Auditing and attributing behaviours of suspicious Android health applications

Mobile health and fitness applications for consumers, collectively known as mobile health applications or mHealth, monitor user ac- tivities such as steps, locations, and email. It seamlessly aggregates sensitive information to facilitate a wide range of functions, such as the management of health conditions and symptom checking. Although mHealth apps provide real-time health monitoring and easier access to healthcare resources, they can also pose serious risks to user safety. Although the research community is primarily well aware of the user’s exposure to several types of malware, there has not been a large-scale in-depth analysis of suspicious mHealth apps using a consistent methodology.

This study conducts a large-scale security and privacy analysis of 381 suspicious free mHealth apps (chosen from a corpus of 15,893 apps) available on “Google Play”. We built a customized toolset to perform a comprehensive analysis of these applications. We explore the range of mechanisms used by mHealth apps to monitor users’ activities, such as photos, text messages, and live microphone access, mainly through the injection of suspicious third-party libraries. In addition, we uncover the use of obfuscation methods used by suspicious mHealth apps to hide their malicious codes. As mHealth apps are used by a large number of customers worldwide, we argue that patients, clinicians, technology developers, and policy-makers alike should be conscious of the hidden risks involved and weigh them carefully against the benefits.