Multi-Layered Security Assessment in mHealth Environments: Case Study on Server, Mobile and Wearable Components in the PHGL-COVID Platform
Source abstract
Abstract
The growing use of mobile health (mHealth) technologies adds complexity and risk to the healthcare environment. This paper presents a multi-layered cybersecurity assessment of an in-house mHealth platform (PHGL-COVID), comprising a Docker-based server infrastructure, a Samsung Galaxy A55 smartphone, and a Galaxy Watch 7 wearable. The objective was to identify vulnerabilities across the server, mobile, and wearable components by emulating real-world attacks and conducting systematic penetration tests on each layer. Tools and methods specifically tailored to each technology were applied, revealing exploitable configurations, insecure Bluetooth Low Energy (BLE) communications, and exposure of Personal Health Records (PHRs). Key findings included incomplete container isolation, BLE metadata leakage, and persistent abuse of Android privacy permissions. This work delivers both a set of actionable recommendations for developers and system architects to strengthen the security of mHealth platforms, and a reproducible audit methodology that has been validated in a real-world deployment, effectively bridging the gap between theoretical threat models and practical cybersecurity practices in healthcare systems.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: User Authentication and Security Systems · Mobile Health and mHealth Applications · Privacy, Security, and Data Protection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Computers, Automation and Electronics, University “Ștefan cel Mare”, 720229 Suceava, Romania
Department of Clinical Pharmacy, USC Alfred E. Mann School of Pharmacy and Pharmaceutical Sciences, University of Southern California, Los Angeles, CA 90033, USA
Funding
Ministry of Research, Innovation and Digitization
References (65)
Show source-provided references
1. Konda, B., Yadulla, A.R., Kasula, V.K., Yenugula, M., and Adupa, C. (2025, January 19–22). Enhancing Traceability and Security in mHealth Systems: A Proximal Policy Optimization-Based Multi-Authority Attribute-Based Encryption Approach. Proceedings of the 2025 29th International Conference on Information Technology (IT), Zabljak, Montenegro.10.1109/IT64745.2025.10930307 ↗
2. Alzghaibi, H. (2025). Barriers to the Utilization of mHealth Applications in Saudi Arabia: Insights from Patients with Chronic Diseases. Healthcare, 13.10.3390/healthcare13060665 ↗
3. Enhancing privacy in mHealth Applications: A User-Centric model identifying key factors influencing Privacy-Related behaviours10.1016/j.ijmedinf.2025.105907 ↗
4. Alzghaibi, H. (2025). Healthcare Practitioners’ Perceptions of mHealth Application Barriers: Challenges to Adoption and Strategies for Enhancing Digital Health Integration. Healthcare, 13.10.3390/healthcare13050494 ↗
5. Impact of the COVID-19 pandemic on mHealth adoption: Identification of the main barriers through an international comparative analysis10.1016/j.ijmedinf.2024.105779 ↗
6. Exploring the factors influencing the intention to use mHealth applications in resource scare settings; a SEM analysis among future nurses10.1016/j.glt.2025.04.002 ↗
7. Detecting Deception and Ensuring Data Integrity in a Nationwide mHealth Randomized Controlled Trial: Factorial Design Survey Study10.2196/66384 ↗
8. Bridging the Digital Divide in Health for Older Adults: A Repeated Cross-Sectional Study of mHealth in Saudi Arabia10.1109/ACCESS.2025.3558368 ↗
9. Efficiency of Mobile Apps in Healthcare: A Case Study of MED-UZ AI
10. Siddiqui, S., Khan, A.A., Khattak, M.A.K., and Sosan, R. (2025). Mobile Health (m-Health). Connected Health Insights for Sustainable Development: Integrating IoT, AI and Data-Driven Solutions, Springer Nature.10.1007/978-3-031-81433-4 ↗
11. Zhang, R., and Wang, H. (2025). Insights into the Technological Evolution and Research Trends of Mobile Health: Bibliometric Analysis. Healthcare, 13.10.3390/healthcare13070740 ↗
12. Federated Learning Meets Blockchain in Decentralized Data Sharing: Healthcare Use Case10.1109/JIOT.2024.3367249 ↗
13. Badidi, E. (2023). Edge AI for Early Detection of Chronic Diseases and the Spread of Infectious Diseases: Opportunities, Challenges, and Future Directions. Future Internet, 15.10.3390/fi15110370 ↗
14. Privacy-preserving deep learning for pervasive health monitoring: A study of environment requirements and existing solutions adequacy10.1007/s12553-022-00640-3 ↗
15. Artificial intelligence–based electrocardiogram analysis improves atrial arrhythmia detection from a smartwatch electrocardiogram10.1093/ehjdh/ztae047 ↗
16. Madanian, S., Chinbat, T., Subasinghage, M., Airehrour, D., Hassandoust, F., and Yongchareon, S. (2024). Health IoT Threats: Survey of Risks and Vulnerabilities. Future Internet, 16.10.3390/fi16110389 ↗
17. Forsberg, A., and Iwaya, L. (2024, January 6–7). Security Analysis of Top-Ranked mHealth Fitness Apps: An Empirical Study. Proceedings of the 29th Nordic Conference, NordSec 2024, Karlstad, Sweden.
