Track Focus
Consumer IoT privacy and firmware analysis
Device identification, lab Wi-Fi isolation, traffic capture, firmware review, cloud behavior mapping, safe reporting, and consumer guidance.
This track fits partners interested in consumer privacy, device security, and safe deployment guidance.
Potential Partners
Pending confirmation
Privacy nonprofits, consumer security labs, IoT vendors, and school safety or privacy groups would be strong sponsor fits for this project.
Best for hardware-curious students interested in firmware analysis, privacy, and network security.
Students will document how a consumer IoT camera boots, connects to Wi-Fi, talks to cloud services, exposes local services, stores credentials, receives firmware updates, and handles video/audio or other privacy-sensitive data.
The goal is not to break into devices. The goal is to create a repeatable workflow for assessing consumer IoT privacy and security risks in a controlled lab.
A structured workflow for device identification, network observation, firmware collection, and safe analysis.
Device Baseline
Identify the device and its externally visible characteristics.
Document the model, FCC ID if available, chipset, ports, storage, external interfaces, mobile app dependencies, and visible hardware markings.
Controlled Network Capture
Create a lab-only Wi-Fi network for observing device behavior.
Capture traffic during first boot, pairing, login, firmware update, live view, cloud reconnect, and other normal user workflows.
Firmware Collection
Use legitimate sources for firmware acquisition.
Attempt collection through vendor update files, mobile app download paths, device update traffic, and publicly available firmware images.
Firmware Analysis
Inspect firmware using established tools and methods.
Use tools such as Binwalk, Ghidra, strings, Firmwalker, EMBA, and the OWASP Firmware Security Testing Methodology to document notable behaviors and risks.
Students will focus on findings that can be responsibly documented and explained to consumers or schools.
Student-Safe Research Question
What data does this device collect, where does it send it, and what risks would a consumer or school need to understand before deploying it?
Practical artifacts for responsible assessment, disclosure, and consumer guidance.
Teardown Report
Device model, hardware identifiers, external interfaces, observed components, and lab setup.
Network Map
Traffic observations for boot, pairing, login, update, live view, and reconnect workflows.
Firmware Notes
Analysis notes from firmware collection and review using standard tooling and methodology.
Privacy Summary
Clear explanation of sensitive data flows and risks for consumers, schools, or nonprofits.
Consumer Guide
Safe configuration guidance, responsible disclosure template, and a checklist for testing IoT cameras safely.
View the full internship overview for program details, dates, and application information.