{ "@context": { "skos": "http://www.w3.org/2004/02/skos/core#", "dct": "http://purl.org/dc/terms/", "ost": "https://ostering.com/taxonomies/ns#", "xsd": "http://www.w3.org/2001/XMLSchema#", "inScheme": { "@id": "skos:inScheme", "@type": "@id" }, "broader": { "@id": "skos:broader", "@type": "@id" }, "narrower": { "@id": "skos:narrower", "@type": "@id" }, "hasTopConcept": { "@id": "skos:hasTopConcept", "@type": "@id" }, "topConceptOf": { "@id": "skos:topConceptOf", "@type": "@id" }, "closeMatch": { "@id": "skos:closeMatch", "@type": "@id" }, "broadMatch": { "@id": "skos:broadMatch", "@type": "@id" }, "related": { "@id": "skos:related", "@type": "@id" }, "prefLabel": { "@id": "skos:prefLabel", "@language": "en" }, "definition": { "@id": "skos:definition", "@language": "en" }, "scopeNote": { "@id": "skos:scopeNote", "@language": "en" }, "notation": "skos:notation", "title": { "@id": "dct:title", "@language": "en" }, "license": { "@id": "dct:license", "@type": "@id" }, "rights": { "@id": "dct:rights", "@language": "en" }, "creator": "dct:creator", "issued": { "@id": "dct:issued", "@type": "xsd:date" }, "hasVersion": "dct:hasVersion", "source": { "@id": "dct:source", "@type": "@id" }, "principle": { "@id": "ost:mitigationPrinciple", "@language": "en" }, "measure": { "@id": "ost:designMeasure", "@language": "en", "@container": "@list" }, "stride": "ost:stride", "physicalSafety": { "@id": "ost:physicalSafety", "@type": "xsd:boolean" }, "rank": "ost:rank", "seenInTheWild": { "@id": "ost:seenInTheWild", "@language": "en" }, "game": { "@id": "ost:game", "@language": "en" } }, "@graph": [ { "@id": "https://ostering.com/taxonomies/smart-home/", "@type": "skos:ConceptScheme", "title": "Smart Home Threat Taxonomy", "hasVersion": "1.0", "issued": "2026-11-03", "creator": "Brett Crawley", "license": "https://creativecommons.org/licenses/by-nc-nd/4.0/", "rights": "Smart Home Threat Taxonomy v1.0. © 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 (https://creativecommons.org/licenses/by-nc-nd/4.0/), with additional permissions from the copyright holder: you may use it in commercial threat modeling work, use it for internal training, and quote individual entries with attribution. Shipping it in a product or service, in whole or in part, needs the author's written permission. Attribution: Smart Home Threat Taxonomy v1.0, Brett Crawley, https://ostering.com/taxonomies/smart-home/", "game": "Open House", "hasTopConcept": [ "https://ostering.com/taxonomies/smart-home/hub-and-bridges/", "https://ostering.com/taxonomies/smart-home/radio-and-mesh/", "https://ostering.com/taxonomies/smart-home/domotics/", "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/", "https://ostering.com/taxonomies/smart-home/alarms-and-locks/", "https://ostering.com/taxonomies/smart-home/appliances/", "https://ostering.com/taxonomies/smart-home/energy/", "https://ostering.com/taxonomies/smart-home/home-network/", "https://ostering.com/taxonomies/smart-home/vendor-cloud/", "https://ostering.com/taxonomies/smart-home/remote-control/", "https://ostering.com/taxonomies/smart-home/voice-and-automations/", "https://ostering.com/taxonomies/smart-home/household/", "https://ostering.com/taxonomies/smart-home/lifecycle/", "https://ostering.com/taxonomies/smart-home/structural-hazards/" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/", "@type": "skos:Concept", "notation": "OPH-HB", "prefLabel": "Hub and Bridges", "definition": "The hub is the house's local brain: it holds the network keys for every device, runs the rules and speaks for the house to the cloud. Whoever owns the hub owns the house.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "topConceptOf": "https://ostering.com/taxonomies/smart-home/", "narrower": [ "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-A", "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-K", "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-Q", "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-J", "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-10", "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-9", "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-8", "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-7", "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-6", "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-5", "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-4", "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-3", "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-2" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-A", "@type": "skos:Concept", "notation": "OPH-HB-A", "prefLabel": "Hub Holds Every Key", "definition": "The hub stores the Zigbee, Z-Wave and Thread network keys, every pairing secret and the tokens for each linked cloud in one place, so a single compromise of the hub is a compromise of the whole house.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/", "principle": "Treat the hub as the home's root of trust, and limit what any one compromise of it yields.", "measure": [ "Keep network keys and tokens in a secure element or the platform keystore, never in plain configuration files.", "Scope each integration's token to the devices and actions it needs, so one leak does not hand over every device.", "Support re-keying each radio network after a suspected compromise without re-pairing every device by hand." ], "stride": "E, I", "physicalSafety": true, "rank": "A", "closeMatch": [ "https://capec.mitre.org/data/definitions/37.html", "https://cwe.mitre.org/data/definitions/522.html" ], "broadMatch": [ "https://cwe.mitre.org/data/definitions/312.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-K", "@type": "skos:Concept", "notation": "OPH-HB-K", "prefLabel": "Unauthenticated Local API", "definition": "The hub exposes an HTTP, WebSocket or MQTT interface that trusts anything on the home network, so any compromised device or visitor's phone on the Wi-Fi can drive the locks and the alarm.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/", "principle": "Authenticate every local client; the home network is not a trust boundary.", "measure": [ "Require paired, per-client credentials (tokens or mutual TLS) for every local interface.", "Separate read scopes from control scopes, and require confirmation for locks, alarms and heat appliances.", "Ship unused local protocols (MQTT, Telnet, UPnP control points) disabled." ], "stride": "S, E", "physicalSafety": true, "rank": "K", "closeMatch": [ "https://cwe.mitre.org/data/definitions/306.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-Q", "@type": "skos:Concept", "notation": "OPH-HB-Q", "prefLabel": "Admin Page Driven from a Web Page", "definition": "The hub's admin pages can be driven by any web page a household browser visits, through cross-site requests, DNS rebinding or script in device names, so a malicious advert reconfigures the house.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/", "principle": "Treat every browser on the home network as an untrusted intermediary.", "measure": [ "Check the Host and Origin headers on every request to block DNS rebinding.", "Protect every state-changing call with anti-forgery tokens and SameSite cookies.", "Encode device-supplied names and labels wherever the interface renders them, behind a strict Content Security Policy." ], "stride": "T, E", "physicalSafety": false, "rank": "Q", "closeMatch": [ "https://capec.mitre.org/data/definitions/62.html", "https://cwe.mitre.org/data/definitions/352.html", "https://cwe.mitre.org/data/definitions/346.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-J", "@type": "skos:Concept", "notation": "OPH-HB-J", "prefLabel": "Integration Runs as the Hub", "definition": "Third-party integrations, add-ons and community components run inside the hub process with its full rights, so one malicious or compromised integration reads every key and drives every device.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/", "principle": "Run each integration with least privilege, isolated from the core and from the others.", "measure": [ "Run integrations in separate processes or containers with declared permissions per device class.", "Sign and review integrations in the store, and show the publisher and permissions before install.", "Let the owner revoke an integration and every token it holds in one step." ], "stride": "E, T", "physicalSafety": false, "rank": "J", "closeMatch": [ "https://capec.mitre.org/data/definitions/446.html", "https://cwe.mitre.org/data/definitions/829.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-10", "@type": "skos:Concept", "notation": "OPH-HB-10", "prefLabel": "Device Reports Become Commands", "definition": "The hub renders or evaluates whatever a device reports (its name, model string or attribute values), so a malicious or spoofed device injects script into dashboards or expressions into rules.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/", "principle": "Treat everything a device reports as untrusted input.", "measure": [ "Validate reported values against the device type's schema and physical range.", "Encode device-supplied strings everywhere they are displayed.", "Never pass device data into shell commands, templates or rule expressions without escaping." ], "stride": "T", "physicalSafety": false, "rank": "10", "closeMatch": [ "https://capec.mitre.org/data/definitions/592.html", "https://cwe.mitre.org/data/definitions/79.html" ], "broadMatch": [ "https://cwe.mitre.org/data/definitions/1287.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-9", "@type": "skos:Concept", "notation": "OPH-HB-9", "prefLabel": "Join Mode Left Open", "definition": "The hub accepts new devices whenever join mode is on, for minutes at a time, from a remote command and without an install code, so a device within radio range joins the network and receives its key.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/", "principle": "Make joining a short, deliberate, local and authenticated act.", "measure": [ "Require install codes, QR setup codes or a DSK (Zigbee install codes, Z-Wave S2, Matter setup payloads).", "Open join windows only from a physical action, keep them short, and show that they are open.", "Notify the owner of every new device and hold it out of automations until confirmed." ], "stride": "S, E", "physicalSafety": false, "rank": "9", "broadMatch": [ "https://capec.mitre.org/data/definitions/151.html", "https://cwe.mitre.org/data/definitions/1390.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-8", "@type": "skos:Concept", "notation": "OPH-HB-8", "prefLabel": "Debug Port Left Open", "definition": "Hubs ship with UART consoles, JTAG, SSH, Telnet, ADB or a vendor support tunnel enabled, so anyone with the box in hand, or on the network, gets a root shell.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/", "principle": "Ship hubs in release configuration, with every non-production interface closed.", "measure": [ "Lock or fuse debug interfaces, and require authentication on any console that remains.", "Open a vendor support tunnel only per session, with the owner's consent, and log it.", "Inventory listening services in release testing and fail the build on any that are unexpected." ], "stride": "E", "physicalSafety": false, "rank": "8", "closeMatch": [ "https://capec.mitre.org/data/definitions/121.html", "https://cwe.mitre.org/data/definitions/1191.html", "https://cwe.mitre.org/data/definitions/1269.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-7", "@type": "skos:Concept", "notation": "OPH-HB-7", "prefLabel": "Backup Carries the House", "definition": "Hub backups hold every key, token, the Wi-Fi password and the camera credentials, and are written unencrypted to cloud drives, network storage or email.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/", "principle": "A backup holds the same secrets as the hub, so protect it like the hub.", "measure": [ "Encrypt backups by default under a key the owner holds.", "Wrap secrets separately so a partial backup can be shared for support without them.", "Warn when backups go to a location outside the owner's control." ], "stride": "I", "physicalSafety": false, "rank": "7", "closeMatch": [ "https://cwe.mitre.org/data/definitions/312.html" ], "broadMatch": [ "https://capec.mitre.org/data/definitions/150.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-6", "@type": "skos:Concept", "notation": "OPH-HB-6", "prefLabel": "Bridge Flattens Trust", "definition": "A bridge translates a weak link (433 MHz, legacy Zigbee, a cloud-only device) into a strong one (Matter, the hub's own API) and drops its security level, so the controller treats an unauthenticated device as authenticated.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/", "principle": "Carry the security level of the weakest hop through to the controller and the user.", "measure": [ "Expose each bridged device's underlying link security as an attribute the controller can read.", "Refuse unlock and disarm commands through links that cannot authenticate.", "Mark bridged devices visibly in every app and dashboard." ], "stride": "S, T", "physicalSafety": false, "rank": "6", "broadMatch": [ "https://capec.mitre.org/data/definitions/700.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-5", "@type": "skos:Concept", "notation": "OPH-HB-5", "prefLabel": "Hub Down, House Dumb", "definition": "When the hub crashes, reboots, loses power or its storage fails, the devices that depend on it stop working: lights, heating schedules, the alarm, the door.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/", "principle": "Design for the hub being absent; every device keeps a safe state and a manual control.", "measure": [ "Have devices hold their last safe state and keep local manual control when the hub disappears.", "Add a watchdog and battery backup to hubs that control security or heating.", "Alert the owner when the hub stops checking in, through a path that does not need the hub." ], "stride": "D", "physicalSafety": true, "rank": "5", "broadMatch": [ "https://cwe.mitre.org/data/definitions/754.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-4", "@type": "skos:Concept", "notation": "OPH-HB-4", "prefLabel": "Chatty Device Starves the Hub", "definition": "A faulty or malicious device floods the hub with reports or joins, so rule processing backs up and an alarm or leak event is acted on minutes late.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/", "principle": "Give safety events their own lane, and bound what any one device can consume.", "measure": [ "Rate-limit reports per device and quarantine a device that exceeds them.", "Process alarm, smoke, leak and lock events in a priority queue ahead of telemetry.", "Report queue delay as a health metric and alert when it grows." ], "stride": "D", "physicalSafety": false, "rank": "4", "closeMatch": [ "https://capec.mitre.org/data/definitions/125.html", "https://cwe.mitre.org/data/definitions/770.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-3", "@type": "skos:Concept", "notation": "OPH-HB-3", "prefLabel": "Clock Moved, Rules Fire", "definition": "The hub takes its time from unauthenticated NTP or the network, so an attacker who shifts the clock fires 'morning' rules at night, expires certificates or replays one-time codes.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/", "principle": "Authenticate time, and bound how far and how fast it may move.", "measure": [ "Use authenticated time (NTS) from more than one source, with a real-time clock as a sanity check.", "Reject or flag jumps larger than a set threshold, and hold security schedules until time is trusted.", "Log every time correction with its size and source." ], "stride": "T", "physicalSafety": false, "rank": "3" }, { "@id": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/#OPH-HB-2", "@type": "skos:Concept", "notation": "OPH-HB-2", "prefLabel": "Logs Without Names", "definition": "The hub records that the door unlocked or the alarm disarmed, but not which user, app, integration or rule caused it, and a reset wipes the log, so an incident cannot be reconstructed.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/hub-and-bridges/", "principle": "Attribute every security-relevant action to a person or a rule, and keep the record off the hub.", "measure": [ "Record the actor, channel and rule behind every lock, alarm and access change.", "Forward security events to storage that survives a hub reset.", "Let every adult in the household read the security log." ], "stride": "R", "physicalSafety": false, "rank": "2", "closeMatch": [ "https://cwe.mitre.org/data/definitions/778.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/", "@type": "skos:Concept", "notation": "OPH-RF", "prefLabel": "Radio and Mesh", "definition": "Zigbee, Z-Wave, Thread, Bluetooth, Wi-Fi and the 433 and 868 MHz bands carry the house's commands through walls and past the property line. Anyone within range is part of the network's threat model.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "topConceptOf": "https://ostering.com/taxonomies/smart-home/", "narrower": [ "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-A", "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-K", "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-Q", "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-J", "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-10", "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-9", "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-8", "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-7", "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-6", "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-5", "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-4", "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-3", "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-2" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-A", "@type": "skos:Concept", "notation": "OPH-RF-A", "prefLabel": "Replayed Command", "definition": "Fixed-code or weakly protected radio commands (garage doors, gates, alarm fobs, some locks) can be recorded and replayed, and rolling codes fall to jam-and-replay.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/", "principle": "Every actuation command must be fresh and authenticated.", "measure": [ "Use challenge-response or authenticated encryption with counters for every command that opens or disarms.", "Reject out-of-window counters, and alert when jamming is followed by a valid code.", "Do not ship fixed-code radios for doors, locks or alarms." ], "stride": "S, T", "physicalSafety": true, "rank": "A", "closeMatch": [ "https://cwe.mitre.org/data/definitions/294.html" ], "seenInTheWild": "RollJam (Samy Kamkar, DEF CON 23, 2015)", "source": "https://gizmodo.com/32-worth-of-electronics-can-open-almost-any-keyless-ca-1723072763" }, { "@id": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-K", "@type": "skos:Concept", "notation": "OPH-RF-K", "prefLabel": "Jammed Alarm Link", "definition": "Wireless alarm sensors and sirens are jammed, so an intrusion or a fire never reaches the panel, and the panel reads the silence as normal.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/", "principle": "Treat jamming and loss of supervision as alarm events in their own right.", "measure": [ "Supervise every wireless sensor with heartbeats and alarm on a missed deadline.", "Detect sustained RF interference and report it to the monitoring path.", "Give critical zones a wired or second-band fallback." ], "stride": "D", "physicalSafety": true, "rank": "K", "closeMatch": [ "https://capec.mitre.org/data/definitions/601.html" ], "broadMatch": [ "https://cwe.mitre.org/data/definitions/754.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-Q", "@type": "skos:Concept", "notation": "OPH-RF-Q", "prefLabel": "Network Key Sent in the Clear", "definition": "Devices join under a publicly known key (the Zigbee default trust centre link key, the all-zero Z-Wave S0 temporary key), so a sniffer in range during pairing captures the network key.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/", "principle": "Never transport a network key under a key the world knows.", "measure": [ "Require Zigbee 3.0 install codes, Z-Wave S2 with a DSK, or Matter commissioning with a PAKE.", "Refuse legacy security for lock, alarm and garage device classes.", "Re-key the network when a legacy device must join, and log it." ], "stride": "I, S", "physicalSafety": false, "rank": "Q", "closeMatch": [ "https://capec.mitre.org/data/definitions/157.html", "https://cwe.mitre.org/data/definitions/1394.html", "https://cwe.mitre.org/data/definitions/322.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-J", "@type": "skos:Concept", "notation": "OPH-RF-J", "prefLabel": "Downgrade to Legacy Security", "definition": "An attacker forces a device to pair in an older mode (Z-Wave S2 to S0, Bluetooth legacy or Just Works pairing), so the weak key exchange becomes the one in use.