Multi-Layered Security Assessment in mHealth Environments: Case Study on Server, Mobile and Wearable Components in the PHGL-COVID Platform

The growing use of mobile health (mHealth) technologies adds complexity and risk to the healthcare environment. This paper proposes a multi-layered assessment of cybersecurity of an in-house mHealth platform (PHGL-COVID), which consists of a Docker-based server infrastructure, a Samsung Galaxy A55 smartphone, and a Galaxy Watch 7 wearable. The goal of the work was to perform an assessment of cybersecurity vulnerabilities across the server, mobile, and wearable components of the mHealth platform by emulating real-world attacks and performing systematic penetration tests on all three layers of security. Each layer was examined using tools and methods specifically designed to assess the server, mobile, and wearable technologies. This analysis uncovered exploitable configurations, insecure Bluetooth Low Energy (BLE) communications, and leaks of Personal Health Records (PHR). The findings found systemic weaknesses including incomplete isolation of a container, leak of BLE meta-data, and the perpetual abuse of privacy permissions by Android applications. This study proposes practical recommendations, for developers and system architects, to help secure mHealth platform services. This study provides reproducible audit methodology, as well as a case study that is realized in real-world operational deployments, thus closing a gap between theorized models and practical security in healthcare.