18. On providing multi-level security assurance based on Common Criteria for O-RAN mobile network equipment. A test case: O-RAN Distributed Unit10.1016/j.cose.2024.104271 ↗
19. A comprehensive systematic review of intrusion detection systems: Emerging techniques, challenges, and future research directions10.55056/jec.885 ↗
20. Bojjagani, S., and Sastry, V. (2017, January 15–17). VAPTAi: A Threat Model for Vulnerability Assessment and Penetration Testing of Android and iOS Mobile Banking Apps. Proceedings of the IEEE 3rd International Conference on Collaboration and Internet Computing (CIC), San Jose, CA, USA.10.1109/CIC.2017.00022 ↗
21. (2025, June 02). Sensors|Special Issue: Security and Privacy for IoT and Metaverse. Available online: https://www.mdpi.com/journal/sensors/special_issues/security_privacy_IoT_Metaverse.
22. Opportunistic access control scheme for enhancing IoT-enabled healthcare security using blockchain and machine learning10.1038/s41598-025-90908-1 ↗
23. Zhang, W., Xing, J., and Li, X. (2025). Penetration Testing for System Security: Methods and Practical Approaches. arXiv.
24. Kołaczek, G. (2025). Internet of Things (IoT) Technologies in Cybersecurity: Challenges and Opportunities. Appl. Sci., 15.10.3390/app15062935 ↗
25. Singla, V., Singh, A., and Bhathal, G. (2024). Navigating Blockchain-Based Clinical Data Sharing: An Interoperability Review, CRC Press. [1st ed.].10.1201/9781003471059-52 ↗
26. (2025, June 02). Edge Computing in Healthcare: Innovations, Opportunities, and Challenges. Available online: https://www.mdpi.com/1999-5903/16/9/329.10.3390/fi16090329 ↗
27. Federated Learning in Real-Time Medical IoT: Optimizing Privacy and Accuracy for Chronic Disease Monitoring
28. Physiological Data: Challenges for Privacy and Ethics10.1109/MC.2024.3404994 ↗
29. Privacy and security in mobile health apps: A review and recommendations10.1007/s10916-014-0181-3 ↗
30. Ravinder, M.K., and Singh, J. (2024, January 8–9). Security Challenges in Mobile Cloud Computing. Proceedings of the 2024 IEEE 1st Karachi Section Humanitarian Technology Conference (KHI-HTC), Tandojam, Pakistan.10.1109/KHI-HTC60760.2024.10482107 ↗
31. Zaman, U., Imran, F.M., Iqbal, N., Kim, J., and Ibrahim, M. (2022). Towards Secure and Intelligent Internet of Health Things: A Survey of Enabling Technologies and Applications. Electronics, 11.10.3390/electronics11121893 ↗
32. Effectiveness of wearable technologies used in the monitoring of cardiovascular diseases in the community: A systematic review of randomized controlled trials10.1016/j.compbiomed.2025.110013 ↗
33. Enhancing Internet of Medical Things security with artificial intelligence: A comprehensive review10.1016/j.compbiomed.2024.108036 ↗
34. Xi, P., Zhang, X., Wang, L., Liu, W., and Peng, S. (2022). A Review of Blockchain-Based Secure Sharing of Healthcare Data. Appl. Sci., 12.10.3390/app12157912 ↗
35. Alruwaill, M.N., Mohanty, S.P., and Kougianos, E. (2025). hChain 4.0: A Secure and Scalable Permissioned Blockchain for EHR Management in Smart Healthcare. arXiv.
36. IoT-Enabled Smart Health Monitoring System with Deep Learning Models for Anomaly Detection and Predictive Health Risk Analytics Integrated with LoRa Technology10.14445/22315381/IJETT-V73I1P102 ↗
37. Farahmandazad, D., and Danesh, K. (2025). ML-Driven Approaches to Combat Medicare Fraud: Advances in Class Imbalance Solutions, Feature Engineering, Adaptive Learning, and Business Impact. arXiv.
38. Mohammadi, M., Javan, R., Beheshti-Atashgah, M., and Aref, M.R. (2024). SCALHEALTH: Scalable Blockchain Integration for Secure IoT Healthcare Systems. arXiv.
