Cyber-Physical Systems Security—A Survey <s> 3) Medical Devices Vulnerabilities: a) MD V4, communication vulnerabilities in cyberphysical-components: <s> Our study analyzes the security and privacy properties of an implantable cardioverter defibrillator (ICD). Introduced to the U.S. market in 2003, this model of ICD includes pacemaker technology and is designed to communicate wirelessly with a nearby external programmer in the 175 kHz frequency range. After partially reverse-engineering the ICD's communications protocol with an oscilloscope and a software radio, we implemented several software radio-based attacks that could compromise patient safety and patient privacy. Motivated by our desire to improve patient safety, and mindful of conventional trade-offs between security and power consumption for resource-constrained devices, we introduce three new zero-power defenses based on RF power harvesting. Two of these defenses are human-centric, bringing patients into the loop with respect to the security and privacy of their implantable medical devices (IMDs). Our contributions provide a scientific baseline for understanding the potential security and privacy risks of current and future IMDs, and introduce human-perceptible and zero-power mitigation techniques that address those risks. To the best of our knowledge, this paper is the first in our community to use general-purpose software radios to analyze and attack previously unknown radio communications protocols. <s> BIB001 </s> Cyber-Physical Systems Security—A Survey <s> 3) Medical Devices Vulnerabilities: a) MD V4, communication vulnerabilities in cyberphysical-components: <s> Wearable and implantable medical devices are being increasingly deployed to improve diagnosis, monitoring, and therapy for a range of medical conditions. Unlike other classes of electronics and computing systems, security attacks on these devices have extreme consequences and must, therefore, be analyzed and prevented with utmost effort. Yet, very little work exists on this important topic and the security vulnerabilities of such systems are not well understood. We demonstrate security attacks that we have implemented in the laboratory on a popular glucose monitoring and insulin delivery system available on the market, and also propose defenses against such attacks. Continuous glucose monitoring and insulin delivery systems are becoming increasingly popular among patients with diabetes. These systems utilize wireless communication links, which are frequently utilized as a portal to launch security attacks. Our study shows that both passive attacks (eavesdropping of the wireless communication) and active attacks (impersonation and control of the medical devices to alter the intended therapy) can be successfully launched using public-domain information and widely available off-the-shelf hardware. The proposed attacks can compromise both the privacy and safety of patients. We propose two possible defenses against such attacks. One is based on rolling-code cryptographic protocols, and the other is based on body-coupled communication. Our security analysis shows that the proposed defenses have the potential to mitigate the security risks associated with personal healthcare systems. <s> BIB002 </s> Cyber-Physical Systems Security—A Survey <s> 3) Medical Devices Vulnerabilities: a) MD V4, communication vulnerabilities in cyberphysical-components: <s> Wireless communication has become an intrinsic part of modern implantable medical devices (IMDs). Recent work, however, has demonstrated that wireless connectivity can be exploited to compromise the confidentiality of IMDs' transmitted data or to send unauthorized commands to IMDs---even commands that cause the device to deliver an electric shock to the patient. The key challenge in addressing these attacks stems from the difficulty of modifying or replacing already-implanted IMDs. Thus, in this paper, we explore the feasibility of protecting an implantable device from such attacks without modifying the device itself. We present a physical-layer solution that delegates the security of an IMD to a personal base station called the shield. The shield uses a novel radio design that can act as a jammer-cum-receiver. This design allows it to jam the IMD's messages, preventing others from decoding them while being able to decode them itself. It also allows the shield to jam unauthorized commands---even those that try to alter the shield's own transmissions. We implement our design in a software radio and evaluate it with commercial IMDs. We find that it effectively provides confidentiality for private data and protects the IMD from unauthorized commands. <s> BIB003 </s> Cyber-Physical Systems Security—A Survey <s> 3) Medical Devices Vulnerabilities: a) MD V4, communication vulnerabilities in cyberphysical-components: <s> Balancing security, privacy, safety, and utility is a necessity in the health care domain, in which implantable medical devices (IMDs) and body area networks (BANs) have made it possible to continuously and automatically manage and treat a number of health conditions. In this work, we survey publications aimed at improving security and privacy in IMDs and health-related BANs, providing clear definitions and a comprehensive overview of the problem space. We analyze common themes, categorize relevant results, and identify trends and directions for future research. We present a visual illustration of this analysis that shows the progression of IMD/BAN research and highlights emerging threats. We identify three broad research categories aimed at ensuring the security and privacy of the telemetry interface, software, and sensor interface layers and discuss challenges researchers face with respect to ensuring reproducibility of results. We find that while the security of the telemetry interface has received much attention in academia, the threat of software exploitation and the sensor interface layer deserve further attention. In addition, we observe that while the use of physiological values as a source of entropy for cryptographic keys holds some promise, a more rigorous assessment of the security and practicality of these schemes is required. <s> BIB004
The reliance on wireless communications in wearable and IMDs invites vulnerabilities that could result in physical impacts on patients when exploited. If medical devices fail to transmit or receive expected packets, an undesired health condition could result from incorrect operations performed by the medical device. As the devices rely on wireless communications, likelihood of jamming attacks arises. For example, when an insulin pump does not receive periodic updates from the associated CGM, it assumes the patient's condition is stable, and no need for an injection of an insulin dosage. This leads to an undesirably high glucose level BIB002 ,  . Some devices are vulnerable to battery exhausting attacks, where an adversary exhausts the devices computational or communication resources to withdraw the battery's reserves BIB001 , BIB004 . By injecting a specially crafted packet, it is possible to send unauthorized commands or false data. Halperin et al. BIB001 and Gollakota et al. BIB003 demonstrated the ICDs' vulnerabilities to injection attacks by exploiting wireless vulnerabilities. In addition, Li et al. BIB002 demonstrated the insulin pump's vulnerability to be remotely controlled by intercepting the device's communications with its remote control. Radcliffe  also uncovered a vulnerability in the insulin pump device that would allow injection attacks. The device requires its serial number to be part of the command packet as an authentication measure. An attacker equipped with the serial number can inject unauthorized commands to the device. Replay attacks do not require knowledge of the underlying protocols; instead, an attacker only needs to capture legitimate measurements or command packets, and retransmits them at a later time. Li et al. BIB002 revealed a vulnerability in an insulin pump that would allow replay attacks so that the pump receives a dishonest reading of the glucose level. And therefore the patient decides mistakenly to inject the wrong amount of insulin, such that the decision might threaten the health condition. In addition, Radcliffe  revealed that a CGM device was vulnerable to replay attacks. By retransmitting precaptured packets to the CGM, the author was able to spoof the CGM with incorrect values. In addition, besides the violation of confidentiality, lack of encryption allows replay attacks BIB001 . b) MD V5, device authentication: An attacker can use a commercial programmer without authorization as a result of the implicit trust given to anyone uses the programmers BIB001 . This makes medical devices vulnerable to safety-critical attacks even without technical knowledge needed for attackers. In addition, some attacks do not need programmers. Instead, universal software radio peripheral is sufficient to replace a programmer and send malicious packets as Halperin et al. BIB001 have shown.