Annual security report of 100 top Android and iOS healthcare applications reveals serious cryptographic vulnerabilities, data leakage, and other security breaches—showing the industry needs to do far better given the massive transition to remote healthcare in the wake of COVID-19 lockdowns.
Intertrust, the pioneer in digital rights management (DRM) technology and leading provider of application security solutions, released their 2020 Security Report on Global mHealth Apps today, revealing that 71% of healthcare and medical apps have at least one serious vulnerability that could lead to a breach of medical data. The report investigated 100 publicly available global mobile healthcare apps across a range of categories—including telehealth, medical device, health commerce, and COVID-tracking—to uncover the most critical mHealth app threats.
Cryptographic issues pose one of the most pervasive and serious threats, with 91% of the apps in the study failing one or more cryptographic tests. This means the encryption used in these medical apps can be easily broken by cybercriminals, potentially exposing confidential patient data, and enabling attackers to tamper with reported data, send illegitimate commands to connected medical devices, or otherwise use the application for malicious purposes.
The study’s overall findings suggest that the push to reshape care delivery under COVID-19 has often come at the expense of mobile application security.
Read More: Microsoft Study: How COVID-19 has altered the Future of Cyber-security
“Unfortunately, there’s been a history of security vulnerabilities in the healthcare and medical space. Things are getting a lot better, but we still have a lot of work to do.” said Bill Horne, General Manager of the Secure Systems product group and Chief Technology Officer at Intertrust. “The good news is that application protection strategies and technologies can help healthcare organizations bring the security of their apps up to speed.”
The Intertrust security report on healthcare and medical mobile apps is based on an audit of 100 iOS and Android applications from healthcare organizations worldwide. All 100 apps were analyzed using an array of static application security testing (SAST) and dynamic application security testing (DAST) techniques based on the OWASP (Open Web Application Security Project) mobile app security guidelines.
The assessment revealed major security gaps in mobile medical apps across the board. Highlights from the report include:
- 71% of tested medical apps have at least one high-level security vulnerability. A vulnerability is classified as high if it can be readily exploited and has the potential for significant damage or loss.
- The vast majority of medical apps (91%) have mishandled and/or weak encryption that puts them at risk for data exposure and IP (intellectual property) theft.
Read More: Top Vulnerabilities that CIOs Need to Consider as the Workforce Returns to Offices
- 34% of Android apps and 28% of iOS apps are vulnerable to encryption key extraction.
- The majority of mHealth apps contain multiple security issues with data storage. For instance, 60% of tested Android apps stored information in SharedPreferences, leaving unencrypted data readily readable and editable by attackers and malicious apps.
- When looking specifically at COVID-tracking apps, 85% leak data.
- 83% of the high-level threats discovered could have been mitigated using application protection technologies such as code obfuscation, tampering detection, and white-box cryptography.
