Lifecycle

November 5, 2026

Smart Home Threat Taxonomy › Lifecycle (OPH-LC)

Manufacture, onboarding, updates, support, resale and disposal. A house lasts for decades, its devices are supported for a few years, and the house changes hands with the devices still on the walls.

Where it sits in the house

The Lifecycle suit sits under every suit: from the box to setup, updates, resale and the bin. It is suit 13 of 13, in the Control deck.

Lifecycle highlighted on the Open House cross-section

The table

Smart Home Threat Taxonomy, Lifecycle: ID, threat, mitigation principle and design measures for all 13 entries

Mappings

Entries in text

OPH-LC-A † Unsigned Update Accepted. Devices accept firmware that is unsigned, or signed with a key extracted from a device, so anyone on the network or with the device in hand installs their own.
OPH-LC-K † Vendor Turns Off the Servers. The vendor shuts its cloud, goes bust or sells to an unknown buyer, and the devices stop working, lose their security features or come under someone else’s control.
OPH-LC-Q † Previous Owner Still Connected. After a house or device is sold, the previous owner’s account still controls the devices and sees the cameras, and the new owner cannot reclaim them without the old one.
OPH-LC-J Implant in the Box. Counterfeit, grey-market or compromised devices arrive with malware preinstalled, and the product cannot tell a genuine unit from a tampered one.
OPH-LC-10 Rolled Back to a Hole. An attacker installs an older, validly signed firmware that still has a known flaw.
OPH-LC-9 Reset Doesn’t Erase. A factory reset leaves the Wi-Fi password, tokens and recordings in flash, so a resold or discarded device gives up the old home’s secrets.
OPH-LC-8 Support Ends Silently. Devices stop receiving security updates with no stated end date and no notice, and keep running on the network.
OPH-LC-7 Old Library Inside. Devices ship with old Linux kernels, BusyBox, OpenSSL and vendor SDKs with known flaws, and the vendor cannot tell which products are affected.
OPH-LC-6 † Update Fails Halfway. A power cut or failed download mid-update bricks the device, or leaves the lock or alarm in an unknown state.
OPH-LC-5 Baked-In Certificate Expires. A root certificate or device certificate baked into firmware expires, and devices across the fleet stop connecting on the same day.
OPH-LC-4 Account Deleted, Data Kept. Deleting the account or removing a device leaves recordings, maps and history in the cloud and its backups.
OPH-LC-3 Nowhere to Report a Flaw. Researchers who find a flaw have no published way to report it, so it is sold or disclosed without a fix.
OPH-LC-2 Repair Shop Sees the Home. Devices sent for repair or replacement carry recordings, maps and credentials that the repairer can read.

† marks a physical-safety consequence. The full principle, measures and mappings for each entry are in the tables above and in the downloads.

Seen in the wild

OPH-LC-K Vendor Turns Off the Servers. Revolv shutdown (2016); Insteon shutdown (April 2022). Alphabet’s Nest will permanently turn off all Revolv hubs on May 15, 2016 (VentureBeat)
OPH-LC-J Implant in the Box. BadBox Android TV boxes (Human Security, 2023 and 2025). HUMAN disrupts digital supply chain threat actor scheme originating from China (BADBOX, Oct 2023)
OPH-LC-9 Reset Doesn’t Erase. Wi-Fi password stored in plain text in LIFX bulb flash (LimitedResults, 2019). LIFX HomeKit bulbs appear to be storing Wi-Fi passwords unencrypted (AppleInsider, Jan 2019)
OPH-LC-5 Baked-In Certificate Expires. DST Root CA X3 expiry (Sept 2021). DST Root CA X3 Expiration (September 2021) (Let’s Encrypt)

← Previous: Household · All suits · Next: Structural Hazards →