> ## Content Index > Fetch the complete content index at: https://www.ostering.com/llms.txt > Use this file to discover other available public pages before exploring further. # Lifecycle - URL: https://www.ostering.com/taxonomies/smart-home/oph-lifecycle/ - Published: 2026-11-05T21:00:00.000Z - Updated: 2026-11-05T20:50:17.478Z - Description: Lifecycle: 13 smart home threats from the Open House taxonomy, with mitigation principles, design measures and STRIDE, CAPEC and CWE mappings. - Author: Brett Crawley [Smart Home Threat Taxonomy](https://ostering.com/taxonomies/smart-home/) › Lifecycle (OPH-LC) Manufacture, onboarding, updates, support, resale and disposal. A house lasts for decades, its devices are supported for a few years, and the house changes hands with the devices still on the walls. ## Where it sits in the house The Lifecycle suit sits under every suit: from the box to setup, updates, resale and the bin. It is suit 13 of 13, in the Control deck. ![Lifecycle highlighted on the Open House cross-section](https://www.ostering.com/media/posts/154/smart-home-13-lifecycle-where-it-sits-1600x900.png =1600x900) ## The table ![Smart Home Threat Taxonomy, Lifecycle: ID, threat, mitigation principle and design measures for all 13 entries](https://www.ostering.com/media/posts/154/smart-home-taxonomy-table-13-LC.png =1200x2668) ### Mappings ![Lifecycle: STRIDE, CAPEC 3.9 and CWE 5.0 mappings for each entry, with physical-safety flags](https://www.ostering.com/media/posts/154/smart-home-mapping-table-13-LC.png =1200x1227) ### Entries in text - **OPH-LC-A † Unsigned Update Accepted.** Devices accept firmware that is unsigned, or signed with a key extracted from a device, so anyone on the network or with the device in hand installs their own. - **OPH-LC-K † Vendor Turns Off the Servers.** The vendor shuts its cloud, goes bust or sells to an unknown buyer, and the devices stop working, lose their security features or come under someone else's control. - **OPH-LC-Q † Previous Owner Still Connected.** After a house or device is sold, the previous owner's account still controls the devices and sees the cameras, and the new owner cannot reclaim them without the old one. - **OPH-LC-J Implant in the Box.** Counterfeit, grey-market or compromised devices arrive with malware preinstalled, and the product cannot tell a genuine unit from a tampered one. - **OPH-LC-10 Rolled Back to a Hole.** An attacker installs an older, validly signed firmware that still has a known flaw. - **OPH-LC-9 Reset Doesn't Erase.** A factory reset leaves the Wi-Fi password, tokens and recordings in flash, so a resold or discarded device gives up the old home's secrets. - **OPH-LC-8 Support Ends Silently.** Devices stop receiving security updates with no stated end date and no notice, and keep running on the network. - **OPH-LC-7 Old Library Inside.** Devices ship with old Linux kernels, BusyBox, OpenSSL and vendor SDKs with known flaws, and the vendor cannot tell which products are affected. - **OPH-LC-6 † Update Fails Halfway.** A power cut or failed download mid-update bricks the device, or leaves the lock or alarm in an unknown state. - **OPH-LC-5 Baked-In Certificate Expires.** A root certificate or device certificate baked into firmware expires, and devices across the fleet stop connecting on the same day. - **OPH-LC-4 Account Deleted, Data Kept.** Deleting the account or removing a device leaves recordings, maps and history in the cloud and its backups. - **OPH-LC-3 Nowhere to Report a Flaw.** Researchers who find a flaw have no published way to report it, so it is sold or disclosed without a fix. - **OPH-LC-2 Repair Shop Sees the Home.** Devices sent for repair or replacement carry recordings, maps and credentials that the repairer can read. † marks a physical-safety consequence. The full principle, measures and mappings for each entry are in the tables above and in the [downloads](https://ostering.com/taxonomies/smart-home/#downloads). ## Seen in the wild - **OPH-LC-K Vendor Turns Off the Servers.** Revolv shutdown (2016); Insteon shutdown (April 2022). [Alphabet's Nest will permanently turn off all Revolv hubs on May 15, 2016 (VentureBeat)](https://venturebeat.com/technology/alphabets-nest-will-permanently-turn-off-all-revolv-hubs-on-may-15-2016) - **OPH-LC-J Implant in the Box.** BadBox Android TV boxes (Human Security, 2023 and 2025). [HUMAN disrupts digital supply chain threat actor scheme originating from China (BADBOX, Oct 2023)](https://www.humansecurity.com/newsroom/human-disrupts-digital-supply-chain-threat-actor-scheme-originating-from-china) - **OPH-LC-9 Reset Doesn't Erase.** Wi-Fi password stored in plain text in LIFX bulb flash (LimitedResults, 2019). [LIFX HomeKit bulbs appear to be storing Wi-Fi passwords unencrypted (AppleInsider, Jan 2019)](https://appleinsider.com/articles/19/01/30/lifx-homekit-bulbs-appear-to-be-storing-wi-fi-passwords-unencrypted) - **OPH-LC-5 Baked-In Certificate Expires.** DST Root CA X3 expiry (Sept 2021). [DST Root CA X3 Expiration (September 2021) (Let's Encrypt)](https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/) --- ← Previous: [Household](https://ostering.com/taxonomies/smart-home/oph-household/) · [All suits](https://ostering.com/taxonomies/smart-home/) · Next: [Structural Hazards](https://ostering.com/taxonomies/smart-home/oph-structural-hazards/) → *Smart Home Threat Taxonomy v1.0 · © 2026 Jonathan Brett Crawley · Licensed under CC BY-NC-ND 4.0 with [additional permissions](https://ostering.com/taxonomies/smart-home/#licence).*