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/", "principle": "Pin a minimum security level per device class and refuse to go below it.", "measure": [ "Have controllers refuse S0 and legacy pairing for security device classes.", "Record the negotiated security level and alert when it is lower than the device supports.", "Use Bluetooth LE Secure Connections only." ], "stride": "T, I", "physicalSafety": false, "rank": "J", "closeMatch": [ "https://capec.mitre.org/data/definitions/620.html", "https://cwe.mitre.org/data/definitions/757.html" ], "seenInTheWild": "Z-Shave (Pen Test Partners, 2018)", "source": "https://pentestpartners.com/security-blog/z-shave-exploiting-z-wave-downgrade-attacks" }, { "@id": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-10", "@type": "skos:Concept", "notation": "OPH-RF-10", "prefLabel": "Mesh Worm", "definition": "A firmware flaw spreads device to device across the mesh, and from house to house, because devices accept updates signed with a shared key that has been extracted from one of them.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/", "principle": "Each device verifies updates against a key that is on no device, and the mesh does not extend trust.", "measure": [ "Sign firmware with an asymmetric key held off-device, and verify before install.", "Have the coordinator authorise each over-the-air update, rather than any neighbour.", "Disable proximity commissioning (Zigbee Touchlink) that lets one device take over another." ], "stride": "E, T", "physicalSafety": false, "rank": "10", "closeMatch": [ "https://capec.mitre.org/data/definitions/186.html", "https://cwe.mitre.org/data/definitions/347.html", "https://cwe.mitre.org/data/definitions/321.html" ], "seenInTheWild": "IoT Goes Nuclear: Philips Hue worm (Ronen et al., IEEE S&P 2017)", "source": "https://eyalro.net/project/iotworm.html" }, { "@id": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-9", "@type": "skos:Concept", "notation": "OPH-RF-9", "prefLabel": "Spoofed Sensor", "definition": "Sensor reports (door contacts, leak, temperature, motion) are not authenticated, so a forged frame says 'door closed' during a break-in, or 'leak' to shut the water off.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/", "principle": "Authenticate what sensors report, not only the commands sent to actuators.", "measure": [ "Use authenticated encryption on sensor frames, bound to the identity set at pairing.", "Cross-check reports for plausibility (contact closed while motion inside the door).", "Alert on frames from unknown or duplicated device identities." ], "stride": "S, T", "physicalSafety": false, "rank": "9", "closeMatch": [ "https://capec.mitre.org/data/definitions/194.html", "https://cwe.mitre.org/data/definitions/290.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-8", "@type": "skos:Concept", "notation": "OPH-RF-8", "prefLabel": "Phone Key Relayed", "definition": "Phone-as-key and Bluetooth proximity unlock trust that a reachable phone is a nearby phone, so a relay over any distance opens the door while the owner is in town.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/", "principle": "Measure proximity; do not infer it from a radio that answers.", "measure": [ "Use secure ranging (UWB distance bounding) for proximity unlock.", "Require a user action (tap, biometric) on the phone to unlock.", "Ship auto-unlock off, with a short time window when turned on." ], "stride": "S", "physicalSafety": true, "rank": "8", "closeMatch": [ "https://capec.mitre.org/data/definitions/94.html" ], "broadMatch": [ "https://cwe.mitre.org/data/definitions/290.html" ], "seenInTheWild": "Bluetooth LE relay against smart locks (NCC Group, 2022)", "source": "https://www.nccgroup.com/newsroom/ncc-group-uncovers-bluetooth-low-energy-ble-vulnerability-that-puts-millions-of-cars-mobile-devices-and-locking-systems-at-risk/" }, { "@id": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-7", "@type": "skos:Concept", "notation": "OPH-RF-7", "prefLabel": "Malformed Frame Crashes the Stack", "definition": "A crafted radio frame crashes or takes over the device's radio stack, because the chip vendor's SDK parses hostile input with known flaws that the product never picked up.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/", "principle": "Treat the radio stack as an internet-facing parser and keep it current.", "measure": [ "Fuzz the radio interfaces in release testing.", "Track the chip vendor's SDK advisories and ship their fixes.", "Recover from radio stack faults with a watchdog rather than a hung device." ], "stride": "D, E", "physicalSafety": false, "rank": "7", "closeMatch": [ "https://cwe.mitre.org/data/definitions/1395.html" ], "broadMatch": [ "https://capec.mitre.org/data/definitions/28.html" ], "seenInTheWild": "SweynTooth (SUTD, 2020)", "source": "https://www.sutd.edu.sg/news-listing/discovery-of-sweyntooth-by-asset-research-group-led-by-assistant-professor-sudipta-chattopadhyay-information-systems-technology-and-design-istd/" }, { "@id": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-6", "@type": "skos:Concept", "notation": "OPH-RF-6", "prefLabel": "Rogue Coordinator", "definition": "A rogue Thread border router or Zigbee coordinator advertises a better route, or lures reset devices onto its network, and so sees or steers their traffic.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/", "principle": "Devices join and route only through authenticated network authorities.", "measure": [ "Authenticate border routers and coordinators before devices route through them.", "Have devices rejoin only the network they were commissioned to, unless re-commissioned locally.", "Alert on a second coordinator or border router on the home's network." ], "stride": "S, T", "physicalSafety": false, "rank": "6", "closeMatch": [ "https://capec.mitre.org/data/definitions/616.html", "https://cwe.mitre.org/data/definitions/940.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-5", "@type": "skos:Concept", "notation": "OPH-RF-5", "prefLabel": "Stolen from Down the Street", "definition": "Proximity commissioning and remote reset (Zigbee Touchlink, factory reset over the air) work from outside the house with a high-gain antenna, so bulbs and plugs are reset and taken over.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/", "principle": "Reset and re-commissioning need a physical act at the device.", "measure": [ "Disable Touchlink and remote reset by default.", "Require a button press or power-cycle sequence at the device to reset.", "Alert the owner when a device leaves the network unexpectedly." ], "stride": "D, E", "physicalSafety": false, "rank": "5", "closeMatch": [ "https://cwe.mitre.org/data/definitions/306.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-4", "@type": "skos:Concept", "notation": "OPH-RF-4", "prefLabel": "Battery Drained by Design", "definition": "An attacker keeps a sleepy battery device awake with traffic or join requests, draining a sensor that should last years in days, so it dies silently.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/", "principle": "Bound the radio work a battery device does for anyone it does not know.", "measure": [ "Ignore unauthenticated traffic before waking the main processor.", "Report battery drain rate, not just level, and alert on sudden change.", "Treat a battery-dead safety sensor as a fault alarm." ], "stride": "D", "physicalSafety": false, "rank": "4", "closeMatch": [ "https://cwe.mitre.org/data/definitions/920.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-3", "@type": "skos:Concept", "notation": "OPH-RF-3", "prefLabel": "Leaky Airwaves", "definition": "Telemetry and advertisements go out in the clear or with fixed identifiers, so someone outside can tell which devices are present, when doors open and when the house is empty.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/", "principle": "Encrypt what is sent, and keep identifiers from becoming trackers.", "measure": [ "Encrypt telemetry on every band, including sub-GHz sensors.", "Rotate Bluetooth and Wi-Fi addresses and avoid static identifiers in advertisements.", "Advertise only while pairing or when a client needs it." ], "stride": "I", "physicalSafety": false, "rank": "3", "closeMatch": [ "https://capec.mitre.org/data/definitions/157.html", "https://cwe.mitre.org/data/definitions/319.html", "https://cwe.mitre.org/data/definitions/359.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/#OPH-RF-2", "@type": "skos:Concept", "notation": "OPH-RF-2", "prefLabel": "Crowded Spectrum", "definition": "The design assumes a clean 2.4 GHz band, but Wi-Fi channels, microwave ovens and the neighbours' networks overlap the mesh, so commands are lost and nobody can tell attack from accident.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/radio-and-mesh/", "principle": "Plan channels and measure link quality as part of the system.", "measure": [ "Choose mesh channels clear of the home Wi-Fi and re-check them over time.", "Retry with acknowledgement for actuation commands, and report delivery failure.", "Expose link quality per device so a degraded link is visible before it fails." ], "stride": "D", "physicalSafety": false, "rank": "2" }, { "@id": "https://ostering.com/taxonomies/smart-home/domotics/", "@type": "skos:Concept", "notation": "OPH-DM", "prefLabel": "Domotics", "definition": "Lighting, heating and cooling, blinds, plugs and relays, water valves and leak sensors: the building services that the house runs on. A bad command here is a physical event: heat, cold, water or darkness.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "topConceptOf": "https://ostering.com/taxonomies/smart-home/", "narrower": [ "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-A", "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-K", "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-Q", "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-J", "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-10", "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-9", "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-8", "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-7", "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-6", "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-5", "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-4", "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-3", "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-2" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-A", "@type": "skos:Concept", "notation": "OPH-DM-A", "prefLabel": "Heating Driven Out of Range", "definition": "Thermostats, boilers and heat pumps accept setpoints from the app or cloud with no limit in the device, so a command, bug or attacker drives the house to dangerous heat or cold.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/domotics/", "principle": "Enforce physical safety limits in the device, not in the app.", "measure": [ "Hold hard minimum and maximum setpoints in firmware that no remote command can override.", "Keep frost protection active whatever mode the system is in.", "Alert the household on extreme or sudden setpoint changes." ], "stride": "T", "physicalSafety": true, "rank": "A", "closeMatch": [ "https://cwe.mitre.org/data/definitions/1284.html", "https://cwe.mitre.org/data/definitions/602.html" ], "broadMatch": [ "https://capec.mitre.org/data/definitions/153.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-K", "@type": "skos:Concept", "notation": "OPH-DM-K", "prefLabel": "Plug Powers a Hazard", "definition": "Smart plugs and relays switch whatever is plugged in, so a remote 'on' energises a heater, iron or hair straightener with nobody home, or rapid switching overheats the load.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/domotics/", "principle": "Safe switching depends on the load, so the device must know what it is switching.", "measure": [ "Ask for the load type at setup and block remote 'on' for heat loads unless confirmed at the plug.", "Build overcurrent, overtemperature and maximum on-time protection into the plug.", "Rate-limit relay switching in firmware." ], "stride": "T", "physicalSafety": true, "rank": "K", "broadMatch": [ "https://cwe.mitre.org/data/definitions/799.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-Q", "@type": "skos:Concept", "notation": "OPH-DM-Q", "prefLabel": "Water Valve Turned on the House", "definition": "A whole-house shut-off valve can be closed or opened by any app user, rule or integration, and its state on power loss was never chosen, so the house floods or loses water for heating and sprinklers.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/domotics/", "principle": "Treat a valve that controls the whole supply as a security-critical actuator.", "measure": [ "Restrict valve control to named roles and confirm every remote change.", "Keep a manual override at the valve that no software can disable.", "Choose and document the fail state on power loss for each installation." ], "stride": "T, D", "physicalSafety": true, "rank": "Q", "closeMatch": [ "https://cwe.mitre.org/data/definitions/862.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-J", "@type": "skos:Concept", "notation": "OPH-DM-J", "prefLabel": "Thermostat Held to Ransom", "definition": "A malicious update, a PIN set by an attacker or a hostile setting puts a device in a state the owner cannot recover, and the heating is held to ransom.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/domotics/", "principle": "The owner keeps a recovery path that an attacker cannot remove.", "measure": [ "Provide a physical reset that restores signed factory firmware.", "Keep a known-good firmware image and roll back to it on failed boot.", "Never let a remote command disable the local controls." ], "stride": "D, E", "physicalSafety": true, "rank": "J", "closeMatch": [ "https://capec.mitre.org/data/definitions/186.html", "https://cwe.mitre.org/data/definitions/494.html" ], "seenInTheWild": "Thermostat ransomware demonstration (Pen Test Partners, DEF CON 24, 2016)", "source": "https://www.pentestpartners.com/security-blog/thermostat-ransomware-a-lesson-in-iot-security/" }, { "@id": "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-10", "@type": "skos:Concept", "notation": "OPH-DM-10", "prefLabel": "Window Opened, Blind Closed", "definition": "Motorised windows, skylights, blinds and shutters move on a remote command or a rule while someone is in the way, or open the building envelope while the house is empty.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/domotics/", "principle": "Moving parts need local interlocks, and opening the envelope needs the security context.", "measure": [ "Build obstacle detection and force limits into the motor controller.", "Block opening windows and skylights when the alarm is armed or the house is in away mode.", "Ship remote opening of ground-floor windows off." ], "stride": "T", "physicalSafety": true, "rank": "10" }, { "@id": "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-9", "@type": "skos:Concept", "notation": "OPH-DM-9", "prefLabel": "Wall Switch Disconnected", "definition": "Smart relays and bulbs detach the wall switch from the light, so when the hub, network or cloud fails, nobody can turn on a light at night or in a fire.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/domotics/", "principle": "Keep a local manual path that works without any software.", "measure": [ "Wire wall switches so they always control the load directly, or through local logic only.", "Have bulbs and relays fall back to 'on' when switched off and on at the wall.", "Test lighting with the hub and the internet both down." ], "stride": "D", "physicalSafety": true, "rank": "9" }, { "@id": "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-8", "@type": "skos:Concept", "notation": "OPH-DM-8", "prefLabel": "Wrong State After a Power Cut", "definition": "After a power cut, devices return to 'on' (heaters, plugs) or 'off' (a freezer plug, a sump pump) by a default nobody chose for that load.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/domotics/", "principle": "Define power-on behaviour per load, with a safe default per class.", "measure": [ "Make the power-on state configurable, defaulting heat loads to off and essential loads to on.", "Tell the household which devices changed state when power returned.", "Never let a heat load start unattended after a power cut." ], "stride": "D, T", "physicalSafety": true, "rank": "8", "broadMatch": [ "https://cwe.mitre.org/data/definitions/1419.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-7", "@type": "skos:Concept", "notation": "OPH-DM-7", "prefLabel": "Strobe from a Command", "definition": "Smart lights accept colour and brightness changes as fast as they can be sent, so a malicious app or rule can strobe a room at a rate that can trigger photosensitive seizures.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/domotics/", "principle": "Limit flash rate in the bulb's firmware.", "measure": [ "Cap the rate of brightness and colour change in firmware, whatever the source.", "Make any 'effects' mode a local, opt-in setting.", "Throttle commands per source at the hub." ], "stride": "T", "physicalSafety": true, "rank": "7", "closeMatch": [ "https://cwe.mitre.org/data/definitions/799.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-6", "@type": "skos:Concept", "notation": "OPH-DM-6", "prefLabel": "Cycled to Destruction", "definition": "Commands toggle a compressor, boiler or heat pump on and off faster than it is built for, wearing it out or tripping it into lockout in cold weather.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/domotics/", "principle": "Protect equipment in firmware with minimum on and off times.", "measure": [ "Enforce minimum run and rest times in the equipment controller.", "Rate-limit setpoint changes from any one source.", "Alert on abnormal cycling patterns." ], "stride": "T, D", "physicalSafety": false, "rank": "6", "closeMatch": [ "https://cwe.mitre.org/data/definitions/799.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-5", "@type": "skos:Concept", "notation": "OPH-DM-5", "prefLabel": "Someone Else's Thermostat", "definition": "A utility, energy supplier or the vendor can change the setpoint for demand response without the household seeing it in time, and the house gets too hot or too cold.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/domotics/", "principle": "Third-party control is visible, bounded and overridable by the people at home.", "measure": [ "Show any third-party adjustment on the device and in the app as it happens.", "Bound how far and for how long a third party can move the setpoint.", "Let the household override, and record who changed what." ], "stride": "T, R", "physicalSafety": false, "rank": "5", "seenInTheWild": "Texas heat wave demand-response thermostat adjustments (June 2021)", "source": "https://dallasnews.com/business/energy/2021/06/22/why-your-smart-thermostat-may-raise-the-temperature-inside-your-house-in-texas-heat-waves" }, { "@id": "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-4", "@type": "skos:Concept", "notation": "OPH-DM-4", "prefLabel": "All Off Means All", "definition": "An 'all off' scene or group switches off loads that must stay on (a fridge, freezer, aquarium, sump pump or equipment someone relies on), and one changed scene affects them all.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/domotics/", "principle": "Mark essential loads, and keep them out of bulk commands.", "measure": [ "Let installers and owners flag essential loads at setup.", "Exclude essential loads from groups and scenes unless explicitly added.", "Confirm bulk commands that include an essential load." ], "stride": "D", "physicalSafety": false, "rank": "4", "broadMatch": [ "https://cwe.mitre.org/data/definitions/1220.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-3", "@type": "skos:Concept", "notation": "OPH-DM-3", "prefLabel": "One Sensor Decides", "definition": "A single cheap temperature or humidity sensor drives the heating and frost protection, so a failed, moved or spoofed sensor decides for the whole house.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/domotics/", "principle": "Cross-check safety decisions against more than one source.", "measure": [ "Compare room sensors with the boiler or heat pump's own readings.", "Flag readings that are flat, out of range or out of step with others.", "Fall back to a safe schedule when a sensor is in doubt." ], "stride": "T, D", "physicalSafety": false, "rank": "3", "broadMatch": [ "https://cwe.mitre.org/data/definitions/1357.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/domotics/#OPH-DM-2", "@type": "skos:Concept", "notation": "OPH-DM-2", "prefLabel": "Predictable Away Mode", "definition": "Away mode runs a fixed lighting and blind schedule, and the away state is readable by integrations, so the empty house is easy to recognise from the street or a feed.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/domotics/", "principle": "Presence simulation should be unpredictable, and away status private.", "measure": [ "Randomise simulated presence within plausible ranges.", "Do not expose away status to integrations unless the owner grants it.", "Keep away-mode changes out of notifications visible on lock screens." ], "stride": "I", "physicalSafety": false, "rank": "2", "closeMatch": [ "https://cwe.mitre.org/data/definitions/359.