{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,28]],"date-time":"2026-08-28T07:47:27Z","timestamp":1787903247477,"version":"build-2784847793"},"reference-count":78,"publisher":"Oxford University Press (OUP)","issue":"10","license":[{"start":{"date-parts":[[2021,8,12]],"date-time":"2021-08-12T00:00:00Z","timestamp":1628726400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/academic.oup.com\/journals\/pages\/open_access\/funder_policies\/chorus\/standard_publication_model"}],"funder":[{"name":"Optus Macquarie University Cyber Security Hub"},{"DOI":"10.13039\/501100000925","name":"National Health and Medical Research Council","doi-asserted-by":"crossref","award":["APP1134919"],"award-info":[{"award-number":["APP1134919"]}],"id":[{"id":"10.13039\/501100000925","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100001230","name":"Macquarie University","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001230","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2021,9,18]]},"abstract":"<jats:title>Abstract<\/jats:title>\n               <jats:sec>\n                  <jats:title>Objective<\/jats:title>\n                  <jats:p>We conduct a first large-scale analysis of mobile health (mHealth) apps available on Google Play with the goal of providing a comprehensive view of mHealth apps\u2019 security features and gauging the associated risks for mHealth users and their data.<\/jats:p>\n               <\/jats:sec>\n               <jats:sec>\n                  <jats:title>Materials and Methods<\/jats:title>\n                  <jats:p>We designed an app collection platform that discovered and downloaded more than 20 000 mHealth apps from the Medical and Health &amp; Fitness categories on Google Play. We performed a suite of app code and traffic measurements to highlight a range of app security flaws: certificate security, sensitive or unnecessary permission requests, malware presence, communication security, and security-related concerns raised in user reviews.<\/jats:p>\n               <\/jats:sec>\n               <jats:sec>\n                  <jats:title>Results<\/jats:title>\n                  <jats:p>Compared to baseline non-mHealth apps, mHealth apps generally adopt more reliable signing mechanisms and request fewer dangerous permissions. However, significant fractions of mHealth apps expose users to serious security risks. Specifically, 1.8% of mHealth apps package suspicious codes (eg, trojans), 45.0% rely on unencrypted communication, and as much as 23.0% of personal data (eg, location information and passwords) is sent on unsecured traffic. An analysis of the app reviews reveals that mHealth app users are largely unaware of the surfaced security issues.<\/jats:p>\n               <\/jats:sec>\n               <jats:sec>\n                  <jats:title>Conclusion<\/jats:title>\n                  <jats:p>Despite being better aligned with security best practices than non-mHealth apps, mHealth apps are still far from ensuring robust security guarantees. App users, clinicians, technology developers, and policy makers alike should be cognizant of the uncovered security issues and weigh them carefully against the benefits of mHealth apps.<\/jats:p>\n               <\/jats:sec>","DOI":"10.1093\/jamia\/ocab131","type":"journal-article","created":{"date-parts":[[2021,6,11]],"date-time":"2021-06-11T11:32:27Z","timestamp":1623411147000},"page":"2074-2084","source":"Crossref","is-referenced-by-count":35,"title":["Analyzing security issues of android mobile health and medical applications"],"prefix":"10.1093","volume":"28","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6282-5994","authenticated-orcid":false,"given":"Gioacchino","family":"Tangari","sequence":"first","affiliation":[{"name":"Department of Computing, Macquarie