Threat Model Your Apartment Like You Threat Model Your Laptop

Your threat model has a hole shaped like your house.

You run endpoint protection on your Mac. You have 2FA, passkeys, hardened browser, DNS filtering. You would never install random software from a forum.

Then you walk into your living room that has 14 always-on microphones, 6 cameras, 3 devices that map your floor plan, and a router you have never audited, all running firmware you have never read.

We need to talk.

In cybersec we threat model laptops. We never threat model apartments. That is backwards. Your laptop leaves your house. Your house never leaves. If your home is compromised, every device you bring into it is compromised by proximity.

Here is how I started threat modeling my apartment the same way I threat model my infra. It takes an afternoon and it will make your home actually sovereign.

Step 1: Draw Trust Zones, Not Floor Plans

Stop thinking in rooms. Start thinking in trust zones, exactly like network segmentation.

I use 3 zones:

Zone 0: The Dead Room. One room where no device can listen, watch, or transmit. No smart anything. No WiFi. No Bluetooth. This is where you think, talk for real, and store sensitive hardware. My bedroom is Zone 0. Nothing with a mic crosses the door. It has a mechanical door sweep and a faraday pouch for phones.

Zone 1: The Clean Network. Your own network that you control. Your router, your Pi-hole, your own hotspot. Devices you have audited. This is where your work laptop lives. It never touches landlord WiFi, coffee shop WiFi, or that free "Apartment_5G" that is actually a $30 camera streaming 24/7.

Zone 2: The Dirty Periphery. Everything else. Landlord's smart lock, smart thermostat, package room cameras, your smart TV, robot vacuum, Alexa, LED strips with mics, that random air freshener that is plugged in at waist height. Assume Zone 2 is hostile and logs everything.

Most people live entirely in Zone 2 and call it cozy. That is why they get doxxed by their own house.

If you want the full build for a Zone 0 room, what to rip out, what to block, how to make a bedroom that is truly dead for under $200, I documented it in THE FARADAY ROOM: Your Home Is Listening. That guide is your Zone 0 manual.

Step 2: RF Sweep — Find What Is Talking

Your apartment is loud. You just cannot hear it because it talks on frequencies you cannot hear.

An RF sweep is how you listen.

You need two things: your phone flashlight and a $25 to $35 RF detector from Amazon. No fancy SDR needed for the first pass. The cheap one beeps when something near it is transmitting on Bluetooth, WiFi, or cellular.

Here is the 10 minute sweep I run in every rental and every Airbnb:

1. Kill the lights. Close curtains. Turn on your phone flashlight and hold it next to your eyes. Slowly scan for tiny lens reflections. Camera lenses reflect even when hidden in black plastic. Check smoke detectors directly over the bed, alarm clocks, air purifiers, TV bezels, and any small black box facing the bed.

2. Power down your own noise. Turn off your phone Bluetooth and WiFi for 60 seconds. This drops your own baseline so the detector does not scream at your own Apple Watch.

3. Walk the walls. Hold the RF detector near outlets, power strips, smoke detectors, mirrors, picture frames, vents, thermostats. If it screams near a "dumb" object like a picture frame or a smoke detector that should not transmit, you found something that is talking when it should be silent.

I have found an AirTag taped inside a couch from a previous tenant, a fake USB charger with a camera module, and a smart thermostat that was transmitting even when I had "disabled" its WiFi. All with a $27 tool.

RF is layer 1 of home threat modeling. If you skip it, you are doing compliance, not security.

Once you know what is talking, you need to know what network it is talking on. That is step 3.

Step 3: Network Inventory — What Is Actually On Your WiFi?

Open a network scanner like Fing. Connect to your apartment WiFi and scan.

You should see your phone, your laptop, maybe your TV. If you see 12 devices and you only own 3, you have neighbors piggybacking or you have hidden devices streaming.

Now check the SSIDs around you. You are looking for weird names: "HD_Cam_02", "WIFI_CAM", "Apt_3B_Security", or a second network with the same name as yours but with "-cam" appended.

The sophisticated version of this is a callback test. This is where I use a Specter Box.

A Specter Box is a tiny $17 drop box I built that phones home when it gets power. It is the size of a USB charger. You plug it into an Ethernet port behind the TV in your rental, or into an outlet, and it wakes up, connects, and sends a POST to a server you own: "I am alive, I am on this SSID, this is my IP, this is how many other devices I can see."