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/", "@type": "skos:Concept", "notation": "OPH-CM", "prefLabel": "Cameras and Doorbells", "definition": "Indoor and outdoor cameras, video doorbells, recorders and their clips put the inside of the house, and the people in it, on the network. Every flaw is a window into a private space.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "topConceptOf": "https://ostering.com/taxonomies/smart-home/", "narrower": [ "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-A", "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-K", "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-Q", "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-J", "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-10", "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-9", "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-8", "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-7", "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-6", "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-5", "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-4", "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-3", "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-2" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-A", "@type": "skos:Concept", "notation": "OPH-CM-A", "prefLabel": "Someone Else's Feed", "definition": "A cloud, cache or relay fault serves one household's live view, events or thumbnails to another household's app.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/", "principle": "Bind every frame and event to its home at every layer, and test the binding.", "measure": [ "Check the requesting account's ownership on every stream, clip and thumbnail request, not just at login.", "Key caches and CDN paths by household as well as by device, and test for crossover.", "Encrypt end to end so a routing fault exposes ciphertext, not video." ], "stride": "I, E", "physicalSafety": false, "rank": "A", "closeMatch": [ "https://cwe.mitre.org/data/definitions/524.html" ], "broadMatch": [ "https://cwe.mitre.org/data/definitions/639.html" ], "seenInTheWild": "Wyze cameras showed other users' events (Sept 2023 and Feb 2024)", "source": "https://www.engadget.com/wyze-camera-security-issue-showed-13000-users-other-owners-homes-140059551.html" }, { "@id": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-K", "@type": "skos:Concept", "notation": "OPH-CM-K", "prefLabel": "Default Login on the Recorder", "definition": "Cameras and recorders ship with default or weak credentials, or hidden support accounts, and are reachable from the internet through P2P services or port mappings.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/", "principle": "Every device has unique credentials and no hidden accounts.", "measure": [ "Ship a unique per-device password, or force one to be set before the device works.", "Remove hidden, support and hard-coded accounts from release firmware.", "Disable P2P and port mapping until the owner turns remote access on." ], "stride": "E, S", "physicalSafety": false, "rank": "K", "closeMatch": [ "https://capec.mitre.org/data/definitions/70.html", "https://cwe.mitre.org/data/definitions/1392.html", "https://cwe.mitre.org/data/definitions/798.html" ], "seenInTheWild": "Mirai botnet (2016)", "source": "https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/" }, { "@id": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-Q", "@type": "skos:Concept", "notation": "OPH-CM-Q", "prefLabel": "Stranger in the Camera", "definition": "Camera accounts protected by a password alone are taken over by credential stuffing, and the attacker watches and talks to the household through the camera.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/", "principle": "Protect a camera account as if it were the camera.", "measure": [ "Require multi-factor authentication or passkeys at setup.", "Check passwords against breach corpora and flag unusual logins.", "Notify every household member of new logins and live-view sessions." ], "stride": "S, I", "physicalSafety": false, "rank": "Q", "closeMatch": [ "https://capec.mitre.org/data/definitions/600.html", "https://cwe.mitre.org/data/definitions/307.html", "https://cwe.mitre.org/data/definitions/308.html" ], "seenInTheWild": "Ring camera takeovers (Dec 2019)", "source": "https://techxplore.com/news/2019-12-family-camera-year-old-daughter-room.amp" }, { "@id": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-J", "@type": "skos:Concept", "notation": "OPH-CM-J", "prefLabel": "Local Only That Isn't", "definition": "The product says video stays local or is end-to-end encrypted, but thumbnails, clips or face data still go to the cloud, unencrypted or viewable by URL.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/", "principle": "The data flow must match the promise, and be tested against it.", "measure": [ "Keep a data-flow inventory per feature and test it in every release.", "Hold end-to-end keys only on the owner's devices.", "Publish what leaves the home, and when." ], "stride": "I", "physicalSafety": false, "rank": "J", "closeMatch": [ "https://cwe.mitre.org/data/definitions/359.html", "https://cwe.mitre.org/data/definitions/319.html" ], "seenInTheWild": "Eufy cloud thumbnails and unencrypted streams (Nov 2022)", "source": "https://9to5google.com/2022/11/29/eufy-camera-cloud-security-leak/" }, { "@id": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-10", "@type": "skos:Concept", "notation": "OPH-CM-10", "prefLabel": "Insider Watches the Feed", "definition": "Vendor staff, contractors or support agents can view customer video, or an installer adds their own account to a customer system.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/", "principle": "No standing human access to customer video.", "measure": [ "Encrypt end to end so staff cannot view video at all.", "Grant support access only with the customer's consent per session, and log it where the customer can see it.", "Expire installer accounts at handover." ], "stride": "I, E", "physicalSafety": false, "rank": "10", "closeMatch": [ "https://capec.mitre.org/data/definitions/122.html", "https://cwe.mitre.org/data/definitions/1220.html" ], "seenInTheWild": "FTC action against Ring (2023); ADT technician case (disclosed 2020, guilty plea 2021)", "source": "https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-says-ring-employees-illegally-surveilled-customers-failed-stop-hackers-taking-control-users" }, { "@id": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-9", "@type": "skos:Concept", "notation": "OPH-CM-9", "prefLabel": "Device ID Is the Password", "definition": "A vendor P2P SDK treats the device's UID as enough to connect, so anyone who learns a UID can impersonate the device or intercept its stream.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/", "principle": "Identifiers are not secrets; authenticate with per-device keys.", "measure": [ "Use mutual authentication with per-device keys for P2P and relay connections.", "Keep third-party camera SDKs on supported, patched versions.", "Treat UIDs as public in the threat model." ], "stride": "S, I", "physicalSafety": false, "rank": "9", "closeMatch": [ "https://cwe.mitre.org/data/definitions/290.html", "https://cwe.mitre.org/data/definitions/1395.html" ], "seenInTheWild": "ThroughTek Kalay, CVE-2021-28372 (Mandiant, 2021)", "source": "https://cloud.google.com/blog/topics/threat-intelligence/mandiant-discloses-critical-vulnerability-affecting-iot-devices" }, { "@id": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-8", "@type": "skos:Concept", "notation": "OPH-CM-8", "prefLabel": "Stream Open on the LAN", "definition": "RTSP and ONVIF streams answer on the home network without authentication or encryption, so any compromised device on the Wi-Fi can watch.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/", "principle": "Authenticate and encrypt local streams as you would remote ones.", "measure": [ "Require credentials for every local stream, unique per device.", "Use encrypted transport for local streaming.", "Ship local streaming off until the owner enables it." ], "stride": "I", "physicalSafety": false, "rank": "8", "closeMatch": [ "https://capec.mitre.org/data/definitions/158.html", "https://cwe.mitre.org/data/definitions/319.html", "https://cwe.mitre.org/data/definitions/306.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-7", "@type": "skos:Concept", "notation": "OPH-CM-7", "prefLabel": "Recording Without the Light", "definition": "The camera can stream or record with its indicator light off, under software control, so people in the room cannot tell they are being watched.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/", "principle": "Tie the indicator to the sensor in hardware.", "measure": [ "Wire the recording indicator to the camera and microphone power.", "Provide a physical shutter or microphone switch on indoor cameras.", "Show who is watching live, in the app, to every household member." ], "stride": "I", "physicalSafety": false, "rank": "7", "closeMatch": [ "https://capec.mitre.org/data/definitions/634.html" ], "broadMatch": [ "https://cwe.mitre.org/data/definitions/359.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-6", "@type": "skos:Concept", "notation": "OPH-CM-6", "prefLabel": "Footage Shared Beyond the Owner", "definition": "Clips are shared through neighbourhood apps, police portals or links that never expire and can be guessed, and the owner cannot see who has them.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/", "principle": "Sharing is opt-in, scoped, expiring and visible to the owner.", "measure": [ "Use signed, expiring share links with enough entropy.", "Show the owner a log of every disclosure, including legal requests.", "Publish the vendor's policy for emergency and legal requests." ], "stride": "I", "physicalSafety": false, "rank": "6", "closeMatch": [ "https://cwe.mitre.org/data/definitions/340.html", "https://cwe.mitre.org/data/definitions/359.html" ], "seenInTheWild": "Ring disclosures to police without consent (2022)", "source": "https://nextgov.com/analytics-data/2022/07/amazon-admits-giving-police-ring-footage-without-owners-permission/374480" }, { "@id": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-5", "@type": "skos:Concept", "notation": "OPH-CM-5", "prefLabel": "Camera Sees the Neighbours", "definition": "Doorbells and outdoor cameras record the street, the neighbours' gardens and conversations by default, putting the household in breach of privacy law.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/", "principle": "Capture only the owner's property by default.", "measure": [ "Ship privacy zones and audio-off as outdoor defaults.", "Show the field of view at setup and prompt for masking.", "Explain the household's obligations where recording reaches beyond the boundary." ], "stride": "I", "physicalSafety": false, "rank": "5", "seenInTheWild": "Fairhurst v Woodard (England, 2021)", "source": "https://www.judiciary.uk/wp-content/uploads/2021/10/Fairhurst-v-Woodard-Judgment.pdf" }, { "@id": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-4", "@type": "skos:Concept", "notation": "OPH-CM-4", "prefLabel": "Doorbell Off the Wall", "definition": "A video doorbell comes off the wall with a standard screwdriver, and its flash holds the home Wi-Fi password and account tokens in plain text.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/", "principle": "Removal is a tamper event, and no secret survives in plain text.", "measure": [ "Alert the owner when the doorbell is removed from its mount.", "Encrypt stored credentials with a device-bound key.", "Use a mount that needs a security screw." ], "stride": "T, I", "physicalSafety": false, "rank": "4", "closeMatch": [ "https://capec.mitre.org/data/definitions/401.html", "https://cwe.mitre.org/data/definitions/312.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-3", "@type": "skos:Concept", "notation": "OPH-CM-3", "prefLabel": "Alerts Until They're Off", "definition": "An attacker trips the motion alerts again and again, until the owner mutes them or turns the camera off, and then comes back.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/", "principle": "Design alerting so it stays on when it matters.", "measure": [ "Rate-limit and summarise repeated alerts rather than leaving muting as the only option.", "Time-limit any mute, and confirm when the camera is turned off.", "Escalate when alerts are muted while the alarm is armed." ], "stride": "D", "physicalSafety": false, "rank": "3" }, { "@id": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/#OPH-CM-2", "@type": "skos:Concept", "notation": "OPH-CM-2", "prefLabel": "Clips Kept Forever", "definition": "Clips and event history are kept with no limit, so years of comings and goings, children and visitors sit in the account for anyone who gets into it.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/cameras-and-doorbells/", "principle": "Keep the least footage for the shortest time.", "measure": [ "Ship a short default retention and let the owner extend it.", "Delete clips everywhere, including backups and analytics, on schedule.", "Show the owner how much history is held." ], "stride": "I", "physicalSafety": false, "rank": "2" }, { "@id": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/", "@type": "skos:Concept", "notation": "OPH-AL", "prefLabel": "Alarms and Locks", "definition": "Intrusion alarms, smoke and carbon monoxide alarms, smart locks, keypads, garage doors and gates: the devices that decide who comes in and whether anyone hears about it.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "topConceptOf": "https://ostering.com/taxonomies/smart-home/", "narrower": [ "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-A", "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-K", "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-Q", "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-J", "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-10", "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-9", "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-8", "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-7", "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-6", "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-5", "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-4", "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-3", "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-2" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-A", "@type": "skos:Concept", "notation": "OPH-AL-A", "prefLabel": "Unlocked Without Intent", "definition": "Any authenticated call (app, voice, automation or integration) can unlock the door or disarm the alarm without fresh intent from a person, so a stolen token or a misfiring rule opens the house.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/", "principle": "Unlocking and disarming need fresh, explicit intent from an authorised person.", "measure": [ "Require step-up authentication (biometric or PIN) on the device that sends the unlock or disarm.", "Keep voice unlock and disarm off by default, and require a spoken PIN when on.", "Allow unlock in automations only by explicit, per-rule approval, and notify on every use." ], "stride": "E, S", "physicalSafety": true, "rank": "A", "broadMatch": [ "https://cwe.mitre.org/data/definitions/308.html", "https://cwe.mitre.org/data/definitions/862.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-K", "@type": "skos:Concept", "notation": "OPH-AL-K", "prefLabel": "Smoke Alarm Silenced", "definition": "Connected smoke and CO alarms can be hushed or tested remotely, or the smart layer suppresses the local siren because the alert was 'handled in the app'.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/", "principle": "The local siren never depends on the network.", "measure": [ "Keep the siren path independent of the networking firmware.", "Time-limit and log remote hush, and never allow it for carbon monoxide.", "Escalate an unacknowledged alarm to every household member and contact." ], "stride": "D, T", "physicalSafety": true, "rank": "K", "closeMatch": [ "https://cwe.mitre.org/data/definitions/1320.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-Q", "@type": "skos:Concept", "notation": "OPH-AL-Q", "prefLabel": "Fails Open, Fails Shut", "definition": "On a flat battery, power loss or crash the lock fails open (insecure) or fails locked, trapping people in a fire, because no one chose the failure state for that door.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/", "principle": "Choose and document the failure state per door, and always allow exit.", "measure": [ "Keep mechanical exit from inside at all times.", "Document the fail state per installation and test it.", "Warn weeks ahead of a flat battery, through more than one channel." ], "stride": "D", "physicalSafety": true, "rank": "Q", "closeMatch": [ "https://cwe.mitre.org/data/definitions/636.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-J", "@type": "skos:Concept", "notation": "OPH-AL-J", "prefLabel": "Keypad Code Guessed", "definition": "Keypads accept short codes with no lockout, show wear and smudge on the used digits, and shared codes never change.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/", "principle": "A keypad code is a password: long enough, rate-limited and changed.", "measure": [ "Lock out after repeated failures, with an alert.", "Support longer codes and decoy digits (scramble before or after the code).", "Prompt code changes when a code holder leaves." ], "stride": "S", "physicalSafety": false, "rank": "J", "closeMatch": [ "https://capec.mitre.org/data/definitions/49.html", "https://capec.mitre.org/data/definitions/626.html", "https://cwe.mitre.org/data/definitions/307.html", "https://cwe.mitre.org/data/definitions/521.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-10", "@type": "skos:Concept", "notation": "OPH-AL-10", "prefLabel": "Guest Code Outlives the Guest", "definition": "Temporary codes and e-keys for cleaners, holiday guests and trades never expire, or stay valid offline after revocation because the lock caches them.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/", "principle": "Time-bound credentials are enforced by the lock, even offline.", "measure": [ "Enforce validity windows in the lock itself.", "Give cached credentials an expiry that does not need the network.", "Show the owner every live credential, and who issued it." ], "stride": "E", "physicalSafety": false, "rank": "10", "broadMatch": [ "https://cwe.mitre.org/data/definitions/324.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-9", "@type": "skos:Concept", "notation": "OPH-AL-9", "prefLabel": "Garage Is the Side Door", "definition": "The garage door or gate has weaker controls than the front door (a fixed code, a cloud API with no step-up, auto-open by geofence), yet it opens onto the house.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/", "principle": "Any door into the house gets front-door controls.", "measure": [ "Apply the same authentication and notification to garage and gate as to the front door.", "Alert when a garage door stays open past a set time.", "Close and lock the internal garage door when the house is armed." ], "stride": "E, T", "physicalSafety": false, "rank": "9", "closeMatch": [ "https://cwe.mitre.org/data/definitions/1390.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-8", "@type": "skos:Concept", "notation": "OPH-AL-8", "prefLabel": "Arming State Leaks", "definition": "Armed or disarmed status, entry delays and lock state are readable by integrations, voice assistants and widgets, so someone outside learns when the house is open.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/", "principle": "Security state is shown only to those who need it.", "measure": [ "Require a scope for reading arming and lock state, granted per integration.", "Keep security state off lock screens and voice answers by default.", "Log every read of security state by an integration." ], "stride": "I", "physicalSafety": false, "rank": "8" }, { "@id": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-7", "@type": "skos:Concept", "notation": "OPH-AL-7", "prefLabel": "Unlocked by a Fake Arrival", "definition": "The lock opens or the alarm disarms when the owner's phone 'arrives' in a geofence, so a spoofed location or drifting fix opens the door while the owner is away or in bed nearby.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/", "principle": "Location is a hint, not an authenticator.", "measure": [ "Combine location with a second, local signal and a prompt on the phone.", "Ship geofence unlock and disarm off.", "Never act on location alone at night or when the house is armed." ], "stride": "S", "physicalSafety": true, "rank": "7", "closeMatch": [ "https://capec.mitre.org/data/definitions/627.html", "https://cwe.mitre.org/data/definitions/807.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-6", "@type": "skos:Concept", "notation": "OPH-AL-6", "prefLabel": "Tamper Goes Unreported", "definition": "A lock forced off the door, a sensor cover opened or a siren wire cut raises no tamper alarm, or raises one only when the network is up.