> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.
# Radio and Mesh
- URL: https://www.ostering.com/taxonomies/smart-home/oph-radio-and-mesh/
- Published: 2026-11-05T21:00:00.000Z
- Updated: 2026-11-05T20:53:41.650Z
- Description: Radio and Mesh: 13 smart home threats from the Open House taxonomy, with mitigation principles, design measures and STRIDE, CAPEC and CWE mappings.
- Author: Brett Crawley
[Smart Home Threat Taxonomy](https://ostering.com/taxonomies/smart-home/) › Radio and Mesh (OPH-RF)
Zigbee, Z-Wave, Thread, Bluetooth, Wi-Fi and the 433 and 868 MHz bands carry the house's commands through walls and past the property line. Anyone within range is part of the network's threat model.
## Where it sits in the house
The Radio and Mesh suit sits in the air between every device and the hub, and out past the property line. It is suit 2 of 13, in the Things deck.
## The table
### Mappings
### Entries in text
- **OPH-RF-A † Replayed Command.** Fixed-code or weakly protected radio commands (garage doors, gates, alarm fobs, some locks) can be recorded and replayed, and rolling codes fall to jam-and-replay.
- **OPH-RF-K † Jammed Alarm Link.** Wireless alarm sensors and sirens are jammed, so an intrusion or a fire never reaches the panel, and the panel reads the silence as normal.
- **OPH-RF-Q Network Key Sent in the Clear.** Devices join under a publicly known key (the Zigbee default trust centre link key, the all-zero Z-Wave S0 temporary key), so a sniffer in range during pairing captures the network key.
- **OPH-RF-J Downgrade to Legacy Security.** An attacker forces a device to pair in an older mode (Z-Wave S2 to S0, Bluetooth legacy or Just Works pairing), so the weak key exchange becomes the one in use.
- **OPH-RF-10 Mesh Worm.** A firmware flaw spreads device to device across the mesh, and from house to house, because devices accept updates signed with a shared key that has been extracted from one of them.
- **OPH-RF-9 Spoofed Sensor.** Sensor reports (door contacts, leak, temperature, motion) are not authenticated, so a forged frame says 'door closed' during a break-in, or 'leak' to shut the water off.
- **OPH-RF-8 † Phone Key Relayed.** Phone-as-key and Bluetooth proximity unlock trust that a reachable phone is a nearby phone, so a relay over any distance opens the door while the owner is in town.
- **OPH-RF-7 Malformed Frame Crashes the Stack.** A crafted radio frame crashes or takes over the device's radio stack, because the chip vendor's SDK parses hostile input with known flaws that the product never picked up.
- **OPH-RF-6 Rogue Coordinator.** A rogue Thread border router or Zigbee coordinator advertises a better route, or lures reset devices onto its network, and so sees or steers their traffic.
- **OPH-RF-5 Stolen from Down the Street.** Proximity commissioning and remote reset (Zigbee Touchlink, factory reset over the air) work from outside the house with a high-gain antenna, so bulbs and plugs are reset and taken over.
- **OPH-RF-4 Battery Drained by Design.** An attacker keeps a sleepy battery device awake with traffic or join requests, draining a sensor that should last years in days, so it dies silently.
- **OPH-RF-3 Leaky Airwaves.** Telemetry and advertisements go out in the clear or with fixed identifiers, so someone outside can tell which devices are present, when doors open and when the house is empty.
- **OPH-RF-2 Crowded Spectrum.** The design assumes a clean 2.4 GHz band, but Wi-Fi channels, microwave ovens and the neighbours' networks overlap the mesh, so commands are lost and nobody can tell attack from accident.
† marks a physical-safety consequence. The full principle, measures and mappings for each entry are in the tables above and in the [downloads](https://ostering.com/taxonomies/smart-home/#downloads).
## Seen in the wild
- **OPH-RF-A Replayed Command.** RollJam (Samy Kamkar, DEF CON 23, 2015). [$32 worth of electronics can open almost any keyless car (Gizmodo, Aug 2015)](https://gizmodo.com/32-worth-of-electronics-can-open-almost-any-keyless-ca-1723072763)
- **OPH-RF-J Downgrade to Legacy Security.** Z-Shave (Pen Test Partners, 2018). [Z-Shave: exploiting Z-Wave downgrade attacks (Pen Test Partners)](https://pentestpartners.com/security-blog/z-shave-exploiting-z-wave-downgrade-attacks)
- **OPH-RF-10 Mesh Worm.** IoT Goes Nuclear: Philips Hue worm (Ronen et al., IEEE S&P 2017). [IoT Goes Nuclear: Creating a ZigBee Chain Reaction (Ronen, Shamir et al.)](https://eyalro.net/project/iotworm.html)
- **OPH-RF-8 Phone Key Relayed.** Bluetooth LE relay against smart locks (NCC Group, 2022). [NCC Group uncovers BLE vulnerability that puts millions of cars, mobile devices and locking systems at risk](https://www.nccgroup.com/newsroom/ncc-group-uncovers-bluetooth-low-energy-ble-vulnerability-that-puts-millions-of-cars-mobile-devices-and-locking-systems-at-risk/)
- **OPH-RF-7 Malformed Frame Crashes the Stack.** SweynTooth (SUTD, 2020). [Discovery of SweynTooth by ASSET Research Group (SUTD)](https://www.sutd.edu.sg/news-listing/discovery-of-sweyntooth-by-asset-research-group-led-by-assistant-professor-sudipta-chattopadhyay-information-systems-technology-and-design-istd/)
---
← Previous: [Hub and Bridges](https://ostering.com/taxonomies/smart-home/oph-hub-and-bridges/) · [All suits](https://ostering.com/taxonomies/smart-home/) · Next: [Domotics](https://ostering.com/taxonomies/smart-home/oph-domotics/) →
*Smart Home Threat Taxonomy v1.0 · © 2026 Jonathan Brett Crawley · Licensed under CC BY-NC-ND 4.0 with [additional permissions](https://ostering.com/taxonomies/smart-home/#licence).*