Security testing for Android mHealth apps

Abstract

Mobile health (mHealth) apps are an ideal tool for monitoring and tracking long-term health conditions; they are becoming incredibly popular despite posing risks to personal data privacy and security. In this paper, we propose a testing method for Android mHealth apps which is designed using a threat analysis, considering possible attack scenarios and vulnerabilities specific to the domain. To demonstrate the method, we have applied it to apps for managing hypertension and diabetes, discovering a number of serious vulnerabilities in the most popular applications. Here we summarise the results of that case study, and discuss the experience of using a testing method dedicated to the domain, rather than out-of-the-box Android security testing methods. We hope that details presented here will help design further, more automated, mHealth security testing tools and methods.

Untitled

“…Although most studies state that evaluation is orientated toward patient safety, our study revealed that most participants had only considered the potential for unhelpful or improper advice. Users and clinicians must remain cautious, as security and the development of adequate privacy (including location information), are not always a priority for mHealth app developers (Knorr & Aspinall, 2015;Buijink et al, 2013).…”

No Risk, More Fun! Automating Breach of Confidentiality Risk Assessment for Android Mobile Health Applications

“…First, evaluation of metainformation regarding information privacy practices, such as privacy notices or user interface characteristics [16,17]. Second, manual assessment conducted on technical aspects of apps, such as analyzing the source code or monitoring data connections [18,19,1,9,20,21,22,23]. Research on automated breach of confidentiality risk assessment is sparse.…”

Pruebas de seguridad: Estudio de herramientas

“…identificaron además herramientas especializadas en pruebas de seguridad para Android [24], [25], [26] estas es particulares son interesantes ya que el número de usuarios con dispositivos móviles ha aumentado significativamente en los últimos años, y las aplicaciones móviles se están convirtiendo en herramientas integrales para la vida diaria.…”