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/", "principle": "Tamper is an alarm event, sent by more than one path.", "measure": [ "Fit tamper switches to locks, sensors, sirens and panels.", "Report tamper over a backup path when the main one is down.", "Keep tamper alarms active when the system is disarmed." ], "stride": "T", "physicalSafety": false, "rank": "6", "broadMatch": [ "https://capec.mitre.org/data/definitions/390.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-5", "@type": "skos:Concept", "notation": "OPH-AL-5", "prefLabel": "Monitoring Path Spoofed", "definition": "The path to the alarm receiving centre (IP or cellular) can be blocked or spoofed, so the centre gets a false all-clear or a flood of false alarms.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/", "principle": "Authenticate the alarm path and supervise it from both ends.", "measure": [ "Authenticate and sequence every message to the receiving centre.", "Have the centre poll the panel and act when polls fail.", "Use dual-path signalling with independent networks." ], "stride": "S, D", "physicalSafety": false, "rank": "5", "closeMatch": [ "https://capec.mitre.org/data/definitions/194.html", "https://cwe.mitre.org/data/definitions/290.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-4", "@type": "skos:Concept", "notation": "OPH-AL-4", "prefLabel": "Smashed in the Entry Delay", "definition": "An intruder destroys the panel during the entry delay, before it has sent anything, so the alarm never reaches anyone.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/", "principle": "Signal at the start of the entry delay, not the end.", "measure": [ "Send a pre-alarm to the monitoring path when the entry delay starts.", "Treat a pre-alarm with no disarm as an alarm.", "Mount the panel away from the entry door." ], "stride": "D", "physicalSafety": false, "rank": "4" }, { "@id": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-3", "@type": "skos:Concept", "notation": "OPH-AL-3", "prefLabel": "Digital Lock, Mechanical Weakness", "definition": "A smart lock is fitted to a weak cylinder or keeps a pickable key override, and the threat model covers only the electronics.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/", "principle": "Model the physical lock with the digital one.", "measure": [ "Specify cylinders that meet an anti-snap or anti-pick standard for retrofit locks.", "Document the mechanical override and its rating.", "Report forced or unusual mechanical operation where the lock can detect it." ], "stride": "E", "physicalSafety": false, "rank": "3", "closeMatch": [ "https://capec.mitre.org/data/definitions/393.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/#OPH-AL-2", "@type": "skos:Concept", "notation": "OPH-AL-2", "prefLabel": "Shared Code, No Name", "definition": "The household shares one code or one account, so the log says 'code 1 unlocked the door' and nobody can tell who it was.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/alarms-and-locks/", "principle": "Every person who can open the door has their own credential.", "measure": [ "Issue a code or e-key per person, including regular visitors.", "Name every credential in the log.", "Make shared codes a visible exception with an expiry." ], "stride": "R", "physicalSafety": false, "rank": "2", "broadMatch": [ "https://cwe.mitre.org/data/definitions/1220.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/appliances/", "@type": "skos:Concept", "notation": "OPH-AP", "prefLabel": "Appliances", "definition": "Ovens and hobs, washing machines, fridges and freezers, robot vacuums and mowers, televisions and water heaters. Connecting them adds remote commands to machines that heat, spin, cut and see.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "topConceptOf": "https://ostering.com/taxonomies/smart-home/", "narrower": [ "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-A", "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-K", "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-Q", "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-J", "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-10", "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-9", "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-8", "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-7", "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-6", "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-5", "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-4", "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-3", "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-2" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-A", "@type": "skos:Concept", "notation": "OPH-AP-A", "prefLabel": "Oven Lit Remotely", "definition": "An oven, hob, kettle or tumble dryer can be started from the app or cloud with nobody home, so a stolen account, a bug or a mistaken tap starts a fire.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/appliances/", "principle": "Heat appliances start remotely only after someone at the appliance has allowed it.", "measure": [ "Allow remote start only after a local 'remote start' action at the appliance within a set time.", "Never allow remote start of a hob, and cap remote run time for ovens and dryers.", "Check door, load and sensor state before starting." ], "stride": "T, E", "physicalSafety": true, "rank": "A", "broadMatch": [ "https://cwe.mitre.org/data/definitions/654.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-K", "@type": "skos:Concept", "notation": "OPH-AP-K", "prefLabel": "Safety Limit in Software Only", "definition": "Over-temperature and pressure limits (water heaters, dryers, ovens) live in updatable firmware rather than an independent cut-out, so malicious firmware or a bad update removes them.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/appliances/", "principle": "Keep an independent hardware safety limit that firmware cannot override.", "measure": [ "Fit a thermal cut-out or pressure relief that works with the firmware off.", "Verify the firmware's own limits against the hardware's at boot.", "Sign firmware and refuse images that change safety parameters." ], "stride": "T", "physicalSafety": true, "rank": "K", "closeMatch": [ "https://cwe.mitre.org/data/definitions/1338.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-Q", "@type": "skos:Concept", "notation": "OPH-AP-Q", "prefLabel": "Mower Starts with the Children Out", "definition": "A robot mower or pool cleaner starts on a remote command or schedule without anyone seeing the area, with children or pets in it.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/appliances/", "principle": "Outdoor robots with blades start only when the area is known to be clear.", "measure": [ "Require a local confirmation or a camera check before a remote start.", "Stop on lift, tilt or contact detection in hardware.", "Pause schedules when the household says people are in the garden." ], "stride": "T", "physicalSafety": true, "rank": "Q" }, { "@id": "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-J", "@type": "skos:Concept", "notation": "OPH-AP-J", "prefLabel": "Child Lock Bypassed by App", "definition": "The appliance's physical child lock does not apply to commands from the app, cloud or voice assistant, so they start a machine a child can reach.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/appliances/", "principle": "Remote commands honour every local safety lock.", "measure": [ "Apply child lock to every command path, not just the front panel.", "Require the lock to be released at the appliance.", "Show lock state in the app before any remote action." ], "stride": "E", "physicalSafety": true, "rank": "J", "closeMatch": [ "https://cwe.mitre.org/data/definitions/288.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-10", "@type": "skos:Concept", "notation": "OPH-AP-10", "prefLabel": "Vacuum Maps the House", "definition": "Robot vacuums with cameras and LiDAR build floor plans and take pictures inside the home, which go to the cloud, to training sets and to contractors.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/appliances/", "principle": "Keep maps and images on the device unless the owner chooses otherwise.", "measure": [ "Process maps and images on the device and upload only with explicit consent.", "Exclude images of people from any training or review set.", "Let the owner delete maps and images everywhere." ], "stride": "I", "physicalSafety": false, "rank": "10", "closeMatch": [ "https://cwe.mitre.org/data/definitions/359.html" ], "seenInTheWild": "iRobot development-robot images leaked by data-labelling contractors (MIT Technology Review, 2022)", "source": "https://www.technologyreview.com/2022/12/19/1065306/" }, { "@id": "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-9", "@type": "skos:Concept", "notation": "OPH-AP-9", "prefLabel": "Appliance as Foothold", "definition": "A fridge or television with an old Linux or Android build sits on the main network, so an attacker uses it as a foothold to reach the hub and the household's computers.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/appliances/", "principle": "Appliances are untrusted network neighbours, and stay patched for their working life.", "measure": [ "Keep appliance software patched for a stated support period.", "Put appliances on an isolated segment with only the flows they need.", "Close every inbound service the appliance does not need." ], "stride": "E", "physicalSafety": false, "rank": "9", "closeMatch": [ "https://cwe.mitre.org/data/definitions/1104.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-8", "@type": "skos:Concept", "notation": "OPH-AP-8", "prefLabel": "Service Mode Password", "definition": "A hidden service mode, reached by a button sequence or a service app with a hard-coded password, lets anyone change parameters, including safety settings.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/appliances/", "principle": "Service access is authenticated per technician and per visit.", "measure": [ "Remove hard-coded service passwords; authenticate technicians individually.", "Keep safety parameters out of reach of service mode.", "Log service mode use where the owner can see it." ], "stride": "E", "physicalSafety": false, "rank": "8", "closeMatch": [ "https://cwe.mitre.org/data/definitions/798.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-7", "@type": "skos:Concept", "notation": "OPH-AP-7", "prefLabel": "TV Watches Back", "definition": "Smart televisions recognise what is on screen and listen for voice commands, and send viewing data to advertisers and data brokers.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/appliances/", "principle": "Content recognition and listening are off until the owner turns them on.", "measure": [ "Ship automatic content recognition off, with a clear prompt to enable.", "Keep voice listening push-to-talk by default.", "Disclose every recipient of viewing data." ], "stride": "I", "physicalSafety": false, "rank": "7", "closeMatch": [ "https://cwe.mitre.org/data/definitions/359.html" ], "seenInTheWild": "FTC settlement with Vizio (2017)", "source": "https://techcrunch.com/2017/02/06/vizio-settles-for-2-2-million-in-ftc-suit-over-snooping-on-consumers-viewing-habits/" }, { "@id": "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-6", "@type": "skos:Concept", "notation": "OPH-AP-6", "prefLabel": "Started Without Being Ready", "definition": "A washing machine or dishwasher starts on a remote command with the door open, the hose loose or the load wrong, and floods the kitchen with nobody home.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/appliances/", "principle": "Remote start checks that the appliance is ready.", "measure": [ "Check door, water supply and load sensors before a remote start.", "Stop and alert on leak detection.", "Require the appliance to be armed for remote start locally." ], "stride": "T", "physicalSafety": true, "rank": "6", "broadMatch": [ "https://cwe.mitre.org/data/definitions/841.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-5", "@type": "skos:Concept", "notation": "OPH-AP-5", "prefLabel": "Freezer Off Without a Word", "definition": "A rule, scene or remote command turns off a fridge or freezer, or changes its temperature, and nothing tells the household until the food has spoiled.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/appliances/", "principle": "Changes to cold storage are always reported.", "measure": [ "Alert on any power or setpoint change to a fridge or freezer.", "Alert on temperature drift, whatever its cause.", "Exclude fridges and freezers from bulk scenes." ], "stride": "D, T", "physicalSafety": false, "rank": "5" }, { "@id": "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-4", "@type": "skos:Concept", "notation": "OPH-AP-4", "prefLabel": "Setup Hotspot Left Open", "definition": "The appliance's setup hotspot stays open, or reappears with a default password, so someone nearby re-provisions it or captures the home Wi-Fi password.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/appliances/", "principle": "The setup channel opens only on a local action and closes after setup.", "measure": [ "Open the setup hotspot only after a button press, and close it after a short time.", "Use a unique password or a PAKE for setup.", "Never send the home Wi-Fi password in the clear during provisioning." ], "stride": "S, I", "physicalSafety": false, "rank": "4", "closeMatch": [ "https://cwe.mitre.org/data/definitions/1188.html", "https://cwe.mitre.org/data/definitions/319.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-3", "@type": "skos:Concept", "notation": "OPH-AP-3", "prefLabel": "Recipe Drives the Heat", "definition": "Ovens and cooking machines run programs downloaded from the cloud or a community, so a malicious or broken program sets temperatures and times the user never saw.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/appliances/", "principle": "Downloaded programs run inside limits the appliance enforces.", "measure": [ "Check every program step against the appliance's safe ranges.", "Sign programs and show their temperatures and times before running.", "Keep community programs out of remote start." ], "stride": "T", "physicalSafety": true, "rank": "3", "closeMatch": [ "https://cwe.mitre.org/data/definitions/1284.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/appliances/#OPH-AP-2", "@type": "skos:Concept", "notation": "OPH-AP-2", "prefLabel": "Usage Data Shows the Routine", "definition": "Appliance usage (cooking times, laundry, coffee, vacuum runs) is collected and shared, and shows when the household wakes, eats and goes out.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/appliances/", "principle": "Collect only what the feature needs, and say who gets it.", "measure": [ "Collect usage data only for features the owner uses.", "Aggregate or remove timestamps before sharing.", "Disclose every third party that receives usage data." ], "stride": "I", "physicalSafety": false, "rank": "2", "closeMatch": [ "https://cwe.mitre.org/data/definitions/359.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/energy/", "@type": "skos:Concept", "notation": "OPH-EN", "prefLabel": "Energy", "definition": "Solar inverters, home batteries, EV chargers, heat pumps as flexible loads, smart meters and the energy manager that plays them against the tariff. Connected energy devices act on the grid as well as on the house.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "topConceptOf": "https://ostering.com/taxonomies/smart-home/", "narrower": [ "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-A", "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-K", "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-Q", "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-J", "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-10", "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-9", "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-8", "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-7", "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-6", "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-5", "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-4", "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-3", "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-2" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-A", "@type": "skos:Concept", "notation": "OPH-EN-A", "prefLabel": "Fleet Switched at Once", "definition": "The vendor's cloud can command every inverter, battery or charger at once, so a compromise or a rogue operator switches thousands of homes together and destabilises the grid.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/energy/", "principle": "No single control path can move a fleet at once.", "measure": [ "Stagger and randomise fleet commands, and cap the power any one command can move.", "Enforce ramp-rate limits in the device itself.", "Require several people to approve fleet-wide commands, and log them." ], "stride": "T, D, E", "physicalSafety": true, "rank": "A", "broadMatch": [ "https://cwe.mitre.org/data/definitions/1357.html" ], "seenInTheWild": "MadIoT (Princeton, USENIX Security 2018); SUN:DOWN (Forescout, 2025)", "source": "https://usenix.org/conference/usenixsecurity18/presentation/soltan" }, { "@id": "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-K", "@type": "skos:Concept", "notation": "OPH-EN-K", "prefLabel": "Grid Protection Switched Off", "definition": "Inverter grid-protection settings (anti-islanding, voltage and frequency trips) can be changed through the app or an installer tool, putting line workers at risk during an outage.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/energy/", "principle": "Grid-code protection is locked, and changed only by an authenticated installer, with a record.", "measure": [ "Lock grid-code settings to the region's approved profile.", "Require an authenticated installer role and log every change.", "Refuse settings outside the grid code, whoever sends them." ], "stride": "T, E", "physicalSafety": true, "rank": "K", "closeMatch": [ "https://cwe.mitre.org/data/definitions/15.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-Q", "@type": "skos:Concept", "notation": "OPH-EN-Q", "prefLabel": "Battery Pushed Past Its Limits", "definition": "Battery management parameters (charge limits, temperature limits, charge rate) can be changed by the app, cloud or firmware, and a bad value starts thermal runaway.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/energy/", "principle": "Keep battery protection in hardware that firmware cannot override.", "measure": [ "Enforce cell voltage and temperature limits in an independent protection circuit.", "Sign BMS firmware and refuse parameters outside the cell maker's limits.", "Alert and isolate on abnormal temperature rise." ], "stride": "T", "physicalSafety": true, "rank": "Q", "closeMatch": [ "https://cwe.mitre.org/data/definitions/1338.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-J", "@type": "skos:Concept", "notation": "OPH-EN-J", "prefLabel": "Undisclosed Radio Inside", "definition": "An inverter or charger carries a communication path the owner cannot see or turn off (a cellular modem, a vendor tunnel), giving remote control outside the owner's network.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/energy/", "principle": "Every communication path is declared, and the owner can switch it off.", "measure": [ "List every radio and remote path in the product documentation and the SBOM.", "Let the owner disable vendor remote access without losing local function.", "Show remote sessions to the owner as they happen." ], "stride": "I, E", "physicalSafety": true, "rank": "J", "closeMatch": [ "https://cwe.mitre.org/data/definitions/912.html" ], "seenInTheWild": "Undocumented communication devices reported in inverters (Reuters, May 2025)", "source": "https://www.pv-magazine.com/2025/05/14/hidden-devices-found-in-chinese-made-inverters-in-the-us-reports-reuters/" }, { "@id": "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-10", "@type": "skos:Concept", "notation": "OPH-EN-10", "prefLabel": "Any Charger by Its ID", "definition": "The charger's cloud API takes a charger or account ID without checking ownership, so anyone can start, stop or reconfigure other people's chargers.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/energy/", "principle": "Check ownership on every request, not just at login.", "measure": [ "Authorise every API call against the caller's ownership of the device.", "Use identifiers that cannot be guessed, and rate-limit enumeration.", "Test for cross-account access in every release." ], "stride": "E", "physicalSafety": false, "rank": "10", "closeMatch": [ "https://cwe.mitre.org/data/definitions/639.html" ], "seenInTheWild": "Charger API flaws at Wallbox and Project EV (Pen Test Partners, 2021)", "source": "https://www.pentestpartners.com/security-blog/smart-car-chargers-plug-n-play-for-hackers/" }, { "@id": "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-9", "@type": "skos:Concept", "notation": "OPH-EN-9", "prefLabel": "Modbus Open on the LAN", "definition": "Inverters and batteries answer Modbus TCP or SunSpec on the home network without authentication, so anything on the Wi-Fi can write their registers.