Vendor Cloud

November 5, 2026

Smart Home Threat Taxonomy › Vendor Cloud (OPH-CL)

The vendor’s service that binds devices to accounts, relays commands, stores events and links to other ecosystems. One cloud serves a million houses, so its mistakes are made a million times.

Where it sits in the house

The Vendor Cloud suit sits outside the house, in the vendor’s service that every device talks to. It is suit 9 of 13, in the Control deck.

Vendor Cloud highlighted on the Open House cross-section

The table

Smart Home Threat Taxonomy, Vendor Cloud: ID, threat, mitigation principle and design measures for all 13 entries

Mappings

Entries in text

OPH-CL-A † Cloud Commands Every Home. Devices obey whatever the vendor’s cloud sends, so a compromise of the command plane, its admin console or its signing keys is a compromise of every home at once.
OPH-CL-K Device Claimed by Someone Else. The cloud binds a device to whichever account first presents its serial number or MAC address, so an attacker pre-claims or re-claims devices from the label or the box.
OPH-CL-Q Other Homes by ID. API endpoints accept a device or home ID without checking that the caller owns it, so enumerating IDs reads or controls other people’s houses.
OPH-CL-J One Device Speaks for Another. Devices authenticate to the cloud with a shared or derivable credential (a fleet-wide certificate, a key from the MAC address), so cloning one device impersonates others.
OPH-CL-10 Credential Stuffing the House. Home accounts protected by a password alone fall to credential stuffing, and the attacker gets every device in the house.
OPH-CL-9 Linked Service Overreach. Linking to a voice assistant, automation service or insurer grants a broad, non-expiring token for every device, so a breach at the third party is control of the house.
OPH-CL-8 Support Desk Hands Over the House. Customer support can move devices between accounts or reset MFA on a phone call with weak identity checks.
OPH-CL-7 † App Says Locked. The cloud’s copy of device state goes stale, so the app shows ‘locked’ or ‘armed’ while the device is not, and the owner relies on it.
OPH-CL-6 One Region, Every Home. A single cloud region’s outage stops cameras, doorbells, locks and vacuums in every home that depends on it, because nothing works locally.
OPH-CL-5 Data Kept and Reused. The vendor keeps telemetry, voice, video and maps beyond their purpose and reuses them for training or advertising.
OPH-CL-4 Fake Notification. Push notifications and webhooks are not authenticated, so an attacker sends a fake ‘door locked’ or a fake alarm prompt that tricks the owner into acting.
OPH-CL-3 Device Floods the Tenant. A device can post any volume of telemetry, so a malicious one exhausts a household’s quota, runs up costs or poisons analytics.
OPH-CL-2 Vendor Access Unseen. The owner cannot see when vendor staff, support or authorities accessed their data or devices.

† marks a physical-safety consequence. The full principle, measures and mappings for each entry are in the tables above and in the downloads.

Seen in the wild

OPH-CL-6 One Region, Every Home. AWS us-east-1 outage (Dec 2021). AWS outage impacts Ring, Netflix, and Amazon deliveries (BleepingComputer, Dec 2021)
OPH-CL-5 Data Kept and Reused. FTC action against Amazon over Alexa retention of children’s voice recordings (2023). Amazon settles with FTC for $25M after flouting kids’ privacy and deletion requests (TechCrunch, May 2023)

← Previous: Home Network · All suits · Next: Remote Control →