Report: Nearly Three-Quarters of mHealth Apps Vulnerable to Data Breach

Intertrust, the pioneer in digital rights management (DRM) technology and leading provider of application security solutions, has released its 2020 Security Report on Global mHealth Apps, revealing that 71 percent of healthcare and medical apps have at least one serious vulnerability that could lead to a breach of medical data. The report investigated 100 publicly available global mobile healthcare apps across a range of categories—including telehealth, medical device, health commerce, and COVID-tracking—to uncover the most critical mHealth app threats.
 
Cryptographic issues pose one of the most pervasive and serious threats, with 91 percent of the apps in the study failing one or more cryptographic tests. This means the encryption used in these medical apps can be easily broken by cybercriminals, potentially exposing confidential patient data, and enabling attackers to tamper with reported data, send illegitimate commands to connected medical devices, or otherwise use the application for malicious purposes.
 
The study’s overall findings suggest that the push to reshape care delivery under COVID-19 has often come at the expense of mobile application security.
 
“Unfortunately, there’s been a history of security vulnerabilities in the healthcare and medical space. Things are getting a lot better, but we still have a lot of work to do,” said Bill Horne, general manager of the Secure Systems product group and chief technology officer at Intertrust. “The good news is that application protection strategies and technologies can help healthcare organizations bring the security of their apps up to speed.”
 
The Intertrust security report on healthcare and medical mobile apps is based on an audit of 100 iOS and Android applications from healthcare organizations worldwide. All 100 apps were analyzed using an array of static application security testing (SAST) and dynamic application security testing (DAST) techniques based on the OWASP (Open Web Application Security Project) mobile app security guidelines.
 
The assessment revealed major security gaps in mobile medical apps across the board. Highlights from the report include:

• Seventy-one percent of tested medical apps have at least one high level security vulnerability. A vulnerability is classified as high if it can be readily exploited and has the potential for significant damage or loss.
• The vast majority of medical apps (91 percent) have mishandled and/or weak encryption that puts them at risk for data exposure and IP (intellectual property) theft.
• Thirty-four percent of Android apps and 28 percent of iOS apps are vulnerable to encryption key extraction.
• The majority of mHealth apps contain multiple security issues with data storage. For instance, 60 percent of tested Android apps stored information in SharedPreferences, leaving unencrypted data readily readable and editable by attackers and malicious apps.
• When looking specifically at COVID-tracking apps, 85 percent leak data.
• Eighty-three percent of the high-level threats discovered could have been mitigated using application protection technologies such as code obfuscation, tampering detection, and white-box cryptography.