Hub and Bridges

November 5, 2026

Smart Home Threat Taxonomy › Hub and Bridges (OPH-HB)

The hub is the house’s local brain: it holds the network keys for every device, runs the rules and speaks for the house to the cloud. Whoever owns the hub owns the house.

Where it sits in the house

The Hub and Bridges suit sits in the hall cupboard, at the centre of the house’s radios and rules. It is suit 1 of 13, in the Things deck.

Hub and Bridges highlighted on the Open House cross-section

The table

Smart Home Threat Taxonomy, Hub and Bridges: ID, threat, mitigation principle and design measures for all 13 entries

Mappings

Entries in text

OPH-HB-A † Hub Holds Every Key. The hub stores the Zigbee, Z-Wave and Thread network keys, every pairing secret and the tokens for each linked cloud in one place, so a single compromise of the hub is a compromise of the whole house.
OPH-HB-K † Unauthenticated Local API. The hub exposes an HTTP, WebSocket or MQTT interface that trusts anything on the home network, so any compromised device or visitor’s phone on the Wi-Fi can drive the locks and the alarm.
OPH-HB-Q Admin Page Driven from a Web Page. The hub’s admin pages can be driven by any web page a household browser visits, through cross-site requests, DNS rebinding or script in device names, so a malicious advert reconfigures the house.
OPH-HB-J Integration Runs as the Hub. Third-party integrations, add-ons and community components run inside the hub process with its full rights, so one malicious or compromised integration reads every key and drives every device.
OPH-HB-10 Device Reports Become Commands. The hub renders or evaluates whatever a device reports (its name, model string or attribute values), so a malicious or spoofed device injects script into dashboards or expressions into rules.
OPH-HB-9 Join Mode Left Open. The hub accepts new devices whenever join mode is on, for minutes at a time, from a remote command and without an install code, so a device within radio range joins the network and receives its key.
OPH-HB-8 Debug Port Left Open. Hubs ship with UART consoles, JTAG, SSH, Telnet, ADB or a vendor support tunnel enabled, so anyone with the box in hand, or on the network, gets a root shell.
OPH-HB-7 Backup Carries the House. Hub backups hold every key, token, the Wi-Fi password and the camera credentials, and are written unencrypted to cloud drives, network storage or email.
OPH-HB-6 Bridge Flattens Trust. A bridge translates a weak link (433 MHz, legacy Zigbee, a cloud-only device) into a strong one (Matter, the hub’s own API) and drops its security level, so the controller treats an unauthenticated device as authenticated.
OPH-HB-5 † Hub Down, House Dumb. When the hub crashes, reboots, loses power or its storage fails, the devices that depend on it stop working: lights, heating schedules, the alarm, the door.
OPH-HB-4 Chatty Device Starves the Hub. A faulty or malicious device floods the hub with reports or joins, so rule processing backs up and an alarm or leak event is acted on minutes late.
OPH-HB-3 Clock Moved, Rules Fire. The hub takes its time from unauthenticated NTP or the network, so an attacker who shifts the clock fires ‘morning’ rules at night, expires certificates or replays one-time codes.
OPH-HB-2 Logs Without Names. The hub records that the door unlocked or the alarm disarmed, but not which user, app, integration or rule caused it, and a reset wipes the log, so an incident cannot be reconstructed.

† marks a physical-safety consequence. The full principle, measures and mappings for each entry are in the tables above and in the downloads.

Seen in the wild

No entry in this suit has a public case recorded in v1.0. That does not make the threats hypothetical; it means no case was found that matched an entry closely enough to cite. If you know of one, tell me and I will add it in the next version.

All suits · Next: Radio and Mesh →