It is not for spying on other people. It is for auditing your own network that you pay for. I left one in my own coworking space with permission, it phoned home 6 hours later from a different desk. Someone had picked it up and plugged it in. That is all the proof you need that physical security is not real.

If you run your own lab or you are allowed to test your office, this is the cheapest physical pen test you will ever run. The full parts list, callback server, and battery mod that keeps it alive for 18 days is in SPECTER BOX: The $17 Drop Box That Phones Home.

For home threat modeling, network inventory answers one question: is your apartment's network trustworthy enough to put your laptop on? Most rentals fail this test.

The fix is simple: never trust rental WiFi. Run your own hotspot through a travel router you control. My full self-hosted comms and hotspot stack is in THE DEAD DROP but even without it, just buying a $30 travel router is a massive upgrade.

Step 4: Firmware — Read The Code Inside The Plastic

You would not run a binary you downloaded from a random forum. But you will plug in a $20 smart plug from Amazon that runs a full Linux OS, has a mic, and phones home to an endpoint you have never read.

If you cannot dump the firmware, you do not own the device.

Firmware dumping sounds scary because people think you will brick the device. You will not if you do it right. The non-destructive order is:

1. Software dump first if possible, via UART or known exploit
2. SPI clip read second, no soldering, just clip onto the chip and read
3. Desolder only if you have to, which you almost never do for consumer stuff

I dump every smart device I bring home before it goes on my clean network. Cheap smart plugs, smart bulbs, that cute LED strip with a mic. I have found hardcoded cloud endpoints, default creds like admin:admin, and mics that were enabled in firmware even though the product page said "no mic."

Your router is the worst offender. If your landlord gave you a router, assume its firmware logs everything. Buy the same model used on eBay, dump it at home, read it. Now you know what your building sees.

I put the full non-bricking method, tools, clips, voltage checks, and failsafes in SHADOW CATALOG: Firmware Dumping Without Bricking. It is written for people who are scared of bricking, because I was too.

Step 5: Put It Together Into A Living Threat Model

Here is my actual home threat model, one page:

Assets: My conversations, my location when I am home, my network traffic, my hardware.

Adversaries: Data brokers, landlord, Airbnb host, delivery drivers with Flipper Zeros, previous tenant who left an AirTag, random $30 cams.

Attack surface:

• Zone 2 devices with mics/cams: TV, vacuum, Alexa, smart thermostat
• Zone 2 network: rental router, shared walls, open ports
• Zone 2 firmware: devices running code I have never read
• Physical: package room, master key, old AirTags, maintenance access

Controls:

• Zone 0 dead room, phones in faraday pouch after 10pm
• Own travel router, Pi-hole, no Zone 2 device on Zone 1 network
• RF sweep monthly, network scan weekly
• All new devices dumped before joining clean network
• One Specter Box as a canary in my bag

This fits on a sticky note. It is more effective than 100 privacy tips on TikTok.

Most people's threat model is "I use a VPN so I am private." That is endpoint thinking. Home threat modeling is infrastructure thinking. You are the CISO of your apartment. Act like it.

You Can't Patch What You Don't Inventory

You audit your laptop because you know it can be compromised. Your apartment can be compromised much easier and you live in it.

Start today:

1. Draw 3 zones. Pick one room to be Zone 0 tonight.
2. Do a 10 minute RF sweep with a flashlight and a cheap detector.
3. Scan your WiFi. Count devices. If the number is wrong, assume hostile.
4. Dump the firmware of the cheapest smart device in your house. See what it is really doing.

Then fix it in layers.

If you want the full stack I use, here is the order:

---

Your threat model has a hole shaped like your house. Here is how you patch it:

If your home is the leak → THE FARADAY ROOM: Your Home Is Listening — full de-bug checklist and how to build a dead room for under $200. This is your Zone 0 manual.

If your network is the leak → SPECTER BOX: The $17 Drop Box That Phones Home — build a callback canary to audit any network you are allowed to test.

If your devices are lying → SHADOW CATALOG: Firmware Dumping Without Bricking — non-destructive firmware dumping so you actually own what you bought.

If you want comms you own → THE DEAD DROP — self-hosted encrypted infra so you never touch dirty WiFi.

All guides on my Gumroad, link in profile. Build for your own stuff only.