I'd like to possibly to my bachelor thesis in Computer Science by reverse engineering some IoT devices such as security cameras & smart locks.
The items will be purchased by myself (probably sponsored by the university) without any direct tie with the manufacturer & distributor of the product. They may be bought from third-party distributors (small shops) and we won't be signing any contract or agreement with any company.
The research will be done by myself and my peers. We'll follow responsible disclosure and report our findings to the companies making the products. After some time, the thesis should be published and made publicly available, assuming the vendor has delivered patches (though most people likely won't patch their stuff).
Could I be held to any terms of use or EULA for the product, even if I never agree to one (for instance, I will not click "Agree" in their mobile app)?
Unlike 21732, we won't be signing a EULA or any kind of agreement with the products' vendors.
Unlike 6852, we'll only publish security vulnerabilities found. We won't publish a derivative work.