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/energy/", "principle": "Local control interfaces are authenticated, and read-only unless enabled.", "measure": [ "Ship local Modbus read-only, with writes enabled by the owner.", "Restrict local control to named clients.", "Place energy devices on their own network segment." ], "stride": "T, E", "physicalSafety": true, "rank": "9", "closeMatch": [ "https://cwe.mitre.org/data/definitions/306.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-8", "@type": "skos:Concept", "notation": "OPH-EN-8", "prefLabel": "Tariff Signal Spoofed", "definition": "Price and demand-response signals arrive unauthenticated, so a fake low price sets every charger charging at once, or a fake high price switches off the heat pump.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/energy/", "principle": "Authenticate price and grid signals before acting on them.", "measure": [ "Verify signatures on tariff and demand-response messages.", "Bound how much the house changes in response to any one signal.", "Alert on signals that are outside the expected range." ], "stride": "S, T", "physicalSafety": false, "rank": "8", "closeMatch": [ "https://capec.mitre.org/data/definitions/194.html", "https://cwe.mitre.org/data/definitions/290.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-7", "@type": "skos:Concept", "notation": "OPH-EN-7", "prefLabel": "Installer Portal Holds Every Site", "definition": "Installer and fleet portals reach thousands of customer systems through shared or weakly protected logins.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/energy/", "principle": "Installer access is per person, per site and time-limited.", "measure": [ "Require multi-factor authentication for installer accounts.", "Grant access per site and expire it after commissioning unless renewed.", "Let owners see and revoke installer access." ], "stride": "E", "physicalSafety": false, "rank": "7", "closeMatch": [ "https://cwe.mitre.org/data/definitions/308.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-6", "@type": "skos:Concept", "notation": "OPH-EN-6", "prefLabel": "Export Limit Lifted", "definition": "The export limit agreed with the network operator can be changed in the app, so the house exports more than its connection allows and overloads the local network.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/energy/", "principle": "Export limits follow the connection agreement and are enforced in the device.", "measure": [ "Lock export limits to the approved value and log changes.", "Require an installer role to change them.", "Report exports above the limit to the owner." ], "stride": "T", "physicalSafety": false, "rank": "6", "closeMatch": [ "https://cwe.mitre.org/data/definitions/15.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-5", "@type": "skos:Concept", "notation": "OPH-EN-5", "prefLabel": "Energy Manager Empties the Battery", "definition": "The energy manager chases tariffs and exports, and drains the battery that the household relies on for backup, or switches off heating, in the hour it is needed.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/energy/", "principle": "Backup reserve and comfort limits come before optimisation.", "measure": [ "Keep a reserve the optimiser cannot use.", "Let the household set comfort floors the optimiser respects.", "Show what the optimiser did and why." ], "stride": "D", "physicalSafety": false, "rank": "5" }, { "@id": "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-4", "@type": "skos:Concept", "notation": "OPH-EN-4", "prefLabel": "Meter Data Shows the Household", "definition": "Detailed consumption data shows when people wake, cook, shower and leave, and which appliances they own, and is shared with suppliers and third parties.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/energy/", "principle": "Collect at the resolution the purpose needs, and share only with consent.", "measure": [ "Default to the lowest resolution the tariff needs.", "Ask consent separately for each third party.", "Let the household see and delete detailed data." ], "stride": "I", "physicalSafety": false, "rank": "4", "closeMatch": [ "https://cwe.mitre.org/data/definitions/359.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-3", "@type": "skos:Concept", "notation": "OPH-EN-3", "prefLabel": "Phantom Generation", "definition": "Production and consumption readings can be forged, so billing, feed-in payments and carbon claims rest on numbers nobody can trust.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/energy/", "principle": "Readings that are paid for are signed at the meter.", "measure": [ "Sign readings in the meter or inverter.", "Cross-check generation against irradiance and neighbouring systems.", "Keep an audit trail of corrections." ], "stride": "T, R", "physicalSafety": false, "rank": "3" }, { "@id": "https://ostering.com/taxonomies/smart-home/energy/#OPH-EN-2", "@type": "skos:Concept", "notation": "OPH-EN-2", "prefLabel": "Charger Knows Who's Home", "definition": "Charging sessions, contract certificates and vehicle identifiers collected by the charger show when each car comes and goes.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/energy/", "principle": "Collect vehicle data only for billing and safety, and keep it short.", "measure": [ "Do not store vehicle identifiers beyond the session unless needed for billing.", "Keep session history on the device by default.", "Disclose who receives charging data." ], "stride": "I", "physicalSafety": false, "rank": "2", "closeMatch": [ "https://cwe.mitre.org/data/definitions/359.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/home-network/", "@type": "skos:Concept", "notation": "OPH-NW", "prefLabel": "Home Network", "definition": "The router, the Wi-Fi, the guest network and the house's path to the internet. Most smart home products assume the home network is friendly; it rarely is.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "topConceptOf": "https://ostering.com/taxonomies/smart-home/", "narrower": [ "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-A", "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-K", "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-Q", "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-J", "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-10", "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-9", "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-8", "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-7", "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-6", "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-5", "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-4", "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-3", "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-2" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-A", "@type": "skos:Concept", "notation": "OPH-NW-A", "prefLabel": "Port Forwarded to the House", "definition": "Devices open inbound ports through UPnP, or setup guides tell owners to forward them, so cameras, recorders and hubs face the internet's scanners directly.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/home-network/", "principle": "No inbound exposure by default; remote access goes through an outbound, authenticated connection.", "measure": [ "Never request UPnP port mappings from the device.", "Provide remote access through an authenticated relay or tunnel that the device opens outward.", "Test the home's exposure from outside at setup and warn when a device is reachable." ], "stride": "E, I", "physicalSafety": false, "rank": "A", "closeMatch": [ "https://cwe.mitre.org/data/definitions/1188.html" ], "broadMatch": [ "https://capec.mitre.org/data/definitions/310.html" ], "seenInTheWild": "Mirai botnet (2016), built from internet-exposed cameras and DVRs", "source": "https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/" }, { "@id": "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-K", "@type": "skos:Concept", "notation": "OPH-NW-K", "prefLabel": "Flat Network", "definition": "Bulbs, cameras, appliances, the hub and the household's laptops share one network, so the weakest device reaches the hub's local interface and every computer.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/home-network/", "principle": "Separate devices by trust, and allow only the flows each one needs.", "measure": [ "Put devices on their own network or VLAN, with client isolation.", "Allow only the device-to-hub and device-to-cloud flows each device needs.", "Document the flows each product needs so the network can enforce them." ], "stride": "E, T", "physicalSafety": false, "rank": "K", "closeMatch": [ "https://cwe.mitre.org/data/definitions/653.html" ], "seenInTheWild": "Casino fish-tank thermometer breach (Darktrace, 2017)", "source": "https://securityaffairs.com/71433/hacking/fish-tank-hack.html" }, { "@id": "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-Q", "@type": "skos:Concept", "notation": "OPH-NW-Q", "prefLabel": "Router Taken Over", "definition": "The home router runs with default or weak admin credentials or unpatched firmware, and whoever owns it controls DNS, routing and every device's path to the internet.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/home-network/", "principle": "The router is the house's perimeter and is secured and updated like one.", "measure": [ "Ship unique admin credentials and disable remote administration by default.", "Update router firmware automatically, with signed images.", "Alert on DNS or admin setting changes." ], "stride": "E, T", "physicalSafety": false, "rank": "Q", "closeMatch": [ "https://capec.mitre.org/data/definitions/70.html", "https://cwe.mitre.org/data/definitions/1392.html" ], "seenInTheWild": "VPNFilter (Cisco Talos, 2018)", "source": "https://www.theregister.com/2018/05/23/vpnfilter_malware_menacing_routers_worldwide/" }, { "@id": "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-J", "@type": "skos:Concept", "notation": "OPH-NW-J", "prefLabel": "Trusts Whoever Answers", "definition": "Devices trust whatever DNS returns and accept any TLS certificate, or skip the hostname check, so whoever controls the network path receives commands and serves updates.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/home-network/", "principle": "Authenticate the far end, whatever the network says.", "measure": [ "Validate certificates and hostnames on every connection, with pinned roots for vendor services.", "Use encrypted DNS where the platform supports it.", "Test every release against an interception proxy." ], "stride": "S, T, I", "physicalSafety": false, "rank": "J", "closeMatch": [ "https://capec.mitre.org/data/definitions/94.html", "https://cwe.mitre.org/data/definitions/295.html", "https://cwe.mitre.org/data/definitions/297.html" ], "broadMatch": [ "https://capec.mitre.org/data/definitions/142.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-10", "@type": "skos:Concept", "notation": "OPH-NW-10", "prefLabel": "Cut the Cable, Silence the House", "definition": "Alarms and cameras report only over the home broadband, so cutting the cable or the power to the router stops every alert before a break-in.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/home-network/", "principle": "Safety and security reporting has a second, independent path.", "measure": [ "Give alarms a cellular or other backup path.", "Treat loss of connectivity while armed as an alarm at the receiving end.", "Keep the router and the backup path on battery power." ], "stride": "D", "physicalSafety": true, "rank": "10", "closeMatch": [ "https://capec.mitre.org/data/definitions/583.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-9", "@type": "skos:Concept", "notation": "OPH-NW-9", "prefLabel": "Evil Twin at Setup", "definition": "During setup the app or device joins an access point that copies the home's network name, or sends the Wi-Fi password in the clear, so an attacker nearby captures it.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/home-network/", "principle": "Provisioning authenticates both ends and never exposes the Wi-Fi password.", "measure": [ "Provision over an authenticated channel (BLE with a PAKE, Wi-Fi Easy Connect).", "Confirm the network the device joined matches the one chosen.", "Never send credentials in the clear during setup." ], "stride": "S, I", "physicalSafety": false, "rank": "9", "closeMatch": [ "https://capec.mitre.org/data/definitions/615.html", "https://cwe.mitre.org/data/definitions/319.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-8", "@type": "skos:Concept", "notation": "OPH-NW-8", "prefLabel": "IPv6 Walks Past the NAT", "definition": "Devices take public IPv6 addresses and the design assumes NAT keeps them unreachable, but the router's IPv6 firewall lets inbound traffic through.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/home-network/", "principle": "Do not rely on NAT; filter inbound traffic on every address family.", "measure": [ "Bind local services to link-local or private addresses only.", "Test reachability over IPv6 as well as IPv4.", "Ship routers with inbound IPv6 blocked by default." ], "stride": "E", "physicalSafety": false, "rank": "8" }, { "@id": "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-7", "@type": "skos:Concept", "notation": "OPH-NW-7", "prefLabel": "Guest Network Bridged", "definition": "The guest network can reach smart devices through discovery reflection or casting features, so a visitor's infected phone reaches the hub.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/home-network/", "principle": "Guests reach the internet, not the house.", "measure": [ "Isolate the guest network from device networks.", "Keep discovery reflection off for guest networks.", "Offer guest control through invitations, not network membership." ], "stride": "E", "physicalSafety": false, "rank": "7", "closeMatch": [ "https://cwe.mitre.org/data/definitions/653.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-6", "@type": "skos:Concept", "notation": "OPH-NW-6", "prefLabel": "Wi-Fi Knocked Off", "definition": "Deauthentication frames or a Wi-Fi jammer knock cameras and doorbells offline before a break-in, and the system does not notice.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/home-network/", "principle": "Treat loss of a security device's link as an event, and harden the link.", "measure": [ "Use WPA3 with protected management frames.", "Alert when a camera or doorbell drops off while the house is armed.", "Record locally during a link loss and upload afterwards." ], "stride": "D", "physicalSafety": false, "rank": "6", "closeMatch": [ "https://capec.mitre.org/data/definitions/604.html" ], "seenInTheWild": "Wi-Fi jammers used in burglaries (LAPD and other US police warnings, 2024)", "source": "https://www.tomshardware.com/networking/lapd-warn-residents-after-spate-of-wi-fi-jammer-cloaked-burglaries-police-share-a-security-check-list" }, { "@id": "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-5", "@type": "skos:Concept", "notation": "OPH-NW-5", "prefLabel": "Discovery Lists the House", "definition": "The hub and devices announce themselves by mDNS and SSDP with names like 'Front Door Lock' and 'Nursery Camera', and their firmware versions, to anything on the network.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/home-network/", "principle": "Announce only what a client needs to connect.", "measure": [ "Use generic service names and leave out firmware versions.", "Answer discovery only on the device network.", "Let the owner turn off announcements once setup is done." ], "stride": "I", "physicalSafety": false, "rank": "5", "closeMatch": [ "https://capec.mitre.org/data/definitions/292.html", "https://cwe.mitre.org/data/definitions/497.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-4", "@type": "skos:Concept", "notation": "OPH-NW-4", "prefLabel": "Sharing the House's Network", "definition": "Devices join a vendor's shared neighbourhood network by default, carrying neighbours' traffic over the home's connection.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/home-network/", "principle": "Sharing is opt-in.", "measure": [ "Ship shared-network features off.", "Explain what is shared and with whom before asking.", "Let the owner see the bandwidth used." ], "stride": "I, E", "physicalSafety": false, "rank": "4", "closeMatch": [ "https://cwe.mitre.org/data/definitions/1188.html" ], "seenInTheWild": "Amazon Sidewalk enabled by default (June 2021)", "source": "https://hackaday.com/2021/05/19/psa-amazon-sidewalk-rolls-out-june-8th" }, { "@id": "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-3", "@type": "skos:Concept", "notation": "OPH-NW-3", "prefLabel": "The House Attacks Others", "definition": "Compromised devices flood other people's services or scan the internet from the home connection, and nothing in the design notices.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/home-network/", "principle": "Bound what a device can send, and watch for change.", "measure": [ "Rate-limit outbound connections per device.", "Alert on traffic far outside a device's normal profile.", "Publish the endpoints each device talks to, so the network can block the rest." ], "stride": "D", "physicalSafety": false, "rank": "3", "closeMatch": [ "https://capec.mitre.org/data/definitions/125.html" ], "broadMatch": [ "https://cwe.mitre.org/data/definitions/770.html" ], "seenInTheWild": "Mirai DDoS attacks (2016)", "source": "https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/" }, { "@id": "https://ostering.com/taxonomies/smart-home/home-network/#OPH-NW-2", "@type": "skos:Concept", "notation": "OPH-NW-2", "prefLabel": "Phones Home to Everyone", "definition": "Devices talk to analytics, advertising and unknown third parties with no stated list, so the owner cannot tell normal from exfiltration.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/home-network/", "principle": "Every destination is declared.", "measure": [ "Publish the destinations each device contacts, and why.", "Remove third-party trackers from device firmware.", "Support a manufacturer usage description so routers can enforce it." ], "stride": "I", "physicalSafety": false, "rank": "2" }, { "@id": "https://ostering.com/taxonomies/smart-home/vendor-cloud/", "@type": "skos:Concept", "notation": "OPH-CL", "prefLabel": "Vendor Cloud", "definition": "The vendor's service that binds devices to accounts, relays commands, stores events and links to other ecosystems. One cloud serves a million houses, so its mistakes are made a million times.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "topConceptOf": "https://ostering.com/taxonomies/smart-home/", "narrower": [ "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-A", "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-K", "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-Q", "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-J", "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-10", "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-9", "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-8", "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-7", "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-6", "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-5", "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-4", "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-3", "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-2" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-A", "@type": "skos:Concept", "notation": "OPH-CL-A", "prefLabel": "Cloud Commands Every Home", "definition": "Devices obey whatever the vendor's cloud sends, so a compromise of the command plane, its admin console or its signing keys is a compromise of every home at once.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/vendor-cloud/", "principle": "Devices verify that commands come from the owner, not just from the cloud.", "measure": [ "Sign security-critical commands on the owner's device and verify them on the target.", "Protect cloud admin access with phishing-resistant MFA and just-in-time grants.", "Limit the blast radius by region and tenant, and rate-limit bulk commands." ], "stride": "E, T", "physicalSafety": true, "rank": "A", "broadMatch": [ "https://cwe.mitre.org/data/definitions/1357.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-K", "@type": "skos:Concept", "notation": "OPH-CL-K", "prefLabel": "Device Claimed by Someone Else", "definition": "The cloud binds a device to whichever account first presents its serial number or MAC address, so an attacker pre-claims or re-claims devices from the label or the box.