# A Systematic Review of Radio Frequency Threats in IoMT
## 3 Results and Discussion
### Cyber-Physical Attacks on Protocols  
This paper [38] examines the effectiveness of IoT against high-power cellular networks using various low-power protocols. The author discusses the key technical differences between Sigfox, LoRa, and NB-IoT, as well as their advantages and disadvantages. According to their investigation, specific protocols will deliver high mobility and QoS. However, downlink data are possible with wearables with the same spectrum threat of the uplink process.  
In other words, the danger is not different for each process since both work under an unlicensed frequency band under the range of Industrial, scientific, and medical (ISM) 900 MHZ [39]. Medical sensors in the ISM band are vulnerable to physical layer attacks. Examples include tampering/malicious code injection, firmware attacks, jamming, replay, and evil twin attacks. During the reconnaissance phase of attack strategies, adversaries thoroughly investigate those devices. OSINT toolsets are suited to their motivations and guided by attack vector maturity. The newly identified markers employ a variety of attack surfaces, including iron oxide fillings and traces. In our scope, we focus on attacks at the spectrum level before reaching the IP network gateway. A few common attacks on those spaces are sniffing, eavesdropping, jamming, network state disruption or transmitting noise, and conflicting the traffic within the target RF channel having the same frequency.  
Re-transmitting the symbol or captured frames to the receiver to implement a replay attack includes re-transmitting mutated information. The threat or aggression process will be the same regardless of the spectrum of attacks. The base of any attack strategy is to understand the protocols and reverse engineer the spectrum for payload injection. Several factors contribute to the identification and localization, including modulation, frequency, bandwidth, data rate, half duplex or full duplex system, maximum payload size, range between source-target, interference immunity, adaptive data rate, authentication, handover to fault-tolerant node, localization, and energy awareness. Additionally, the localization of the transmitting rogue SDR is detectable using the angle of arrival (AOA), time difference of arrival (TDOA), frequency difference of arrival (FDOA), and received signal strength indicator (RSSI) techniques.  
Cyber-Physical Attacks on Low-Power Protocols  
In paper [39], the author examines the effectiveness of the Internet of Things using low-power protocols. Furthermore, their investigation claims that mobility and QoS will be high for specific protocols because of asset mobility and continuous evaluation and monitoring. The IoT, drones, radio channels, satellite communications, and marine, aeronautical, and deep space communication create new cybersecurity threats. Anything emitting RF energy is vulnerable. Due to IoT, including the internet of medical things, battle things, and the internet of everything, and high-level adversary motivation, the attack surface is growing. New threats will increase the urgency for innovation in frameworks, cybersecurity maturity models, standards, and guidelines. Therefore, cybersecurity policies and controls must move into the extended maturity group.