39. Deep learning on medical image analysis10.1049/cit2.12356 ↗
40. Atlam, H.F., and Yang, Y. (2025). Enhancing Healthcare Security: A Unified RBAC and ABAC Risk-Aware Access Control Approach. Future Internet, 17.10.3390/fi17060262 ↗
41. The Impact of AI on the Development of Multimodal Wearable Devices in Musculoskeletal Medicine10.1177/15563316251344945 ↗
42. Securing fog computing in healthcare with a zero-trust approach and blockchain10.1186/s13638-025-02431-6 ↗
43. Mekruksavanich, S., and Jitpattanakul, A. (2024). Wearable Sensor-Based Behavioral User Authentication Using a Hybrid Deep Learning Approach with Squeeze-and-Excitation Mechanism. Computers, 13.10.3390/computers13120337 ↗
44. Akif, M.A., Butun, I., Williams, A., and Mahgoub, I. (2025). Hybrid Machine Learning Models for Intrusion Detection in IoT: Leveraging a Real-World IoT Dataset. arXiv.
45. Interoperability of telemonitoring data in digital health solutions: A scoping review10.3389/fdgth.2025.1502260 ↗
46. Riahi, T., Bappy, M.A.H., and Islam, M.M. (2025). ElderFallGuard: Real-Time IoT and Computer Vision-Based Fall Detection System for Elderly Safety. arXiv.
47. Finding Consensus on Trust in AI in Health Care: Recommendations From a Panel of International Experts10.2196/56306 ↗
48. ZTCloudGuard: Zero Trust Context-Aware Access Management Framework to Avoid Medical Errors in the Era of Generative AI and Cloud-Based Health Information Ecosystems10.3390/ai5030055 ↗
49. Rahmati, M. (2025). Towards Explainable and Lightweight AI for Real-Time Cyber Threat Hunting in Edge Networks. arXiv.
50. Pekaric, I., Sauerwein, C., Laichner, S., and Breu, R. (2025, January 24–26). How Do Mobile Applications Enhance Security? An Exploratory Analysis of Use Cases and Provided Information. Proceedings of the ACM Southeast Conference, Cape Girardeau, MO, USA.10.1145/3696673.3723067 ↗
51. Secure Adaptive Context-Aware ABE for Smart Environments10.3390/iot4020007 ↗
52. Cross-device federated unsupervised learning for the detection of anomalies in single-lead electrocardiogram signals10.1371/journal.pdig.0000793 ↗
53. Blockchain for Securing AI-Driven Healthcare Systems: A Systematic Review and Future Research Perspectives
54. Contact tracing strategies for infectious diseases: A systematic literature review10.1371/journal.pgph.0004579 ↗
55. Wearable Sensors and Artificial Intelligence for Sleep Apnea Detection: A Systematic Review10.1007/s10916-025-02199-8 ↗
56. Cho, W., Immanuel, S.A., Heo, J., and Kwon, D. (2025). Fourier-Modulated Implicit Neural Representation for Multispectral Satellite Image Compression. arXiv.
57. Toward Robust Security Orchestration and Automated Response in Security Operations Centers with a Hyper-Automation Approach Using Agentic AI10.3390/info16050365 ↗
58. Cross-Border Data Flows and Digital Sovereignty: Legal Dilemmas in Transnational Governance
59. Reconstructing Risk Dimensions in Telemedicine: Investigating Technology Adoption and Barriers During the COVID-19 Pandemic in Taiwan10.2196/53306 ↗
60. Girma, A., and Barrett, A. Security Challenges and Solutions in 5G-Enabled IoT Networks. Proceedings of the Future Technologies Conference (FTC) 2024.10.1007/978-3-031-73128-0_43 ↗
61. ECG Biometric Authentication Using Self-Supervised Learning for IoT Edge Sensors10.1109/JBHI.2024.3455803 ↗
62. Allouzi, M.A., and Khan, J. (2024). Enabling Zero Trust Security in IoMT Edge Network. arXiv.
63. Bose, S., and Marijan, D. (2023). Secure Traversable Event logging for Responsible Identification of Vertically Partitioned Health Data. arXiv.10.1109/TrustCom60117.2023.00213 ↗
64. Enhancing Patient Outcome Prediction Through Deep Learning With Sequential Diagnosis Codes From Structured Electronic Health Record Data10.2196/57358 ↗
65. Tan, M.J.T., and Benos, P.V. (2025). Addressing Intersectionality, Explainability, and Ethics in AI-Driven Diagnostics: A Rebuttal and Call for Transdiciplinary Action. arXiv.