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/vendor-cloud/", "principle": "Claiming a device needs proof that you hold it.", "measure": [ "Require proof of possession at claim (a secret shown only on the device, or a local challenge).", "Use claim tokens that cannot be guessed from the serial number.", "Notify the current owner of any claim attempt." ], "stride": "E, S", "physicalSafety": false, "rank": "K", "closeMatch": [ "https://cwe.mitre.org/data/definitions/283.html" ], "broadMatch": [ "https://cwe.mitre.org/data/definitions/340.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-Q", "@type": "skos:Concept", "notation": "OPH-CL-Q", "prefLabel": "Other Homes by ID", "definition": "API endpoints accept a device or home ID without checking that the caller owns it, so enumerating IDs reads or controls other people's houses.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/vendor-cloud/", "principle": "Authorise every object on every request.", "measure": [ "Check ownership of every device and home ID in every handler.", "Use non-sequential identifiers and rate-limit enumeration.", "Run automated cross-tenant tests in every release." ], "stride": "E, I", "physicalSafety": false, "rank": "Q", "closeMatch": [ "https://cwe.mitre.org/data/definitions/639.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-J", "@type": "skos:Concept", "notation": "OPH-CL-J", "prefLabel": "One Device Speaks for Another", "definition": "Devices authenticate to the cloud with a shared or derivable credential (a fleet-wide certificate, a key from the MAC address), so cloning one device impersonates others.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/vendor-cloud/", "principle": "Each device has its own key, provisioned in manufacture.", "measure": [ "Provision a unique key pair per device in a secure element.", "Bind cloud identity to that key, never to a derivable value.", "Revoke individual device credentials when cloning is detected." ], "stride": "S", "physicalSafety": false, "rank": "J", "closeMatch": [ "https://capec.mitre.org/data/definitions/151.html", "https://cwe.mitre.org/data/definitions/798.html", "https://cwe.mitre.org/data/definitions/1394.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-10", "@type": "skos:Concept", "notation": "OPH-CL-10", "prefLabel": "Credential Stuffing the House", "definition": "Home accounts protected by a password alone fall to credential stuffing, and the attacker gets every device in the house.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/vendor-cloud/", "principle": "A home account needs stronger authentication than a password.", "measure": [ "Offer passkeys and require MFA for accounts that hold locks, alarms or cameras.", "Check passwords against breach corpora.", "Rate-limit and fingerprint login attempts." ], "stride": "S", "physicalSafety": false, "rank": "10", "closeMatch": [ "https://capec.mitre.org/data/definitions/600.html", "https://cwe.mitre.org/data/definitions/307.html", "https://cwe.mitre.org/data/definitions/308.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-9", "@type": "skos:Concept", "notation": "OPH-CL-9", "prefLabel": "Linked Service Overreach", "definition": "Linking to a voice assistant, automation service or insurer grants a broad, non-expiring token for every device, so a breach at the third party is control of the house.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/vendor-cloud/", "principle": "Linked services get the least access for the shortest time.", "measure": [ "Scope linking tokens by device and action, and exclude locks and alarms unless chosen.", "Expire linking tokens and require renewal.", "Show the owner every linked service and what it can do." ], "stride": "E, I", "physicalSafety": false, "rank": "9", "closeMatch": [ "https://cwe.mitre.org/data/definitions/1220.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-8", "@type": "skos:Concept", "notation": "OPH-CL-8", "prefLabel": "Support Desk Hands Over the House", "definition": "Customer support can move devices between accounts or reset MFA on a phone call with weak identity checks.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/vendor-cloud/", "principle": "Account recovery is as strong as account login.", "measure": [ "Require proof of possession of a device or a recovery code for transfers.", "Delay and notify on recovery, so the real owner can stop it.", "Log support actions where the owner can see them." ], "stride": "S", "physicalSafety": false, "rank": "8", "closeMatch": [ "https://capec.mitre.org/data/definitions/407.html" ], "broadMatch": [ "https://cwe.mitre.org/data/definitions/640.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-7", "@type": "skos:Concept", "notation": "OPH-CL-7", "prefLabel": "App Says Locked", "definition": "The cloud's copy of device state goes stale, so the app shows 'locked' or 'armed' while the device is not, and the owner relies on it.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/vendor-cloud/", "principle": "Show state with its age, and confirm critical state from the device.", "measure": [ "Show when each state was last confirmed by the device.", "Confirm lock and alarm state from the device before displaying it as current.", "Alert when the device and the cloud disagree." ], "stride": "T", "physicalSafety": true, "rank": "7", "closeMatch": [ "https://cwe.mitre.org/data/definitions/451.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-6", "@type": "skos:Concept", "notation": "OPH-CL-6", "prefLabel": "One Region, Every Home", "definition": "A single cloud region's outage stops cameras, doorbells, locks and vacuums in every home that depends on it, because nothing works locally.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/vendor-cloud/", "principle": "Core functions work without the cloud.", "measure": [ "Keep locks, alarms, lighting and heating working on the local network.", "Run the cloud across regions with tested failover.", "Tell owners which functions need the cloud." ], "stride": "D", "physicalSafety": false, "rank": "6", "seenInTheWild": "AWS us-east-1 outage (Dec 2021)", "source": "https://www.bleepingcomputer.com/news/technology/aws-outage-impacts-ring-netflix-and-amazon-deliveries/" }, { "@id": "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-5", "@type": "skos:Concept", "notation": "OPH-CL-5", "prefLabel": "Data Kept and Reused", "definition": "The vendor keeps telemetry, voice, video and maps beyond their purpose and reuses them for training or advertising.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/vendor-cloud/", "principle": "Keep data for its stated purpose and period, then delete it.", "measure": [ "Set retention per data type and enforce it in storage and backups.", "Ask for consent before reuse for training or advertising.", "Give the owner an export and a verified deletion." ], "stride": "I", "physicalSafety": false, "rank": "5", "closeMatch": [ "https://cwe.mitre.org/data/definitions/359.html" ], "seenInTheWild": "FTC action against Amazon over Alexa retention of children's voice recordings (2023)", "source": "https://techcrunch.com/2023/05/31/amazon-settles-with-ftc-for-25m-after-flouting-kids-privacy-and-deletion-requests" }, { "@id": "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-4", "@type": "skos:Concept", "notation": "OPH-CL-4", "prefLabel": "Fake Notification", "definition": "Push notifications and webhooks are not authenticated, so an attacker sends a fake 'door locked' or a fake alarm prompt that tricks the owner into acting.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/vendor-cloud/", "principle": "Notifications carry no authority on their own.", "measure": [ "Sign webhook payloads and verify them.", "Make any action from a notification open the app and re-check state.", "Keep sensitive details off lock-screen notifications." ], "stride": "S", "physicalSafety": false, "rank": "4", "closeMatch": [ "https://cwe.mitre.org/data/definitions/290.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-3", "@type": "skos:Concept", "notation": "OPH-CL-3", "prefLabel": "Device Floods the Tenant", "definition": "A device can post any volume of telemetry, so a malicious one exhausts a household's quota, runs up costs or poisons analytics.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/vendor-cloud/", "principle": "Bound what each device can send.", "measure": [ "Rate-limit and size-limit ingestion per device.", "Validate telemetry against the device type's schema.", "Quarantine devices that exceed their limits." ], "stride": "D", "physicalSafety": false, "rank": "3", "closeMatch": [ "https://capec.mitre.org/data/definitions/125.html", "https://cwe.mitre.org/data/definitions/770.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/vendor-cloud/#OPH-CL-2", "@type": "skos:Concept", "notation": "OPH-CL-2", "prefLabel": "Vendor Access Unseen", "definition": "The owner cannot see when vendor staff, support or authorities accessed their data or devices.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/vendor-cloud/", "principle": "Every access by someone other than the household is visible to the household.", "measure": [ "Log vendor and legal access to each home.", "Show that log to the owner, unless a court forbids it.", "Publish a transparency report." ], "stride": "R", "physicalSafety": false, "rank": "2", "closeMatch": [ "https://cwe.mitre.org/data/definitions/778.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/remote-control/", "@type": "skos:Concept", "notation": "OPH-RC", "prefLabel": "Remote Control", "definition": "The phone in a pocket, the computer at work, the tablet on the wall and the watch on a wrist: the clients that control the house from anywhere. Each one is a key that can be lost, copied or borrowed.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "topConceptOf": "https://ostering.com/taxonomies/smart-home/", "narrower": [ "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-A", "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-K", "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-Q", "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-J", "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-10", "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-9", "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-8", "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-7", "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-6", "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-5", "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-4", "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-3", "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-2" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-A", "@type": "skos:Concept", "notation": "OPH-RC-A", "prefLabel": "Lost Phone Opens the Door", "definition": "A stolen or borrowed phone with a long-lived session, a widget or a watch complication unlocks the door with no check that the holder is the owner.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/remote-control/", "principle": "Security actions need the person, not just the phone.", "measure": [ "Require biometric or PIN confirmation in the app for unlock and disarm.", "Make widgets and watch actions for locks require the phone to be unlocked.", "Let the owner revoke a device's sessions from any other device." ], "stride": "S, E", "physicalSafety": true, "rank": "A", "closeMatch": [ "https://capec.mitre.org/data/definitions/507.html" ], "broadMatch": [ "https://cwe.mitre.org/data/definitions/308.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-K", "@type": "skos:Concept", "notation": "OPH-RC-K", "prefLabel": "Token Lifted from the App", "definition": "The app keeps refresh tokens and API keys in plain storage, logs or backups, so malware or a backup extraction gives lasting control of the house.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/remote-control/", "principle": "Store secrets in the platform's hardware-backed keystore.", "measure": [ "Keep tokens in the iOS Keychain or Android Keystore, bound to the device.", "Exclude tokens from backups and logs.", "Rotate refresh tokens on use and detect reuse." ], "stride": "I, E", "physicalSafety": false, "rank": "K", "closeMatch": [ "https://capec.mitre.org/data/definitions/37.html", "https://cwe.mitre.org/data/definitions/922.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-Q", "@type": "skos:Concept", "notation": "OPH-RC-Q", "prefLabel": "Fake App, Real Password", "definition": "A cloned app or a look-alike login page captures the owner's credentials for the house.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/remote-control/", "principle": "Make credentials useless to anyone who copies them.", "measure": [ "Offer passkeys, which cannot be phished.", "Monitor app stores and domains for impersonation.", "Alert the owner on logins from new devices." ], "stride": "S", "physicalSafety": false, "rank": "Q", "closeMatch": [ "https://capec.mitre.org/data/definitions/98.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-J", "@type": "skos:Concept", "notation": "OPH-RC-J", "prefLabel": "Dashboard Session Hijacked", "definition": "The web dashboard keeps tokens in browser storage, renders device data unencoded or accepts cross-site requests, so a malicious page or script takes over the session.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/remote-control/", "principle": "Treat the browser dashboard as a high-value web application.", "measure": [ "Use HttpOnly, SameSite session cookies rather than tokens in browser storage.", "Protect state-changing requests against forgery.", "Encode all device-supplied data and enforce a Content Security Policy." ], "stride": "E", "physicalSafety": false, "rank": "J", "closeMatch": [ "https://capec.mitre.org/data/definitions/593.html", "https://cwe.mitre.org/data/definitions/79.html" ], "broadMatch": [ "https://cwe.mitre.org/data/definitions/1004.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-10", "@type": "skos:Concept", "notation": "OPH-RC-10", "prefLabel": "Link Opens the Lock", "definition": "A custom URL scheme, app link or intent triggers unlock, disarm or share without confirmation, so a link in a text message acts on the house.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/remote-control/", "principle": "Links can open screens, never perform security actions.", "measure": [ "Route every deep link to a screen that asks for confirmation.", "Validate the source and parameters of every link handler.", "Exclude security actions from deep-link handlers entirely." ], "stride": "E", "physicalSafety": true, "rank": "10", "closeMatch": [ "https://cwe.mitre.org/data/definitions/939.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-9", "@type": "skos:Concept", "notation": "OPH-RC-9", "prefLabel": "Other Apps Drive This One", "definition": "Exported activities, services or broadcast receivers in the Android app let other apps on the phone send commands to the house.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/remote-control/", "principle": "Export only what other apps need, and check who is calling.", "measure": [ "Mark components as not exported unless required.", "Protect exported components with signature permissions.", "Use explicit intents for anything security-related." ], "stride": "E", "physicalSafety": false, "rank": "9", "closeMatch": [ "https://capec.mitre.org/data/definitions/502.html", "https://cwe.mitre.org/data/definitions/926.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-8", "@type": "skos:Concept", "notation": "OPH-RC-8", "prefLabel": "First Hub That Answers", "definition": "The app finds the hub on the local network by discovery and trusts the first device that answers, so a rogue hub collects credentials.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/remote-control/", "principle": "The app authenticates the hub before sending it anything.", "measure": [ "Pin the hub's identity at pairing and verify it on every connection.", "Warn when a new device claims to be the hub.", "Send no credentials to an unverified hub." ], "stride": "S", "physicalSafety": false, "rank": "8", "closeMatch": [ "https://capec.mitre.org/data/definitions/616.html", "https://cwe.mitre.org/data/definitions/940.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-7", "@type": "skos:Concept", "notation": "OPH-RC-7", "prefLabel": "Wall Panel Runs as Owner", "definition": "A wall tablet or shared family tablet stays signed in with the owner's full rights, so guests, children and cleaners can do anything the owner can.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/remote-control/", "principle": "Shared screens get a shared, limited role.", "measure": [ "Provide a kiosk role with chosen controls only.", "Require a PIN for security actions on shared screens.", "Time out admin sessions on shared devices." ], "stride": "E", "physicalSafety": false, "rank": "7", "closeMatch": [ "https://cwe.mitre.org/data/definitions/1220.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-6", "@type": "skos:Concept", "notation": "OPH-RC-6", "prefLabel": "Remote Desktop to the Hub", "definition": "Owners and installers expose the hub through remote desktop, VNC, SSH or a third-party tunnel with weak credentials, to reach it from work.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/remote-control/", "principle": "Provide a secure remote path so nobody builds their own.", "measure": [ "Offer an authenticated remote access path in the product.", "Warn when the hub's admin interface is reachable from the internet.", "Require MFA on any remote admin path." ], "stride": "E", "physicalSafety": false, "rank": "6", "closeMatch": [ "https://capec.mitre.org/data/definitions/555.html" ], "broadMatch": [ "https://cwe.mitre.org/data/definitions/1188.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-5", "@type": "skos:Concept", "notation": "OPH-RC-5", "prefLabel": "Notification Tells the Street", "definition": "Lock-screen notifications say 'Front door unlocked', 'Alarm disarmed' or show a camera snapshot to anyone holding or near the phone.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/remote-control/", "principle": "Lock screens show that something happened, not what.", "measure": [ "Default to generic notification text for security events.", "Keep camera snapshots off lock screens unless chosen.", "Encrypt notification payloads end to end." ], "stride": "I", "physicalSafety": false, "rank": "5", "closeMatch": [ "https://cwe.mitre.org/data/definitions/359.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-4", "@type": "skos:Concept", "notation": "OPH-RC-4", "prefLabel": "Location All the Time", "definition": "The app asks for continuous location for geofencing and sends each member's movements to the cloud and to the rest of the household.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/remote-control/", "principle": "Use the least location, for the shortest time, shown to the fewest people.", "measure": [ "Use on-device geofence events rather than location history.", "Keep each member's location visible only to themselves unless they share it.", "Let each member turn presence off without leaving the household." ], "stride": "I", "physicalSafety": false, "rank": "4", "closeMatch": [ "https://cwe.mitre.org/data/definitions/359.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-3", "@type": "skos:Concept", "notation": "OPH-RC-3", "prefLabel": "Old App Still Accepted", "definition": "The cloud accepts every old app version, so flaws fixed in the app stay exploitable by anyone who keeps the old one.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/remote-control/", "principle": "Retire vulnerable client versions.", "measure": [ "Enforce a minimum app version for security fixes.", "Version the API and turn off deprecated endpoints.", "Prompt owners to update before blocking." ], "stride": "E", "physicalSafety": false, "rank": "3" }, { "@id": "https://ostering.com/taxonomies/smart-home/remote-control/#OPH-RC-2", "@type": "skos:Concept", "notation": "OPH-RC-2", "prefLabel": "Screenshot Shows the Code", "definition": "Camera views, door codes and recovery codes appear in app-switcher snapshots, screen recordings and shared screens.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/remote-control/", "principle": "Hide sensitive screens from capture.", "measure": [ "Blank sensitive screens in the app switcher.", "Mark code and camera screens as secure against capture where the platform allows.", "Show codes only on request, for a short time." ], "stride": "I", "physicalSafety": false, "rank": "2", "closeMatch": [ "https://cwe.mitre.org/data/definitions/359.html" ], "broadMatch": [ "https://capec.mitre.org/data/definitions/648.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/voice-and-automations/", "@type": "skos:Concept", "notation": "OPH-VA", "prefLabel": "Voice and Automations", "definition": "Voice assistants, routines and scenes, rules and scripts, third-party skills and AI agents: the layer that turns words and events into actions on the house without a person pressing a button.