Radio and Mesh

Smart Home Threat Taxonomy › Radio and Mesh (OPH-RF)

Zigbee, Z-Wave, Thread, Bluetooth, Wi-Fi and the 433 and 868 MHz bands carry the house’s commands through walls and past the property line. Anyone within range is part of the network’s threat model.

Where it sits in the house

The Radio and Mesh suit sits in the air between every device and the hub, and out past the property line. It is suit 2 of 13, in the Things deck.

Radio and Mesh highlighted on the Open House cross-section

The table

Smart Home Threat Taxonomy, Radio and Mesh: ID, threat, mitigation principle and design measures for all 13 entries

Mappings

Radio and Mesh: STRIDE, CAPEC 3.9 and CWE 5.0 mappings for each entry, with physical-safety flags

Entries in text

  • OPH-RF-A † Replayed Command. Fixed-code or weakly protected radio commands (garage doors, gates, alarm fobs, some locks) can be recorded and replayed, and rolling codes fall to jam-and-replay.
  • OPH-RF-K † Jammed Alarm Link. Wireless alarm sensors and sirens are jammed, so an intrusion or a fire never reaches the panel, and the panel reads the silence as normal.
  • OPH-RF-Q Network Key Sent in the Clear. Devices join under a publicly known key (the Zigbee default trust centre link key, the all-zero Z-Wave S0 temporary key), so a sniffer in range during pairing captures the network key.
  • OPH-RF-J Downgrade to Legacy Security. An attacker forces a device to pair in an older mode (Z-Wave S2 to S0, Bluetooth legacy or Just Works pairing), so the weak key exchange becomes the one in use.
  • OPH-RF-10 Mesh Worm. A firmware flaw spreads device to device across the mesh, and from house to house, because devices accept updates signed with a shared key that has been extracted from one of them.
  • OPH-RF-9 Spoofed Sensor. Sensor reports (door contacts, leak, temperature, motion) are not authenticated, so a forged frame says ‘door closed’ during a break-in, or ‘leak’ to shut the water off.
  • OPH-RF-8 † Phone Key Relayed. Phone-as-key and Bluetooth proximity unlock trust that a reachable phone is a nearby phone, so a relay over any distance opens the door while the owner is in town.
  • OPH-RF-7 Malformed Frame Crashes the Stack. A crafted radio frame crashes or takes over the device’s radio stack, because the chip vendor’s SDK parses hostile input with known flaws that the product never picked up.
  • OPH-RF-6 Rogue Coordinator. A rogue Thread border router or Zigbee coordinator advertises a better route, or lures reset devices onto its network, and so sees or steers their traffic.
  • OPH-RF-5 Stolen from Down the Street. Proximity commissioning and remote reset (Zigbee Touchlink, factory reset over the air) work from outside the house with a high-gain antenna, so bulbs and plugs are reset and taken over.
  • OPH-RF-4 Battery Drained by Design. An attacker keeps a sleepy battery device awake with traffic or join requests, draining a sensor that should last years in days, so it dies silently.
  • OPH-RF-3 Leaky Airwaves. Telemetry and advertisements go out in the clear or with fixed identifiers, so someone outside can tell which devices are present, when doors open and when the house is empty.
  • OPH-RF-2 Crowded Spectrum. The design assumes a clean 2.4 GHz band, but Wi-Fi channels, microwave ovens and the neighbours’ networks overlap the mesh, so commands are lost and nobody can tell attack from accident.

† marks a physical-safety consequence. The full principle, measures and mappings for each entry are in the tables above and in the downloads.

Seen in the wild

← Previous: Hub and Bridges · All suits · Next: Domotics →

Smart Home Threat Taxonomy v1.0 · © 2026 Jonathan Brett Crawley · Licensed under CC BY-NC-ND 4.0 with additional permissions.