University, Sydney, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Muhammad","family":"Ikram","sequence":"additional","affiliation":[{"name":"Department of Computing, Macquarie University, Sydney, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"I Wayan Budi","family":"Sentana","sequence":"additional","affiliation":[{"name":"Department of Computing, Macquarie University, Sydney, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8722-6595","authenticated-orcid":false,"given":"Kiran","family":"Ijaz","sequence":"additional","affiliation":[{"name":"Centre for Health Informatics, Australian Institute of Health Innovation, Macquarie"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mohamed Ali","family":"Kaafar","sequence":"additional","affiliation":[{"name":"Department of Computing, Macquarie University, Sydney, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shlomo","family":"Berkovsky","sequence":"additional","affiliation":[{"name":"Centre for Health Informatics, Australian Institute of Health Innovation, Macquarie"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"286","published-online":{"date-parts":[[2021,8,12]]},"reference":[{"key":"2021091817524404600_ocab131-B1","author":"Iqbal","year":"2020"},{"key":"2021091817524404600_ocab131-B2","first-page":"66","volume-title":"mHealth: New Horizons for Health through Mobile Technologies","author":"Kay","year":"2011"},{"key":"2021091817524404600_ocab131-B3","year":"2018)"},{"issue":"4","key":"2021091817524404600_ocab131-B4","doi-asserted-by":"crossref","first-page":"e192542","DOI":"10.1001\/jamanetworkopen.2019.2542","article-title":"Assessment of the data sharing and privacy practices of smartphone apps for depression and smoking cessation","volume":"2","author":"Huckvale","year":"2019","journal-title":"JAMA Network Open"},{"issue":"1","key":"2021091817524404600_ocab131-B5","doi-asserted-by":"crossref","first-page":"e013518","DOI":"10.1136\/bmjopen-2016-013518","article-title":"Ibobbly mobile health intervention for suicide prevention in Australian indigenous youth: a pilot randomised controlled trial","volume":"7","author":"Tighe","year":"2017","journal-title":"BMJ Open"},{"issue":"1","key":"2021091817524404600_ocab131-B6","doi-asserted-by":"crossref","first-page":"4","DOI":"10.1038\/s41746-019-0206-x","article-title":"What is the clinical value of mHealth for patients?","volume":"3","author":"Rowland","year":"2020","journal-title":"NPJ Digit Med"},{"issue":"2","key":"2021091817524404600_ocab131-B7","doi-asserted-by":"crossref","first-page":"330","DOI":"10.1093\/jamia\/ocz175","article-title":"Safety concerns with consumer-facing mobile health applications and their consequences: a scoping review","volume":"27","author":"Akbar","year":"2020","journal-title":"J Am Med Inform Assoc"},{"key":"2021091817524404600_ocab131-B8","year":"2019"},{"key":"2021091817524404600_ocab131-B9","year":"2020"},{"key":"2021091817524404600_ocab131-B10"},{"key":"2021091817524404600_ocab131-B11","author":"Ren","year":"2018"},{"key":"2021091817524404600_ocab131-B12","doi-asserted-by":"crossref","first-page":"107","DOI":"10.1136\/ebmental-2019-300137","article-title":"Longitudinal trends in the quality, effectiveness and attributes of highly rated smartphone health apps","volume":"23","author":"Mercurio","year":"2020","journal-title":"Evid-Based Mental Health"},{"issue":"10","key":"2021091817524404600_ocab131-B13","doi-asserted-by":"crossref","first-page":"1051","DOI":"10.1001\/jama.2015.19426","article-title":"Privacy policies of android diabetes apps and sharing of health information","volume":"315","author":"Blenner","year":"2016","journal-title":"JAMA"},{"key":"2021091817524404600_ocab131-B14","doi-asserted-by":"crossref","first-page":"l920","DOI":"10.1136\/bmj.l920","article-title":"Data