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "topConceptOf": "https://ostering.com/taxonomies/smart-home/", "narrower": [ "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-A", "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-K", "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-Q", "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-J", "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-10", "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-9", "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-8", "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-7", "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-6", "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-5", "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-4", "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-3", "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-2" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-A", "@type": "skos:Concept", "notation": "OPH-VA-A", "prefLabel": "Voice Opens the Door", "definition": "Voice commands are accepted from anyone in earshot, from the television or from inaudible injection (ultrasound, laser), and some of them unlock doors, disarm alarms or open the garage.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/voice-and-automations/", "principle": "Voice is not identity; security actions by voice need a second factor.", "measure": [ "Keep voice unlock, disarm and open off by default.", "Require a spoken PIN and voice match, and confirm on a phone.", "Filter inaudible frequencies and check that commands come from a live speaker." ], "stride": "S, E", "physicalSafety": true, "rank": "A", "closeMatch": [ "https://cwe.mitre.org/data/definitions/290.html" ], "seenInTheWild": "DolphinAttack (2017); Light Commands (2019)", "source": "https://arxiv.org/pdf/1708.09537" }, { "@id": "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-K", "@type": "skos:Concept", "notation": "OPH-VA-K", "prefLabel": "Rule Runs as Owner", "definition": "Automations run with the owner's full rights, whoever wrote them, so a household member or integration creates a rule that unlocks the door at three in the morning.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/voice-and-automations/", "principle": "A rule runs with its author's rights, and security actions need the owner's approval.", "measure": [ "Run each rule under its author's permissions.", "Require owner approval for rules that unlock, disarm or open.", "Notify the household when a security rule is created or changed." ], "stride": "E", "physicalSafety": true, "rank": "K", "closeMatch": [ "https://cwe.mitre.org/data/definitions/250.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-Q", "@type": "skos:Concept", "notation": "OPH-VA-Q", "prefLabel": "Agent Talked into It", "definition": "An AI home agent acts on instructions hidden in device names, calendar entries, messages or text a camera sees, or reads 'open everything' too literally.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/voice-and-automations/", "principle": "An agent's reach is limited and its security actions are confirmed.", "measure": [ "Give the agent no lock, alarm or heat-appliance tools without per-action confirmation.", "Treat device names and other content as data, never as instructions.", "Log every agent action with the prompt that led to it." ], "stride": "E, T", "physicalSafety": true, "rank": "Q", "closeMatch": [ "https://cwe.mitre.org/data/definitions/1427.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-J", "@type": "skos:Concept", "notation": "OPH-VA-J", "prefLabel": "Sound-Alike Skill", "definition": "A third-party skill or action with a name that sounds like a trusted one captures commands, keeps listening or asks for passwords.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/voice-and-automations/", "principle": "Invocation names are reviewed for confusion, and skills cannot impersonate the assistant.", "measure": [ "Review new skills for names that sound like existing ones.", "Stop skills from asking for passwords or keeping the microphone open after they finish.", "Show which skill handled each request." ], "stride": "S, I", "physicalSafety": false, "rank": "J", "broadMatch": [ "https://capec.mitre.org/data/definitions/631.html" ], "seenInTheWild": "Skill Squatting (Kumar et al., USENIX Security 2018); Smart Spies (SRLabs, 2019)", "source": "https://srlabs.de/blog/smart-spies" }, { "@id": "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-10", "@type": "skos:Concept", "notation": "OPH-VA-10", "prefLabel": "Spoofed Sensor Triggers a Rule", "definition": "A rule uses a spoofable signal (motion, presence, a doorbell press, recognised face) to disarm or unlock, so whoever fakes the signal triggers the security action.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/voice-and-automations/", "principle": "Security actions never rest on a signal an outsider can fake.", "measure": [ "Exclude untrusted sensors from triggers for security actions.", "Require a second, independent condition for any disarm or unlock rule.", "Flag rules that link outside sensors to security actions." ], "stride": "E", "physicalSafety": true, "rank": "10", "closeMatch": [ "https://cwe.mitre.org/data/definitions/807.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-9", "@type": "skos:Concept", "notation": "OPH-VA-9", "prefLabel": "Imported Rule Does More", "definition": "A community blueprint, script or shared routine does more than it says, sending data out or unlocking a door under a harmless name.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/voice-and-automations/", "principle": "Show what an imported rule will do before it runs.", "measure": [ "Show every action and destination of an imported rule before import.", "Run imported rules with no security actions until the owner approves them.", "Sign rules from known publishers." ], "stride": "T, E", "physicalSafety": false, "rank": "9", "closeMatch": [ "https://cwe.mitre.org/data/definitions/829.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-8", "@type": "skos:Concept", "notation": "OPH-VA-8", "prefLabel": "Rules Fight Each Other", "definition": "Two automations work against each other (heating on, window open), or loop until a device is damaged, and one triggered sensor sets off a chain.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/voice-and-automations/", "principle": "Detect conflicts and loops before and while rules run.", "measure": [ "Check new rules for conflicts with existing ones on the same devices.", "Stop loops with a limit on actions per device per minute.", "Show the chain of rules behind each action." ], "stride": "T, D", "physicalSafety": false, "rank": "8", "broadMatch": [ "https://cwe.mitre.org/data/definitions/835.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-7", "@type": "skos:Concept", "notation": "OPH-VA-7", "prefLabel": "Presence Faked", "definition": "Away mode turns off when the system sees the owner's phone by Wi-Fi or Bluetooth address, so a spoofed address 'comes home' and disarms the house.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/voice-and-automations/", "principle": "Presence from a radio address is a hint, not a person.", "measure": [ "Do not disarm on network presence alone.", "Use authenticated presence from the owner's phone.", "Notify when presence changes the security state." ], "stride": "S", "physicalSafety": false, "rank": "7", "closeMatch": [ "https://capec.mitre.org/data/definitions/151.html", "https://cwe.mitre.org/data/definitions/290.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-6", "@type": "skos:Concept", "notation": "OPH-VA-6", "prefLabel": "Overheard and Kept", "definition": "False wake words record private conversations, which are kept, reviewed by people or sent to contacts.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/voice-and-automations/", "principle": "Recordings are rare, short-lived and visible to the household.", "measure": [ "Tune wake-word detection to favour missing a command over recording.", "Delete recordings by default, and ask before human review.", "Show every recording in the household's history." ], "stride": "I", "physicalSafety": false, "rank": "6", "closeMatch": [ "https://cwe.mitre.org/data/definitions/359.html" ], "seenInTheWild": "Alexa recording sent to a contact (Portland, 2018)", "source": "https://techcrunch.com/2018/05/24/family-claims-their-echo-sent-a-private-conversation-to-a-random-contact" }, { "@id": "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-5", "@type": "skos:Concept", "notation": "OPH-VA-5", "prefLabel": "Ordered by Voice", "definition": "Voice purchases and account changes need nothing but a voice, so children, visitors and the television make them.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/voice-and-automations/", "principle": "Voice transactions need a PIN and a confirmation.", "measure": [ "Ship voice purchasing off or behind a PIN.", "Confirm purchases and account changes on a phone.", "Make purchases easy to cancel." ], "stride": "E", "physicalSafety": false, "rank": "5", "closeMatch": [ "https://cwe.mitre.org/data/definitions/308.html" ], "seenInTheWild": "Alexa dollhouse order by a child (Dallas, Jan 2017)", "source": "https://edition.cnn.com/2017/01/05/health/amazon-alexa-dollhouse-trnd/index.html" }, { "@id": "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-4", "@type": "skos:Concept", "notation": "OPH-VA-4", "prefLabel": "Assistant Answers Anyone", "definition": "The assistant tells anyone who asks whether the alarm is set, what is in the calendar and who has messaged, and reads notifications aloud.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/voice-and-automations/", "principle": "Personal and security answers need voice match.", "measure": [ "Require voice match for personal and security questions.", "Keep security state out of spoken answers by default.", "Let each member set what the assistant reads aloud." ], "stride": "I", "physicalSafety": false, "rank": "4", "closeMatch": [ "https://cwe.mitre.org/data/definitions/359.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-3", "@type": "skos:Concept", "notation": "OPH-VA-3", "prefLabel": "Rule Changed Quietly", "definition": "Rules can be edited without anyone being told, so a malicious change stays unnoticed until it runs.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/voice-and-automations/", "principle": "Every rule change is attributed and announced.", "measure": [ "Record who changed a rule, when and what changed.", "Notify the household of changes to rules that touch security devices.", "Keep rule history and allow rollback." ], "stride": "R", "physicalSafety": false, "rank": "3", "closeMatch": [ "https://cwe.mitre.org/data/definitions/778.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/voice-and-automations/#OPH-VA-2", "@type": "skos:Concept", "notation": "OPH-VA-2", "prefLabel": "Wrong Voice, Wrong Profile", "definition": "Voice match mistakes one household member for another, so personal results, purchases or permissions go to the wrong person.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/voice-and-automations/", "principle": "Fall back to the least-privileged profile when unsure.", "measure": [ "Treat uncertain voice matches as a guest.", "Let members set which actions need a confident match.", "Let members review and correct matches." ], "stride": "S", "physicalSafety": false, "rank": "2" }, { "@id": "https://ostering.com/taxonomies/smart-home/household/", "@type": "skos:Concept", "notation": "OPH-HH", "prefLabel": "Household", "definition": "The people in the house: partners, children, lodgers, guests, cleaners, landlords and installers. A smart home has many users with different interests, and most products model one owner.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "topConceptOf": "https://ostering.com/taxonomies/smart-home/", "narrower": [ "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-A", "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-K", "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-Q", "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-J", "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-10", "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-9", "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-8", "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-7", "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-6", "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-5", "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-4", "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-3", "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-2" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-A", "@type": "skos:Concept", "notation": "OPH-HH-A", "prefLabel": "House Turned Against Its People", "definition": "A partner or ex-partner with admin rights uses the cameras, locks, heating and lights to watch, control or frighten the others in the house.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/household/", "principle": "Everyone who lives in the house can see who controls it, and control cannot be kept in secret.", "measure": [ "Show every adult resident the full list of users, sessions and linked services.", "Notify residents when cameras or microphones are viewed and when rules change.", "Provide a documented way to remove an admin without the admin's cooperation, on proof of residence." ], "stride": "E, I", "physicalSafety": true, "rank": "A", "broadMatch": [ "https://capec.mitre.org/data/definitions/122.html" ], "seenInTheWild": "Smart home devices used in domestic abuse (New York Times, June 2018)", "source": "https://www.cnbc.com/2018/06/26/thermostats-locks-and-lights-digital-tools-of-domestic-abuse.html" }, { "@id": "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-K", "@type": "skos:Concept", "notation": "OPH-HH-K", "prefLabel": "Ex Keeps the Keys", "definition": "Someone who has moved out keeps the account, codes and app access because the devices are bound to their account.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/household/", "principle": "Leaving the house ends access, and the people who stay keep the house.", "measure": [ "Bind devices to the home, with members, rather than to one person's account.", "Make removing a member revoke every code, session and token they hold.", "Let remaining residents take over ownership with proof of residence." ], "stride": "E", "physicalSafety": true, "rank": "K", "closeMatch": [ "https://cwe.mitre.org/data/definitions/282.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-Q", "@type": "skos:Concept", "notation": "OPH-HH-Q", "prefLabel": "One Account for Everyone", "definition": "The product has one account that the household shares, so there is no attribution, and revoking one person means changing everyone's password.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/household/", "principle": "Every person has their own identity in the home.", "measure": [ "Support individual member accounts with roles.", "Make inviting a member easier than sharing the password.", "Show each action against the person who took it." ], "stride": "S, R", "physicalSafety": false, "rank": "Q", "closeMatch": [ "https://cwe.mitre.org/data/definitions/1220.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-J", "@type": "skos:Concept", "notation": "OPH-HH-J", "prefLabel": "Landlord Sees Inside", "definition": "A landlord or agent installs devices and keeps admin or camera access to the tenant's home, and the tenant is not an admin.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/household/", "principle": "The occupier controls what sees and hears inside their home.", "measure": [ "Split building control (boiler service, leak alerts) from occupier control (cameras, locks, schedules).", "Hand occupier control to the tenant at the start of a tenancy.", "Show the tenant every access the landlord has." ], "stride": "I, E", "physicalSafety": false, "rank": "J" }, { "@id": "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-10", "@type": "skos:Concept", "notation": "OPH-HH-10", "prefLabel": "Installer Keeps a Key", "definition": "The installer or integrator keeps admin or remote access after handover, and the owner does not know it exists.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/household/", "principle": "Handover transfers all control and ends the installer's access.", "measure": [ "Expire installer access at handover unless the owner renews it.", "List installer access in the app.", "Require the owner's consent per visit for later access." ], "stride": "E, I", "physicalSafety": false, "rank": "10", "closeMatch": [ "https://capec.mitre.org/data/definitions/122.html" ], "seenInTheWild": "ADT technician accessed customer cameras (disclosed 2020, guilty plea 2021)", "source": "https://abc7news.com/adt-tech-home-security-hacker-video-hack-internet/9903489/" }, { "@id": "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-9", "@type": "skos:Concept", "notation": "OPH-HH-9", "prefLabel": "Guest Gets Owner Rights", "definition": "Inviting a guest grants a role that can add users, view camera history or change rules, and the invitation never expires.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/household/", "principle": "Guests get a narrow role with an end date.", "measure": [ "Offer guest roles limited to chosen devices and times.", "Expire guest access by default.", "Keep camera history and user management out of guest roles." ], "stride": "E", "physicalSafety": false, "rank": "9", "closeMatch": [ "https://cwe.mitre.org/data/definitions/1220.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-8", "@type": "skos:Concept", "notation": "OPH-HH-8", "prefLabel": "Child Holds Adult Rights", "definition": "Children use the panel, voice or a shared tablet to disarm the alarm, unlock the door or turn on appliances, because the product has no child role.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/household/", "principle": "Roles fit the person: children get the controls a child should have.", "measure": [ "Provide child roles without security or heat-appliance actions.", "Apply roles on every interface (voice, panel, app).", "Let parents review what a child's role can do." ], "stride": "E", "physicalSafety": true, "rank": "8", "closeMatch": [ "https://cwe.mitre.org/data/definitions/1220.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-7", "@type": "skos:Concept", "notation": "OPH-HH-7", "prefLabel": "Emergency Access Denied", "definition": "In an emergency (a fire, a fall, the owner taken ill) responders and family cannot get in or silence the alarm, because there is no break-glass access.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/household/", "principle": "Plan emergency access before the emergency.", "measure": [ "Provide a break-glass credential held by a named contact or service.", "Make emergency access logged and notified.", "Keep a mechanical way in for emergency services." ], "stride": "D", "physicalSafety": true, "rank": "7" }, { "@id": "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-6", "@type": "skos:Concept", "notation": "OPH-HH-6", "prefLabel": "Building Controls the Door", "definition": "In a shared building, the managing agent's system controls the entrance, flat doors or shared hub, and residents cannot see or limit what it does.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/household/", "principle": "Residents see and control access to their own home.", "measure": [ "Show residents every credential that opens their door.", "Separate building-wide access from access to each home.", "Give residents an audit log of their door." ], "stride": "E, I", "physicalSafety": false, "rank": "6" }, { "@id": "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-5", "@type": "skos:Concept", "notation": "OPH-HH-5", "prefLabel": "Family Members Tracked", "definition": "Presence and geofencing features show each member's arrivals and departures to everyone else in the household, including people they would not choose to tell.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/household/", "principle": "Each person controls who sees their location.", "measure": [ "Make presence sharing per person and opt-in.", "Show members who can see their presence.", "Let a member stop sharing without others being alerted." ], "stride": "I", "physicalSafety": false, "rank": "5", "closeMatch": [ "https://cwe.mitre.org/data/definitions/359.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-4", "@type": "skos:Concept", "notation": "OPH-HH-4", "prefLabel": "Alert Goes to the Absent Owner", "definition": "Smoke, CO, leak and alarm alerts go only to the account owner, who may be abroad, and not to the people in the house.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/household/", "principle": "Safety alerts reach the people who can act.", "measure": [ "Send safety alerts to everyone present and to named contacts.", "Escalate when the first recipient does not acknowledge.", "Sound alerts locally whatever the app does." ], "stride": "D", "physicalSafety": true, "rank": "4" }, { "@id": "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-3", "@type": "skos:Concept", "notation": "OPH-HH-3", "prefLabel": "Visitors Recorded Without Notice", "definition": "Indoor cameras and microphones record nannies, cleaners, guests and tradespeople who were never told.