## 3 Security and Privacy Issues
### Security Threats
In this threat, malicious nodes may refuse to forward certain messages (e.g., ECG, temperature, _etc._) and may simply drop them, so that they cannot be broadcast further. This threat can be stronger if the attacker is explicitly included in the routing path. Figure 9 illustrates an example; suppose an ECG sensor forwards packets, _i.e._, 1, 2, 3, 4... 10, to the next hop. But if a patient's enemy intentionally capture and drops some ECG packets, and only forwards a few packets, _i.e._, 4, 5, 6, 8 and 10, to the remote site [58], this could be life-threatening in a patient emergency condition. Further, in [49], the authors point-out that the CodeBlue architecture is susceptible to grey-hole attacks. They claimed that if attackers modify the ADMR packet header of certain packets by small hop-count, they can make the adjacent nodes believe that the attacker is located in the shortest-path to the sink. Thereafter, the attacker can generously drop every packet, whatever he/she receives. That could cause life-threatening risks. 2. Sinkhole threat: In this threat, an attacker tries to attract all neighboring nodes to establish routes through a malicious node. Figure 10 illustrates a sinkhole attack; once the attacker is successful in the sinkhole attack, then the network is also open to other attacks [58], for example, eavesdropping or selective forwarding. Sinkhole attacks are very hard to detect [59]. 3. Sybil Attack: In this attack, a compromised node presents multiple fake identities to other neighboring nodes in the network [60]. Figure 11 illustrates how the multiple fake identities of a compromised node are sent to other neighboring nodes [58]. Further, [PERSON] _et al._ claim that the CodeBlue system is susceptible to Sybil attack, especially, when it operates in an _ad-hoc_ manner; for details the reader can refer to [49]. The Sybil attack poses a significant threat in geographic and multipath routing protocols, because the compromised node may  
Figure 9: Selective Forwarding Attack. appear in more than one place [61]. Further, in [60,62] the authors have discussed more routing attacks in the context of healthcare applications using sensor networks, e.g., sleep attack, fairness attack, and wormhole attack. In a home care application, an attacker can easily rogue a wireless rely point while patient data is transmitting to the remote location. In general wireless rely nodes are unguarded, so it may happen that a rogue rely node can provide unrestricted access to an attacker who can then cause a masquerade. In this threat, an illegal rely node acts as a real node to the network. This can lead to false alarms to remote sites and an emergency team could start a rescue operation for a non-existent person. A masquerade node can apply easily denial-of-service attacks, and can disrupt the application operation. It can even defeat the purpose of wireless healthcare. Thus, masquerading nodes can be very dangerous for healthcare applications. More important, if a masquerade relay node captures the patient physiological data, later, these captured messages can pose replay threats to the real-time healthcare application. Obviously the patient treatment depends on fresh received messages from medical sensor  
Figure 11: Sybil Attack. Figure 10: Sinkhole Attack. networks. If masquerade nodes replay the old messages again and again, this could cause of mistreatment and overtreatment (_i.e._, medicine overdose) of the patients. Thus, masquerade and replay threats endanger real-time healthcare applications using wireless medical sensors. Location Threats  
Medical sensor networks support patient mobility, so exact patient location knowledge is needed since location knowledge allows reaching medical staff in a short time, in case of any emergency [63]. Generally, location-tracking systems are based on radio frequency [46], ultrasound, received signal strength indicator or some other technology [44].