY; however long it takes you to solve double or triple that for the players. You don't know who is going to get the puzzle and unless they do that kind of puzzle for fun, they'll probably have a hard time with it. Couple with the duress of combat, they will be even slower. As a LARP writer, your job is to permit the characters to simulate the skills their characters have, not the skills that the players have.

Answer 2

If you have a Nintendo Switch and some cheap Walkie-Talkies, I say:

Play "Keep Talking and Nobody Explodes"

In Keep Talking and Nobody Explodes, one player is trapped in a virtual room with a ticking time bomb they must defuse. The other players are the “Experts” who must give the instructions to defuse the bomb by deciphering the information found in the bomb defusal manual.

The hacker, at a defensive position, is given the Nintendo Switch (Or Laptop, but your mileage may vary on battery life) and a walkie-talkie.

The hacker is then challenged with defusing the bomb by communicating with the Expert. Bombs vary in difficulty pretty drastically!

I've played this game over walkie-talkies, and it definitely adds another layer of difficulty. I haven't ever tried it in an actual "tense" situation like a LARP, but it sounds like a blast.

The "Expert" can either be outside of the LARP or at a separate defensive position to read the manual.

Aside from running out the timer, a hacker may make too many mistakes and detonate the bomb. How you handle this is up to you! You can consider a detonated bomb a failed hacking attempt (IT locked you out! You've been sliced!) or the hacker can attempt again and the end-game is to defuse a single bomb.

Answer 3

Make it into a game of Solitaire, with some changes

FYI, I have no experience with LARPing, and haven't utilized a system like this in real life. I do have some experience with designing simple games.

Make sure each ref has a deck of cards, and each challenge a game of solitaire with a specific requirement needed to make. To speed things up, add random elements like stating that, for this round, suits don't matter, or the value of a face card is interchangeable with any other face card. Harder challenges require all the cards to be used (like a normal game of Solitaire), where easier challenges only require a single stack to be completed.

For when a hacker is having difficulty, always have the "brute force" timer available, when their "backup system" gets past the issues and the hack succeeds anyway, but this should always be longer than ideal. Base these as being slightly longer than what the existing system uses for a timer. So if it takes one of your current challenges 5 minutes of hacking, the solitaire system should be about 7 minutes for the brute force method.

If you need to balance it out, have two specific timers ready, one for the maximum time it should take for the challenge to complete (the brute force option), and one to prevent too early of access because of a lack of balancing the system (which is 5 minutes earlier than the brute force option).

Meaning that player decision making can only change things within a 5 minute time range. If they beat it too early, they won't break the event because they're super smart, and will have to wait for the minimal timer (say it's a catch up timer as their system is catching up to their fast programming). If they're too slow, the brute force system will solve it for them.

If they succeed before the brute force timer, they get to memorize one of the system's "loopholes" (the random rules used to modify the game) and can use it on a future hacking challenge.

Only one loophole can be saved this way, and each loophole can only be used once. After it is used, and the player succeeds on the new challenge, they may not keep the loophole they just used.

To add to the ominous feel and the tension, write the special rules on individual note cards. When a player encounters a hacking challenge, the ref simply hands the player the deck of cards and the note cards of special rules relevant to this challenge.

---

I suggested this as it does follow some trends of working a computer system in real life.

• You can teach yourself all of the basics and practice, practice, practice, but you will always find things that surprise you.

• Its strength and difficulty isn't always reliant on outside sources but usually dependent on you, which is why I chose Solitaire as the tool of choice.

• It isn't always about being the best or most thorough, it's often about finding the one abstract way that makes you succeed, and this version of Solitaire provides this via the abstract rulings.

• Last, but not least, you often find trends in systems that are noticeable in similar systems, and you may base a solution from one event from something you found in another, and the concept of "remembering" a loophole in my example utilizes this kind of idea.

Answer 4

Puzzle games on a tablet/phone

Assuming you can get some kind of cheap mobile device into the field, install a simple puzzle game (something like Flow Free) which the player has to solve to perform the hack.

Roleplay cards

In one game I play, surgery is done with a deck of cards. Every 30 seconds the surgeon character draws a card, which may say things are proceeding well or provide some kind of complication, e.g. "the patient is in cardiac arrest", "the patient's blood pressure is dropping". They then roleplay a response to the complication. When they draw a success card, the patient is stable.

Provide a deck of hacking cards along with the keyboard and box. They could be randomly shuffled, or if you want things to go a specific way you can stack the deck. The cards can give the players ideas for what kind of technobabble to deploy, or have them call for pieces of equipment, or ask people for the answer to a simple riddle - whatever feels suitably thematic for your game.

More experienced hacker players might get some extra cards to shuffle into the deck - things like 'effortly bypass your next complication while laughing at the idiots who thought that was going to stop you.'

Answer 5

What if you actually put a penetration practice simulator in front of them? They'd have to actually learn something about penetration testing... But Software Quality Assurance engineers have already created resources to simulate hacking, why not use them? I'm not suggesting you give them something like Kali Linux. But maybe make them play a simulator?

A quick google returns: https://cybercrip.com/hacking-simulator-games/