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/household/", "principle": "People in the home know when they are recorded.", "measure": [ "Provide visible indicators and a guest mode that pauses indoor recording.", "Prompt owners about notice duties when indoor recording is on.", "Make recording schedules easy to set around visits." ], "stride": "I", "physicalSafety": false, "rank": "3" }, { "@id": "https://ostering.com/taxonomies/smart-home/household/#OPH-HH-2", "@type": "skos:Concept", "notation": "OPH-HH-2", "prefLabel": "Nobody Reviews the Members", "definition": "The product never prompts anyone to review users, codes and rights when the household changes, so access only grows.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/household/", "principle": "Access is reviewed when life changes.", "measure": [ "Prompt a review of members and credentials periodically.", "Prompt a review when a member has been inactive for a long time.", "Show unused credentials and offer to remove them." ], "stride": "E", "physicalSafety": false, "rank": "2" }, { "@id": "https://ostering.com/taxonomies/smart-home/lifecycle/", "@type": "skos:Concept", "notation": "OPH-LC", "prefLabel": "Lifecycle", "definition": "Manufacture, onboarding, updates, support, resale and disposal. A house lasts for decades, its devices are supported for a few years, and the house changes hands with the devices still on the walls.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "topConceptOf": "https://ostering.com/taxonomies/smart-home/", "narrower": [ "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-A", "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-K", "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-Q", "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-J", "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-10", "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-9", "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-8", "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-7", "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-6", "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-5", "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-4", "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-3", "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-2" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-A", "@type": "skos:Concept", "notation": "OPH-LC-A", "prefLabel": "Unsigned Update Accepted", "definition": "Devices accept firmware that is unsigned, or signed with a key extracted from a device, so anyone on the network or with the device in hand installs their own.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/lifecycle/", "principle": "Every update is signed with a key that is on no device, and verified before install.", "measure": [ "Sign firmware with an asymmetric key held in an HSM.", "Verify the signature in a secure boot chain rooted in hardware.", "Reject updates that fail verification and report them." ], "stride": "T, E", "physicalSafety": true, "rank": "A", "closeMatch": [ "https://capec.mitre.org/data/definitions/186.html", "https://cwe.mitre.org/data/definitions/494.html", "https://cwe.mitre.org/data/definitions/347.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-K", "@type": "skos:Concept", "notation": "OPH-LC-K", "prefLabel": "Vendor Turns Off the Servers", "definition": "The vendor shuts its cloud, goes bust or sells to an unknown buyer, and the devices stop working, lose their security features or come under someone else's control.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/lifecycle/", "principle": "Devices keep their core functions, and their owners keep control, without the vendor.", "measure": [ "Keep core functions local, and publish a local API before end of life.", "Commit to a notice period and an end-of-life plan.", "Let owners move devices to another controller (Matter, an open API)." ], "stride": "D", "physicalSafety": true, "rank": "K", "seenInTheWild": "Revolv shutdown (2016); Insteon shutdown (April 2022)", "source": "https://venturebeat.com/technology/alphabets-nest-will-permanently-turn-off-all-revolv-hubs-on-may-15-2016" }, { "@id": "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-Q", "@type": "skos:Concept", "notation": "OPH-LC-Q", "prefLabel": "Previous Owner Still Connected", "definition": "After a house or device is sold, the previous owner's account still controls the devices and sees the cameras, and the new owner cannot reclaim them without the old one.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/lifecycle/", "principle": "Ownership moves with the house, and the old owner's access ends.", "measure": [ "Provide a reclaim flow based on physical possession and a local reset.", "Notify and remove the previous owner when a device is reclaimed.", "Warn sellers to transfer devices as part of the sale." ], "stride": "E, I", "physicalSafety": true, "rank": "Q", "closeMatch": [ "https://cwe.mitre.org/data/definitions/282.html", "https://cwe.mitre.org/data/definitions/283.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-J", "@type": "skos:Concept", "notation": "OPH-LC-J", "prefLabel": "Implant in the Box", "definition": "Counterfeit, grey-market or compromised devices arrive with malware preinstalled, and the product cannot tell a genuine unit from a tampered one.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/lifecycle/", "principle": "Devices prove they are genuine before they are trusted.", "measure": [ "Use hardware attestation at onboarding.", "Refuse to onboard units that fail attestation.", "Publish how to check a device is genuine." ], "stride": "T, E", "physicalSafety": false, "rank": "J", "closeMatch": [ "https://capec.mitre.org/data/definitions/439.html", "https://cwe.mitre.org/data/definitions/506.html" ], "seenInTheWild": "BadBox Android TV boxes (Human Security, 2023 and 2025)", "source": "https://www.humansecurity.com/newsroom/human-disrupts-digital-supply-chain-threat-actor-scheme-originating-from-china" }, { "@id": "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-10", "@type": "skos:Concept", "notation": "OPH-LC-10", "prefLabel": "Rolled Back to a Hole", "definition": "An attacker installs an older, validly signed firmware that still has a known flaw.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/lifecycle/", "principle": "Firmware never goes backwards past a security fix.", "measure": [ "Keep an anti-rollback counter in hardware.", "Raise the security version with every security fix.", "Refuse older images." ], "stride": "T", "physicalSafety": false, "rank": "10", "closeMatch": [ "https://cwe.mitre.org/data/definitions/1328.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-9", "@type": "skos:Concept", "notation": "OPH-LC-9", "prefLabel": "Reset Doesn't Erase", "definition": "A factory reset leaves the Wi-Fi password, tokens and recordings in flash, so a resold or discarded device gives up the old home's secrets.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/lifecycle/", "principle": "Reset erases every secret and personal record.", "measure": [ "Encrypt user data under a key that reset destroys.", "Revoke the device's cloud credentials on reset.", "Test reset by reading the flash afterwards." ], "stride": "I", "physicalSafety": false, "rank": "9", "closeMatch": [ "https://capec.mitre.org/data/definitions/675.html", "https://cwe.mitre.org/data/definitions/1266.html" ], "seenInTheWild": "Wi-Fi password stored in plain text in LIFX bulb flash (LimitedResults, 2019)", "source": "https://appleinsider.com/articles/19/01/30/lifx-homekit-bulbs-appear-to-be-storing-wi-fi-passwords-unencrypted" }, { "@id": "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-8", "@type": "skos:Concept", "notation": "OPH-LC-8", "prefLabel": "Support Ends Silently", "definition": "Devices stop receiving security updates with no stated end date and no notice, and keep running on the network.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/lifecycle/", "principle": "State the support period, and tell owners before it ends.", "measure": [ "State the minimum security support period on the box and in the app.", "Notify owners before support ends.", "Offer to isolate or retire devices after end of support." ], "stride": "E", "physicalSafety": false, "rank": "8", "broadMatch": [ "https://cwe.mitre.org/data/definitions/1104.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-7", "@type": "skos:Concept", "notation": "OPH-LC-7", "prefLabel": "Old Library Inside", "definition": "Devices ship with old Linux kernels, BusyBox, OpenSSL and vendor SDKs with known flaws, and the vendor cannot tell which products are affected.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/lifecycle/", "principle": "Know what is in the device and keep it current.", "measure": [ "Produce an SBOM for every firmware release.", "Track advisories against the SBOM and ship fixes within a stated time.", "Remove components the product does not use." ], "stride": "E", "physicalSafety": false, "rank": "7", "closeMatch": [ "https://cwe.mitre.org/data/definitions/1395.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-6", "@type": "skos:Concept", "notation": "OPH-LC-6", "prefLabel": "Update Fails Halfway", "definition": "A power cut or failed download mid-update bricks the device, or leaves the lock or alarm in an unknown state.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/lifecycle/", "principle": "Updates are atomic and leave a working device whatever happens.", "measure": [ "Use A/B partitions with automatic rollback.", "Update security devices only when disarmed and attended, or with a safe fallback state.", "Report update failures to the owner." ], "stride": "D", "physicalSafety": true, "rank": "6", "broadMatch": [ "https://cwe.mitre.org/data/definitions/1419.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-5", "@type": "skos:Concept", "notation": "OPH-LC-5", "prefLabel": "Baked-In Certificate Expires", "definition": "A root certificate or device certificate baked into firmware expires, and devices across the fleet stop connecting on the same day.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/lifecycle/", "principle": "Plan credential expiry and renewal for the device's whole life.", "measure": [ "Keep root stores updatable.", "Track the expiry of every certificate in the fleet.", "Renew before expiry with a tested path." ], "stride": "D", "physicalSafety": false, "rank": "5", "broadMatch": [ "https://cwe.mitre.org/data/definitions/1329.html" ], "seenInTheWild": "DST Root CA X3 expiry (Sept 2021)", "source": "https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/" }, { "@id": "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-4", "@type": "skos:Concept", "notation": "OPH-LC-4", "prefLabel": "Account Deleted, Data Kept", "definition": "Deleting the account or removing a device leaves recordings, maps and history in the cloud and its backups.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/lifecycle/", "principle": "Deletion reaches every copy.", "measure": [ "Delete user data from primary storage, analytics and backups on schedule.", "Confirm deletion to the owner.", "Test deletion end to end." ], "stride": "I", "physicalSafety": false, "rank": "4", "closeMatch": [ "https://cwe.mitre.org/data/definitions/212.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-3", "@type": "skos:Concept", "notation": "OPH-LC-3", "prefLabel": "Nowhere to Report a Flaw", "definition": "Researchers who find a flaw have no published way to report it, so it is sold or disclosed without a fix.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/lifecycle/", "principle": "Publish a vulnerability disclosure policy and act on reports.", "measure": [ "Publish a contact and policy for vulnerability reports.", "Acknowledge reports and give timelines.", "Credit reporters and publish advisories." ], "stride": "E", "physicalSafety": false, "rank": "3" }, { "@id": "https://ostering.com/taxonomies/smart-home/lifecycle/#OPH-LC-2", "@type": "skos:Concept", "notation": "OPH-LC-2", "prefLabel": "Repair Shop Sees the Home", "definition": "Devices sent for repair or replacement carry recordings, maps and credentials that the repairer can read.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/lifecycle/", "principle": "Devices leave the home without the home's data.", "measure": [ "Offer a repair mode that locks user data.", "Wipe or encrypt user data before a unit is returned.", "Tell owners what a repairer can access." ], "stride": "I", "physicalSafety": false, "rank": "2", "closeMatch": [ "https://capec.mitre.org/data/definitions/675.html", "https://cwe.mitre.org/data/definitions/1266.html" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/structural-hazards/", "@type": "skos:Concept", "notation": "OPH-TR", "prefLabel": "Structural Hazards", "definition": "Structural hazards are properties of the connected home as a whole, not single faults. In the game they play as Trumps, in both decks; deal them against the whole design before the suits.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "topConceptOf": "https://ostering.com/taxonomies/smart-home/", "narrower": [ "https://ostering.com/taxonomies/smart-home/structural-hazards/#OPH-TR-1", "https://ostering.com/taxonomies/smart-home/structural-hazards/#OPH-TR-2", "https://ostering.com/taxonomies/smart-home/structural-hazards/#OPH-TR-3", "https://ostering.com/taxonomies/smart-home/structural-hazards/#OPH-TR-4", "https://ostering.com/taxonomies/smart-home/structural-hazards/#OPH-TR-5", "https://ostering.com/taxonomies/smart-home/structural-hazards/#OPH-TR-6", "https://ostering.com/taxonomies/smart-home/structural-hazards/#OPH-TR-7", "https://ostering.com/taxonomies/smart-home/structural-hazards/#OPH-TR-8", "https://ostering.com/taxonomies/smart-home/structural-hazards/#OPH-TR-9", "https://ostering.com/taxonomies/smart-home/structural-hazards/#OPH-TR-10" ] }, { "@id": "https://ostering.com/taxonomies/smart-home/structural-hazards/#OPH-TR-1", "@type": "skos:Concept", "notation": "OPH-TR-1", "prefLabel": "The House Is the Blast Radius", "definition": "A software fault in a smart home becomes a physical event: fire, flood, freeze, a door open to the street. Threat models that score impact by data loss miss it.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/structural-hazards/", "principle": "Score impact by what happens in the house, not just to the data.", "measure": [ "Add physical consequences (heat, water, access, life safety) to the impact scale.", "Trace every remote command to the physical effect it can cause.", "Keep independent, non-software safety for every hazardous effect." ], "stride": "T, D", "physicalSafety": true, "rank": "1" }, { "@id": "https://ostering.com/taxonomies/smart-home/structural-hazards/#OPH-TR-2", "@type": "skos:Concept", "notation": "OPH-TR-2", "prefLabel": "Every Device Is a Door", "definition": "The house is as secure as its least secure connected device: the cheapest plug shares a network and a hub with the alarm and the lock.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/structural-hazards/", "principle": "Assume the weakest device will be compromised, and limit what it reaches.", "measure": [ "Inventory every connected device and its trust level.", "Separate devices by trust on the network and in the hub.", "Let no device send commands to another without the hub's authorisation." ], "stride": "E", "physicalSafety": false, "rank": "2" }, { "@id": "https://ostering.com/taxonomies/smart-home/structural-hazards/#OPH-TR-3", "@type": "skos:Concept", "notation": "OPH-TR-3", "prefLabel": "The Cloud Holds the Keys", "definition": "Local functions and safety features depend on a remote service the household does not control, and that service can fail, change or be compromised.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/structural-hazards/", "principle": "Decide which functions must work without the cloud, and make them.", "measure": [ "List the functions that need the cloud.", "Make safety, access and heating work locally.", "Test the house with the internet off." ], "stride": "D, E", "physicalSafety": false, "rank": "3" }, { "@id": "https://ostering.com/taxonomies/smart-home/structural-hazards/#OPH-TR-4", "@type": "skos:Concept", "notation": "OPH-TR-4", "prefLabel": "Outlives Its Support", "definition": "A house lasts decades, its devices are supported for a few years, and vendors leave the market, so the house fills with devices nobody patches.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/structural-hazards/", "principle": "Design for the device's life in the house, not its life in the catalogue.", "measure": [ "State support periods, and plan for what happens after them.", "Prefer open, local standards that outlast a vendor.", "Give owners a way to retire devices safely." ], "stride": "E, D", "physicalSafety": false, "rank": "4" }, { "@id": "https://ostering.com/taxonomies/smart-home/structural-hazards/#OPH-TR-5", "@type": "skos:Concept", "notation": "OPH-TR-5", "prefLabel": "Many Hands on the Keys", "definition": "A household is not one user: partners, children, guests, lodgers, landlords and installers share it, with interests that differ and change.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/structural-hazards/", "principle": "Model every person who lives with the system, not just the buyer.", "measure": [ "List every role in the household, including those who never install the app.", "Give each role its own identity and limits.", "Model the household turning against one of its members." ], "stride": "E, R", "physicalSafety": true, "rank": "5" }, { "@id": "https://ostering.com/taxonomies/smart-home/structural-hazards/#OPH-TR-6", "@type": "skos:Concept", "notation": "OPH-TR-6", "prefLabel": "Houses Change Hands", "definition": "Devices stay with the bricks and accounts stay with people, so every sale, letting or separation leaves access in the wrong hands.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/structural-hazards/", "principle": "Make transfer of the house a designed event.", "measure": [ "Bind devices to the home, with transferable ownership.", "Provide transfer and reclaim flows based on possession.", "Remind owners to transfer before moving." ], "stride": "E, I", "physicalSafety": false, "rank": "6" }, { "@id": "https://ostering.com/taxonomies/smart-home/structural-hazards/#OPH-TR-7", "@type": "skos:Concept", "notation": "OPH-TR-7", "prefLabel": "Many Homes, One Grid", "definition": "Connected energy devices act together on the grid, so a compromise or a bad signal moves the load of thousands of homes at once.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/structural-hazards/", "principle": "Treat fleets of energy devices as grid infrastructure.", "measure": [ "Model the fleet's combined effect, not just one home's.", "Build ramp limits and random delays into each device.", "Protect fleet control paths as critical infrastructure." ], "stride": "D", "physicalSafety": true, "rank": "7" }, { "@id": "https://ostering.com/taxonomies/smart-home/structural-hazards/#OPH-TR-8", "@type": "skos:Concept", "notation": "OPH-TR-8", "prefLabel": "Ecosystems Inherit the Weakest Link", "definition": "Bridges, multi-admin controllers and cloud-to-cloud links pass trust between ecosystems, and the strongest system takes on the weakest one's flaws.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/structural-hazards/", "principle": "Trace trust across every ecosystem link.", "measure": [ "Map every bridge, linked cloud and shared controller.", "Carry each device's security level across links.", "Limit what linked ecosystems can command." ], "stride": "S, E", "physicalSafety": false, "rank": "8" }, { "@id": "https://ostering.com/taxonomies/smart-home/structural-hazards/#OPH-TR-9", "@type": "skos:Concept", "notation": "OPH-TR-9", "prefLabel": "Radio Ignores Walls", "definition": "Radio, light and sound reach beyond the property line, so the attacker can be on the street, next door or across the road, with no need to enter.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/structural-hazards/", "principle": "Treat everyone within range as a possible attacker.", "measure": [ "Measure the real range of every radio and voice interface.", "Assume the street can hear, see and transmit.", "Require a local act for anything range alone should not grant." ], "stride": "S, I", "physicalSafety": false, "rank": "9" }, { "@id": "https://ostering.com/taxonomies/smart-home/structural-hazards/#OPH-TR-10", "@type": "skos:Concept", "notation": "OPH-TR-10", "prefLabel": "The House Keeps a Diary", "definition": "Sensors, meters, cameras and logs record when people wake, leave, return and who they are with, and together they say more than any one of them.", "inScheme": "https://ostering.com/taxonomies/smart-home/", "broader": "https://ostering.com/taxonomies/smart-home/structural-hazards/", "principle": "Minimise and separate what the house records about its people.", "measure": [ "Inventory every source of personal data in the house.", "Keep data local unless a feature needs it elsewhere.", "Model what combined data reveals, not just each stream." ], "stride": "I", "physicalSafety": false, "rank": "10" } ] }