The Hardware Procurement Iceberg: A Framework To Keep Embedded Research Fun Cheap and Ethical

The talk argues that embedded security research does not need an enterprise budget, but where hardware comes from shapes what it costs, how much effort it takes and the ethical risk involved. It introduces a ranked framework, the Hardware Procurement Iceberg, with common sources at the top and riskier, obscure ones lower down. Before sourcing, it outlines a firmware-first workflow: extract firmware from a vendor download or directly from a chip, then emulate it with QEMU to find boot entry points. Emulation misses hardware such as GPIO, so proof-of-concept testing still needs a real device at factory defaults.

Each channel is weighed in turn. Retailers offer simple returns, borrowed devices need agreed rules and a fair thank-you, and thrift stores and recyclers are cheap but often untested. eBay suits known targets thanks to its search and buyer protection, while Facebook Marketplace is scam-prone. Government liquidation sites such as GovDeals sell lots with low reserves, and custom price trackers can catch clearance deals. Returns are discussed only with care, and the speaker warns against using Shodan to probe other people's internet-exposed devices.

The closing message is that cheap, ethical embedded research is achievable, and ownership should guide every choice. In the Q&A, steady effort of about an hour a day was suggested as more valuable than occasional bursts of work.