> ## Content Index > Fetch the complete content index at: https://www.ostering.com/llms.txt > Use this file to discover other available public pages before exploring further. # Vendor Cloud - URL: https://www.ostering.com/taxonomies/smart-home/oph-vendor-cloud/ - Published: 2026-11-05T21:00:00.000Z - Updated: 2026-11-05T20:51:23.309Z - Description: Vendor Cloud: 13 smart home threats from the Open House taxonomy, with mitigation principles, design measures and STRIDE, CAPEC and CWE mappings. - Author: Brett Crawley [Smart Home Threat Taxonomy](https://ostering.com/taxonomies/smart-home/) › Vendor Cloud (OPH-CL) The vendor's service that binds devices to accounts, relays commands, stores events and links to other ecosystems. One cloud serves a million houses, so its mistakes are made a million times. ## Where it sits in the house The Vendor Cloud suit sits outside the house, in the vendor's service that every device talks to. It is suit 9 of 13, in the Control deck. ![Vendor Cloud highlighted on the Open House cross-section](https://www.ostering.com/media/posts/150/smart-home-09-vendor-cloud-where-it-sits-1600x900.png =1600x900) ## The table ![Smart Home Threat Taxonomy, Vendor Cloud: ID, threat, mitigation principle and design measures for all 13 entries](https://www.ostering.com/media/posts/150/smart-home-taxonomy-table-09-CL.png =1200x2850) ### Mappings ![Vendor Cloud: STRIDE, CAPEC 3.9 and CWE 5.0 mappings for each entry, with physical-safety flags](https://www.ostering.com/media/posts/150/smart-home-mapping-table-09-CL.png =1200x1138) ### Entries in text - **OPH-CL-A † Cloud Commands Every Home.** Devices obey whatever the vendor's cloud sends, so a compromise of the command plane, its admin console or its signing keys is a compromise of every home at once. - **OPH-CL-K Device Claimed by Someone Else.** The cloud binds a device to whichever account first presents its serial number or MAC address, so an attacker pre-claims or re-claims devices from the label or the box. - **OPH-CL-Q Other Homes by ID.** API endpoints accept a device or home ID without checking that the caller owns it, so enumerating IDs reads or controls other people's houses. - **OPH-CL-J One Device Speaks for Another.** Devices authenticate to the cloud with a shared or derivable credential (a fleet-wide certificate, a key from the MAC address), so cloning one device impersonates others. - **OPH-CL-10 Credential Stuffing the House.** Home accounts protected by a password alone fall to credential stuffing, and the attacker gets every device in the house. - **OPH-CL-9 Linked Service Overreach.** Linking to a voice assistant, automation service or insurer grants a broad, non-expiring token for every device, so a breach at the third party is control of the house. - **OPH-CL-8 Support Desk Hands Over the House.** Customer support can move devices between accounts or reset MFA on a phone call with weak identity checks. - **OPH-CL-7 † App Says Locked.** The cloud's copy of device state goes stale, so the app shows 'locked' or 'armed' while the device is not, and the owner relies on it. - **OPH-CL-6 One Region, Every Home.** A single cloud region's outage stops cameras, doorbells, locks and vacuums in every home that depends on it, because nothing works locally. - **OPH-CL-5 Data Kept and Reused.** The vendor keeps telemetry, voice, video and maps beyond their purpose and reuses them for training or advertising. - **OPH-CL-4 Fake Notification.** Push notifications and webhooks are not authenticated, so an attacker sends a fake 'door locked' or a fake alarm prompt that tricks the owner into acting. - **OPH-CL-3 Device Floods the Tenant.** A device can post any volume of telemetry, so a malicious one exhausts a household's quota, runs up costs or poisons analytics. - **OPH-CL-2 Vendor Access Unseen.** The owner cannot see when vendor staff, support or authorities accessed their data or devices. † marks a physical-safety consequence. The full principle, measures and mappings for each entry are in the tables above and in the [downloads](https://ostering.com/taxonomies/smart-home/#downloads). ## Seen in the wild - **OPH-CL-6 One Region, Every Home.** AWS us-east-1 outage (Dec 2021). [AWS outage impacts Ring, Netflix, and Amazon deliveries (BleepingComputer, Dec 2021)](https://www.bleepingcomputer.com/news/technology/aws-outage-impacts-ring-netflix-and-amazon-deliveries/) - **OPH-CL-5 Data Kept and Reused.** FTC action against Amazon over Alexa retention of children's voice recordings (2023). [Amazon settles with FTC for $25M after flouting kids' privacy and deletion requests (TechCrunch, May 2023)](https://techcrunch.com/2023/05/31/amazon-settles-with-ftc-for-25m-after-flouting-kids-privacy-and-deletion-requests) --- ← Previous: [Home Network](https://ostering.com/taxonomies/smart-home/oph-home-network/) · [All suits](https://ostering.com/taxonomies/smart-home/) · Next: [Remote Control](https://ostering.com/taxonomies/smart-home/oph-remote-control/) → *Smart Home Threat Taxonomy v1.0 · © 2026 Jonathan Brett Crawley · Licensed under CC BY-NC-ND 4.0 with [additional permissions](https://ostering.com/taxonomies/smart-home/#licence).*