Assessing the Security Risks of Medical Mobile Applications

In this study, we conducted a comprehensive security analysis of 140 medical mobile applications tested on both Android and iOS platforms. Our methodology included looking for side channel leaks that can be abused by third-party applications installed on the device, assessing support for old and potentially vulnerable versions of Android and iOS, evaluating device and application integrity protections, conducting dynamic analysis to observe runtime behavior such as local data storage practices, and searching for hardcoded keys or other sensitive information embedded in the code. We also performed traffic analysis to observe communication between the mobile applications and their associated APIs. Our findings reveal that significant underlooked risks still exist. The majority of the apps we analyzed lacked typical security safeguards, such as root detection and secure local data storage, leaving sensitive Patient Health Information (PHI) vulnerable to attackers with local or physical access to the device. Four of the apps were communicating over plain HTTP, which poses a significant risk to the confidentiality and integrity of the patient data that was transmitted. These results highlight the urgent need for improved security measures in medical mobile applications, both from a technical and regulatory point of view.