A cyber warfare perspective on risks related to health IoT devices and contact tracing

Abstract

The wide use of IT resources to assess and manage the recent COVID-19 pandemic allows to increase the effectiveness of the countermeasures and the pervasiveness of monitoring and prevention. Unfortunately, the literature reports that IoT devices, a widely adopted technology for these applications, are characterized by security vulnerabilities that are difficult to manage at the state level. Comparable problems exist for related technologies that leverage smartphones, such as contact tracing applications, and non-medical health monitoring devices. In analogous situations, these vulnerabilities may be exploited in the cyber domain to overload the crisis management systems with false alarms and to interfere with the interests of target countries, with consequences on their economy and their political equilibria. In this paper we analyze the potential threat to an example subsystem to show how these influences may impact it and evaluate a possible consequence.

Keywords: COVID-19; Cyber warfare; IoT; Risk analysis; Security.

Fig. 1

Influence Net for the scenario

Fig. 2

Description of the behavior of the contact tracing protocol

Fig. 3

The coloured Petri net model for the considered subsystems

Fig. 4

The MAM for the considered subsystems

Fig. 5

The evolution of the average number of people in the considered states

Fig. 6

Susceptible, Infected, total population at home, and average waiting time as function of the contact rate $\alpha$

Fig. 7

Growth of total quarantined persons in function of false positives