CH 00 · Independent security practice
NIIS 9 studies how wireless links, mobile platforms, and identity systems fail, measures what they leak to anyone listening, then models the adversary who will make them fail on purpose.
Sample air synthetic
CH 01 · Practice
Most security programs still treat radios as plumbing and phones as endpoints. The interesting failures sit in between: pairing, paging, attestations, public footprints, and identifiers that leak across layers.
Wi-Fi, Bluetooth, cellular, and proprietary links. Beacons, relays, coexistence, and the physical layer treated as a first-class trust boundary.
iOS and Android as hostile neighborhoods: sandbox edges, radio APIs, payment stacks, and the SDKs that quietly widen them.
Linkability of radio identifiers, device graphs, and “anonymous” telemetry. LINDDUN-shaped analysis for products that broadcast.
What a patient stranger can assemble about your organization, your devices, and your consenting people from public sources, before sending a single packet.
Adversary stories before scanners. Data-flow and trust-boundary work that includes spectrum, baseband, public footprint, and the human holding the device.
CH 02 · Selected work
Client names stay off this site. The problems do not. These sketches are representative of the work, not case-study theater.
A regional operator needed to know whether tap-to-ride tokens could be cloned at the platform edge, and whether the backend would notice.
Finding classRelay · token replay
A health system had retired pagers in policy only. Unauthenticated remnants sat beside a “modern” clinical app and a shared Wi-Fi estate.
Finding classCleartext paging · PHI on air
A payments SDK treated the phone’s NFC and BLE neighborhood as friendly. The model had to include the stranger one meter away.
Finding classProximity trust · NFC relay
A leadership team asked what a stranger could learn without touching their accounts. Wardriving records, a fitness segment, and a badge photo placed three of them at home.
Finding classPublic footprint · location inference
CH 03 · Method
NIIS 9 does not start with a scanner profile. Work begins with the adversary, the asset that actually matters, and the radio or mobile boundary that was treated as scenery. Testing exists to confirm, refute, or sharpen the model.
Name the asset, the adversary, and the authorization before any radio is touched.
Draw the system with spectrum on it: interfaces, identifiers, pairing state, SDKs, and public footprint.
Argue about trust on purpose. STRIDE and LINDDUN turn each boundary into a hypothesis worth testing.
Press only on what the model named. Manual, targeted, and bounded by the framing in step one.
Rank by operational impact. Write remediation that someone can actually put on a schedule.
CH 04 · Notes
5G hid a subscriber number and left a graph of radio behaviors that still correlate.
Read noteUnlock and payment flows still confuse “close enough” with “the intended peer.”
Read noteSTRIDE still works if the data flow includes spectrum, not just HTTP.
Read note