> ## Content Index > Fetch the complete content index at: https://www.ostering.com/llms.txt > Use this file to discover other available public pages before exploring further. # Hub and Bridges - URL: https://www.ostering.com/taxonomies/smart-home/oph-hub-and-bridges/ - Published: 2026-11-05T21:00:00.000Z - Updated: 2026-11-05T20:53:56.306Z - Description: Hub and Bridges: 13 smart home threats from the Open House taxonomy, with mitigation principles, design measures and STRIDE, CAPEC and CWE mappings. - Author: Brett Crawley [Smart Home Threat Taxonomy](https://ostering.com/taxonomies/smart-home/) › Hub and Bridges (OPH-HB) The hub is the house's local brain: it holds the network keys for every device, runs the rules and speaks for the house to the cloud. Whoever owns the hub owns the house. ## Where it sits in the house The Hub and Bridges suit sits in the hall cupboard, at the centre of the house's radios and rules. It is suit 1 of 13, in the Things deck. ![Hub and Bridges highlighted on the Open House cross-section](https://www.ostering.com/media/posts/142/smart-home-01-hub-and-bridges-where-it-sits-1600x900.png =1600x900) ## The table ![Smart Home Threat Taxonomy, Hub and Bridges: ID, threat, mitigation principle and design measures for all 13 entries](https://www.ostering.com/media/posts/142/smart-home-taxonomy-table-01-HB.png =1200x3554) ### Mappings ![Hub and Bridges: STRIDE, CAPEC 3.9 and CWE 5.0 mappings for each entry, with physical-safety flags](https://www.ostering.com/media/posts/142/smart-home-mapping-table-01-HB.png =1200x1289) ### Entries in text - **OPH-HB-A † Hub Holds Every Key.** The hub stores the Zigbee, Z-Wave and Thread network keys, every pairing secret and the tokens for each linked cloud in one place, so a single compromise of the hub is a compromise of the whole house. - **OPH-HB-K † Unauthenticated Local API.** The hub exposes an HTTP, WebSocket or MQTT interface that trusts anything on the home network, so any compromised device or visitor's phone on the Wi-Fi can drive the locks and the alarm. - **OPH-HB-Q Admin Page Driven from a Web Page.** The hub's admin pages can be driven by any web page a household browser visits, through cross-site requests, DNS rebinding or script in device names, so a malicious advert reconfigures the house. - **OPH-HB-J Integration Runs as the Hub.** Third-party integrations, add-ons and community components run inside the hub process with its full rights, so one malicious or compromised integration reads every key and drives every device. - **OPH-HB-10 Device Reports Become Commands.** The hub renders or evaluates whatever a device reports (its name, model string or attribute values), so a malicious or spoofed device injects script into dashboards or expressions into rules. - **OPH-HB-9 Join Mode Left Open.** The hub accepts new devices whenever join mode is on, for minutes at a time, from a remote command and without an install code, so a device within radio range joins the network and receives its key. - **OPH-HB-8 Debug Port Left Open.** Hubs ship with UART consoles, JTAG, SSH, Telnet, ADB or a vendor support tunnel enabled, so anyone with the box in hand, or on the network, gets a root shell. - **OPH-HB-7 Backup Carries the House.** Hub backups hold every key, token, the Wi-Fi password and the camera credentials, and are written unencrypted to cloud drives, network storage or email. - **OPH-HB-6 Bridge Flattens Trust.** A bridge translates a weak link (433 MHz, legacy Zigbee, a cloud-only device) into a strong one (Matter, the hub's own API) and drops its security level, so the controller treats an unauthenticated device as authenticated. - **OPH-HB-5 † Hub Down, House Dumb.** When the hub crashes, reboots, loses power or its storage fails, the devices that depend on it stop working: lights, heating schedules, the alarm, the door. - **OPH-HB-4 Chatty Device Starves the Hub.** A faulty or malicious device floods the hub with reports or joins, so rule processing backs up and an alarm or leak event is acted on minutes late. - **OPH-HB-3 Clock Moved, Rules Fire.** The hub takes its time from unauthenticated NTP or the network, so an attacker who shifts the clock fires 'morning' rules at night, expires certificates or replays one-time codes. - **OPH-HB-2 Logs Without Names.** The hub records that the door unlocked or the alarm disarmed, but not which user, app, integration or rule caused it, and a reset wipes the log, so an incident cannot be reconstructed. † marks a physical-safety consequence. The full principle, measures and mappings for each entry are in the tables above and in the [downloads](https://ostering.com/taxonomies/smart-home/#downloads). ## Seen in the wild No entry in this suit has a public case recorded in v1.0. That does not make the threats hypothetical; it means no case was found that matched an entry closely enough to cite. If you know of one, tell me and I will add it in the next version. --- [All suits](https://ostering.com/taxonomies/smart-home/) · Next: [Radio and Mesh](https://ostering.com/taxonomies/smart-home/oph-radio-and-mesh/) → *Smart Home Threat Taxonomy v1.0 · © 2026 Jonathan Brett Crawley · Licensed under CC BY-NC-ND 4.0 with [additional permissions](https://ostering.com/taxonomies/smart-home/#licence).*