sharing practices of medicines related apps and the mobile ecosystem: traffic, content, and network analysis","volume":"364","author":"Grundy","year":"2019","journal-title":"BMJ"},{"key":"2021091817524404600_ocab131-B15","first-page":"645","volume-title":"Washington, DC, USA: American Medical Informatics Association Annual (AMIA) Symposium","author":"He","year":"2014"},{"issue":"1","key":"2021091817524404600_ocab131-B16","doi-asserted-by":"crossref","first-page":"214","DOI":"10.1186\/s12916-015-0444-y","article-title":"Unaddressed privacy risks in accredited health and wellness apps: a cross-sectional systematic assessment","volume":"13","author":"Huckvale","year":"2015","journal-title":"BMC Med"},{"key":"2021091817524404600_ocab131-B17","year":"2013"},{"key":"2021091817524404600_ocab131-B18","volume-title":";","author":"Ikram","year":"2017"},{"key":"2021091817524404600_ocab131-B19","volume-title":"Proceedings of the 2016 Internet Measurement Conference (IMC '16)","author":"Ikram","year":"2016"},{"key":"2021091817524404600_ocab131-B20","author":"Tang","year":"2020"},{"key":"2021091817524404600_ocab131-B21","year":"2020"},{"key":"2021091817524404600_ocab131-B22","year":"2020"},{"key":"2021091817524404600_ocab131-B23","year":"2019"},{"key":"2021091817524404600_ocab131-B24","year":"2019"},{"key":"2021091817524404600_ocab131-B25","doi-asserted-by":"publisher","author":"Ikram","DOI":"10.1145\/3308558.3313521"},{"key":"2021091817524404600_ocab131-B26","author":"Kantchelian","year":"2015"},{"key":"2021091817524404600_ocab131-B27","author":"Kharraz","year":"2015"},{"key":"2021091817524404600_ocab131-B28","volume-title":".","author":"Arp","year":"2014"},{"key":"2021091817524404600_ocab131-B29","author":"Bartel","year":"2012"},{"key":"2021091817524404600_ocab131-B30","first-page":"627","volume-title":"Proceedings of the 18th ACM Conference on Computer and Communications Security, CCS \u201911","author":"Porter Felt","year":"2011:"},{"key":"2021091817524404600_ocab131-B31","first-page":"217","volume-title":"Proceedings of the 2012 ACM Conference on Computer and Communications Security, CCS \u201912","author":"Au","year":"2012:"},{"key":"2021091817524404600_ocab131-B32","year":"2019"},{"key":"2021091817524404600_ocab131-B33","year":"2019"},{"key":"2021091817524404600_ocab131-B34","year":"2020"},{"key":"2021091817524404600_ocab131-B35","doi-asserted-by":"crossref","DOI":"10.1145\/2906388.2906392","volume-title":"ReCon: Revealing and Controlling PII Leaks in Mobile Network Traffic","author":"Ren","year":"2016"},{"key":"2021091817524404600_ocab131-B36","volume-title":"Automated Test Input Generation for Android: Towards Getting There in an Industrial Case","author":"Zheng"},{"key":"2021091817524404600_ocab131-B37","year":"2020"},{"key":"2021091817524404600_ocab131-B38","year":"2020"},{"key":"2021091817524404600_ocab131-B39","year":"2020"},{"key":"2021091817524404600_ocab131-B40","year":"2020"},{"key":"2021091817524404600_ocab131-B41","volume-title":"International symposium on research in attacks, intrusions, and defenses (RAID). Springer, Cham: Telecom SudParis, France; pp. 230-253. 2016","author":"Sebasti\u00e1n"},{"key":"2021091817524404600_ocab131-B42","doi-asserted-by":"crossref","first-page":"425","DOI":"10.1109\/MSR.2017.57","volume-title":"2017 IEEE\/ACM 14th International Conference on Mining Software Repositories (MSR)","author":"Hurier","year":"2017"},{"key":"2021091817524404600_ocab131-B43","year":"2020"},{"key":"2021091817524404600_ocab131-B44","year":"2020"},{"key":"2021091817524404600_ocab131-B45","year":"2016"},{"key":"2021091817524404600_ocab131-B46","year":"2020"},{"key":"2021091817524404600_ocab131-B47","author":"Zhang","year":"2016"},{"key":"2021091817524404600_ocab131-B48","year":"2020"},{"key":"2021091817524404600_ocab131-B49","year":"2018"},{"key":"2021091817524404600_ocab131-B50","year":"2020"},{"key":"2021091817524404600_ocab131-B51","doi-asserted-by":"crossref","first-page":"293","DOI":"10.1145\/3278532.3278558","volume-title":"Proceedings