Learning from others’ mistakes: penetration testing IoT devices in the classroom

Tom Chothia, Joeri De Ruiter

Research output: Contribution to conference (unpublished)Paperpeer-review


This paper shows how it is possible to use commercial off-the-shelf IoT devices in a taught cyber security course. We argue that the current level of IoT device security makes testing them an excellent exercise for students. We have developed a course based around this idea that teaches students basic penetration testing techniques and then sets two rounds of group assignments in which they get hands-on experience with performing a security analysis of an IoT device. In the first round, the students get devices which we know are vulnerable. In the second round, the groups are mixed and they get devices with no previously known vulnerabilities. This approach enables us to provide them enough guidance in the first round to get the experience needed to perform the analysis independently in the second round. This seems to have been successful because our student teams found previously unknown vulnerabilities in five devices in the second round of tests.
Original languageEnglish
Publication statusPublished - 9 Aug 2016
EventUSENIX Workshop on Advances in Security Education -
Duration: 9 Aug 201610 Sept 2016


ConferenceUSENIX Workshop on Advances in Security Education
Internet address


  • cyber security
  • education


Dive into the research topics of 'Learning from others’ mistakes: penetration testing IoT devices in the classroom'. Together they form a unique fingerprint.

Cite this