HARDWARE EVIDENCE↗
0/4Four physical tag slots
SECURITY ENGINEERING / FIELD OPERATIONS GX / 002
⊕ GHOSTKEY ADVERSARY ASSURANCE SYSTEM LAB BUILD 2.0
Every signal
has a story.
Trace the credential. Challenge the trust boundary. Prove what the evidence can—and cannot—establish.
00 real lock tests07 modeled threatsOFFLINE / READ-ONLY BY DEFAULT
ACCESS TRUST TOPOLOGYCONCEPT MODEL / NOT LIVE TELEMETRY
NFC METADATA POLICY RULES LOG EVIDENCETOPO // 001
P0 / FIELD VALIDATION STILL MISSING
Two real targets. No invented results.
Start by identifying the IHG card, then document legitimate door behavior and obtain authorized vendor audit evidence.
OPERATIONAL PICTUREREAL DATA IS LABELED / UNVERIFIED IS VISIBLE
THREAT VALIDATION⌁
0/7Synthetic scenario runs
DOOR INTELLIGENCE◫
0Imported or simulated events
PHYSICAL VALIDATION—
0Controlled lock tests to date
FIELD WORKFLOWS CHOOSE YOUR NEXT OPERATION
ENGAGEMENT GOVERNANCE ROE / 01
⌁
Rules of engagementRequired for physical NFC operations
POLICY / AHard boundary. No active hotel-key duplication, lock bypass, protected-sector extraction, or live-door command sequences.
PROVENANCE / WHAT WE ACTUALLY KNOW
Keep observation separate from interpretation.
OBSERVEDMIFARE Classic 1KOne white card + blue fob from earlier NFC Tools screenshots
NOT PROVENDoor authorizationNone connected
0%
OPERATION 02 / PASSIVE NFC TELEMETRY
The signal
workbench.
Tag discovery, reader-reported identity evidence, and controlled benign duplication. Every result is graded by what was actually measured.
AVAILABLE DEVICE SLOTSSELECT ONE TO ACQUIRE
◈
NFC / 13.56 MHz
SCANNER / PASSIVE READ
Choose a test device
Select a device. Use Chrome on Android with NFC enabled.
Unverified read detected
Device responded without a reader-reported identifier. This cannot prove the selected card was the source.
CLASSIFY / NFC TOOLS
Hardware fingerprint
For chips unsupported by Web NFC, enter the public technology from NFC Tools READ.
REPLAY / PAST EVIDENCE
Import existing scan
Bring your existing four-card JSON back into the analysis. Not a new live hardware scan.
EXPERIMENT 002 / LEGITIMATE REFERENCE CARD
ACTIVE CREDENTIAL — READ ONLYIHG hotel-card fingerprint
Record public NFC technology and NDEF record types from the card you legitimately hold. This is separate from the four blank test devices. No payloads, serial values, protected sectors or hotel access secrets are retained.
▤HOTEL / REF-01NOT ASSESSED
Use Chrome on Android. Scan only the legitimate card you hold, with no hotel identifiers recorded.
An active hotel access credential is NOT a cloning target. If Web NFC cannot read its NDEF, record the chip family from NFC Tools READ without accessing protected data.
EXPERIMENT 001 / NON-ACCESS NDEF
Controlled content replication
Write an identical, harmless demonstration message to each confirmed blank white card. This tests application-message copying—not credential cloning.
FIXED, NON-SECRET PAYLOAD
CPX-GHOSTKEY-LAB-NONACCESS-2026-10-31Only blank owned white cards. Never use a live hotel credential.
OPERATION 03 / DETECTION VALIDATION
Adversary
simulation.
Challenge security assumptions using reproducible threat fixtures. Run each scenario individually or execute the full battery. No real lock is contacted.
No simulations run. No physical lock connected.
THREAT SCENARIO MATRIXRED = RISK / GREEN = SYNTHETIC DETECTION / AMBER = UNPROVEN
OPERATION 04 / EVENT INTELLIGENCE
Read the trail.
Question the trail.
Cross-correlate authorization, revocation, and access anomalies. Lock event history must come from an authorized vendor export; the phone cannot extract it by tapping a door.
LOCK-SIDE PROFILE
Reader system
Reader-side metadata only. No door firmware, keys, RF exchanges, or entry history are retrieved from NFC browser scans.
EVENT INGEST
Source verification
Import a permissioned, anonymized event file—or run the clearly labeled synthetic dataset.
No verified door audit events are connected.
FIELD PASS / OBSERVED NORMAL USE
SELF-REPORTED / NOT AUDIT-PROVENDocument the door, not an invented exploit
Record a normal entry attempt to your assigned room using your legitimately issued hotel card. Do not try blank cards, the blue fob, copied keys, or unauthorized doors.
No physical access observation logged. A normal door response is not a vendor-authenticated audit event.
IHG card: not characterized · Lock protocol: unknown · Vendor audit: not supplied.
FINDINGS / EVENT CORRELATION
NO REAL LOCK EVENTSAudit anomalies
No events yet. Import authorized data or run the synthetic demo.
OPERATION 05 / EXAMINATION REPORT
Evidence over
assumption.
Independent observed facts, simulated threat fixtures, audit gaps, and defensible recommendations. Never claim a working attack from absent evidence.
PROVENANCE MATRIX
What can we substantiate?
REMEDIATION PRIORITY