# Security Threats and Cryptographic Protocols for Medical Wearables
## 3 Simulation of a Malware Attack against Medical Devices  
Attacks to WHMS are possible because of vulnerabilities in their design and functioning protocols. An attack executed on a WHMS can disturb functionality, lead the user not to receive information about vital signals and may cause severe injury or death. As users data are sensitive, attacks suppose a dangerous scenario, even more critical than hacking any other device, such as a laptop or a mobile phone [65; 32]. Medical devices and their connections are similar to a wireless sensor network [24]. Figure 2 represent the scenario of a malware attack against a WHMS. A simulation of a malware attack against medical devices with an SEIRS-D agent-based model [66] was developed. Agent-based models (ABM) are models where individuals (agents) are entities that are unique and autonomous, which interact with their neighbours and with their near environment. An ABM can be made up of different agents that represent different individuals within the system under analysis. Generally, these models are suitable for systems with heterogeneous, autonomous, and proactive actors in which individual characteristics cannot be neglected. In this model, in each time \(t\), the sensor nodes can assume one of the following states:  
* Susceptible: the sensor has the characteristics for been infected by malware. * Exposed: the malware has attacked the sensor, but the sensor cannot be transmitted to the sensors neighbors. * Infected: the computational characteristics of the sensor allows it to be infected by malware and a sensor is capable of transmitting malware to its neighbors and the gateway. * Recovered: the malware has been removed from the sensor, either by updating or fixing. * Dead: the sensor battery life may be exhausted faster because of the infection of malware, and the sensor is no longer useful. The states of SEIRS-D model can be determined from the characteristics of the agents involved in the transmission and infection of malware (see Table 1). The agents and their characteristics involved in this process are as follows:  
Figure 2: Scheme of the agents involved in the proposed model. * WHMS sensors: are responsible for measuring various vital signs of a person, such as foot temperature. * Type of sensors: can be sensor, sink, and cluster-head nodes. Each one performs a particular function within the device. * Computational capacity: each WHMS can have computational capabilities, such as a microprocessor, memory, and storage, which allow performing different measurements. * Energy consumption: depends on the number and the frequency of measurements. * The capacity of transmission and reception of information: is related to the computational capacity; for example, a device with higher computational capacity will process more data and, in turn, transmit that information to its neighbours. * Security level: is critical, as the health data handled by these sensors are sensitive. * Data collection method: refers to the technique and periodicity in which a sensor performs measurements. * Duty cycle: when the sensor is not taking measurements, it may be in a inactive state, while its state is active when it is taking measurements. * Malware: are those malicious codes that seek to perform unauthorized actions on the devices. * Type of malware: WMHS sensors may be affected by IoT-based malware. * Spreading mechanism: malware can use self-replication, exploit, or user interaction to perform malicious actions. * Target: the most common attacks for WHMS are DoS/DDoS or botnet attacks. * Network topology: represents the form of communication of the sensors. * Type of topology: WHMS is based on a body area network. * Routing or communication protocols: depending on the tier, the communication is established through different protocols. * The phenomenon of interest: the environment where these devices are located is outside hospitals to monitor patients during their daily activities. * Risk of malware attack: can range from low to high according to exposure to unsafe networks.