# Health IoT Threats: Survey of Risks and Vulnerabilities
## 4 Results
### Overview of IoT Security and Privacy in Healthcare
#### 4.1.3 The Application Layer  
This layer is responsible for data processing, storage, and presentation. It provides the interface through which users interact with IoT devices. As a result, healthcare IoT systems are vulnerable to a wide range of security and privacy issues and attacks at the application layer. The high number of IoT applications and their diversity and complexity could be considered the main cause of the security issues of the IoT caused by system integration [68; 91]. One of the most common issues is the lack of data integrity and authenticity, which can lead to the spread of false information and negatively affect patient care [91]. Ensuring data integrity and authenticity can be achieved through implementing secure communication protocols, such as Transport Layer Security and Secure Sockets Layer to protect the data while in transit. Another common issue is the use of default or weak credentials, which can easily be guessed or brute-forced by attackers, compromising patient privacy and safety [144]. To prevent such attacks, the healthcare industry should establish strong password policies, use multifactor authentication, and ensure that IoT devices are configured with strong passwords [145]. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Issue or Attack** & **Explanation and Highlight** & **Countermeasure** \\ \hline Gray Hole & \begin{tabular}{c} A type of attack where an IoT \\ device selectively drops or \\ modifies some network traffic, \\ leading to degradation in service \\ quality and potential data loss. \\ This attack is similar to a black \\ hole attack; instead of destroying \\ all signals, it just removes a \\ selection of those [140]. \\ \end{tabular} & \begin{tabular}{c} Using encryption, implementing access controls, network traffic \\ analysis, intrusion detection and prevention systems, keeping IoT \\ devices up to date, deploying \\ firewalls, and implementing data \\ redundancy [137; 141]. \\ \end{tabular} \\ \hline Worm Hole & \begin{tabular}{c} A type of attack where an attacker \\ captures packets from one part of \\ the network and tunnels them to \\ bypassing network security \\ measures [137]. By managing at \\ least two network nodes or adding \\ additional false nodes to the \\ network, the attacker establishes a \\ link between different parts of the \\ network. The hacker gathers data \\ from one point and replays it to \\ the other after confirming the \\ link [142]. \\ \end{tabular} & \begin{tabular}{c} Implementing secure communication protocols, using location-based authentication, network traffic analysis, intrusion detection, and prevention systems, implementing access controls, using digital signatures, and deploying firewalls [137]. \\ \end{tabular} \\ \hline Congestion Attack & \
\begin{tabular}{c} A type of attack where an attacker \\ floods the network with traffic, \\ causing it to become congested \\ and resulting in the degradation of \\ service quality or even network \\ failure [124]. This attack succeeds \\ by flooding networks with \\ unprocessed responses until their \\ period runs out. Then, the lane is \\ restricted to transactions whenever \\ the highest number of unsolved \\ requests (HTLCs) is achieved [143]. \\ \end{tabular} &
\begin{tabular}{c} Using traffic shaping, implementing Quality of Service (QoS) policies, using rate limiting, implementing access controls, deploying intrusion detection and prevention systems, using network traffic analysis, and keeping IoT devices up to date \\ with the latest security patches \\ and firmware updates [65]. \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 5: _Cont._Moreover, several reports of attacks on the application layer in healthcare IoT systems include ransomware attacks that can disrupt critical medical services [54; 146] and DDoS attacks [147] that can make the system unavailable. Such attacks can be prevented by implementing network security controls, such as firewalls and intrusion detection systems, to detect and mitigate attacks before they cause damage [148].