of the Internet Measurement Conference 2018, IMC \u201918","author":"Wang","year":"2018"},{"key":"2021091817524404600_ocab131-B52","year":"2020"},{"key":"2021091817524404600_ocab131-B53","year":"2020"},{"key":"2021091817524404600_ocab131-B54","author":"Ren","year":"2016"},{"key":"2021091817524404600_ocab131-B55","doi-asserted-by":"crossref","first-page":"9390","DOI":"10.1109\/ACCESS.2018.2799522","article-title":"Security and privacy analysis of mobile health applications: the alarming state of practice","volume":"6","author":"Papageorgiou","year":"2018","journal-title":"IEEE Access"},{"issue":"1","key":"2021091817524404600_ocab131-B56","doi-asserted-by":"crossref","first-page":"e8","DOI":"10.2196\/mhealth.3672","article-title":"Exploring the far side of mobile health: information security and privacy of mobile health apps on iOS and android","volume":"3","author":"Dehling","year":"2015","journal-title":"JMIR mHealth and uHealth"},{"key":"2021091817524404600_ocab131-B57","first-page":"110","article-title":"Dissecting the android bouncer","volume":"95","author":"Jon","year":"2012","journal-title":"SummerCon2012, New York"},{"key":"2021091817524404600_ocab131-B58","year":"2012"},{"key":"2021091817524404600_ocab131-B59","author":"Whitwam","year":"2012"},{"key":"2021091817524404600_ocab131-B60","doi-asserted-by":"crossref","first-page":"30","DOI":"10.1109\/ARES.2014.12","volume-title":"2014 Ninth International Conference on Availability, Reliability and Security (ARES)","author":"Maier","year":"2014:"},{"key":"2021091817524404600_ocab131-B61","author":"Ren","year":"2018"},{"key":"2021091817524404600_ocab131-B62","author":"Zubaydi","year":"2015"},{"key":"2021091817524404600_ocab131-B63","year":"2020"},{"key":"2021091817524404600_ocab131-B64","year":"2020"},{"key":"2021091817524404600_ocab131-B65","year":"2020"},{"key":"2021091817524404600_ocab131-B66","year":"2020"},{"key":"2021091817524404600_ocab131-B67","year":"2020"},{"key":"2021091817524404600_ocab131-B68","year":"2020"},{"key":"2021091817524404600_ocab131-B69","year":"2020"},{"key":"2021091817524404600_ocab131-B70","year":"2020"},{"key":"2021091817524404600_ocab131-B71","year":"2020"},{"key":"2021091817524404600_ocab131-B72","year":"2020"},{"key":"2021091817524404600_ocab131-B73","year":"2020"},{"key":"2021091817524404600_ocab131-B74","year":"2020"},{"key":"2021091817524404600_ocab131-B75","year":"2020"},{"key":"2021091817524404600_ocab131-B76","year":"2020"},{"key":"2021091817524404600_ocab131-B77"},{"key":"2021091817524404600_ocab131-B78","year":"2020"}],"container-title":["Journal of the American Medical Informatics Association"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/academic.oup.com\/jamia\/article-pdf\/28\/10\/2074\/40408890\/ocab131.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"http:\/\/academic.oup.com\/jamia\/article-pdf\/28\/10\/2074\/40408890\/ocab131.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,9,18]],"date-time":"2021-09-18T17:54:23Z","timestamp":1631987663000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/jamia\/article\/28\/10\/2074\/6335525"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,8,12]]},"references-count":78,"journal-issue":{"issue":"10","published-online":{"date-parts":[[2021,8,12]]},"published-print":{"date-parts":[[2021,9,18]]}},"URL":"https:\/\/doi.org\/10.1093\/jamia\/ocab131","relation":{},"ISSN":["1527-974X"],"issn-type":[{"value":"1527-974X","type":"electronic"}],"subject":[],"published-other":{"date-parts":[[2021,10,1]]},"published":{"date-parts":[[2021,8,12]]}}}