Intertrust Releases 2020 Security Report on Global mHealth App Threats

Annual security report of 100 top Android and iOS healthcare applications reveals serious cryptographic vulnerabilities, data leakage, and other security breaches—showing the industry needs to do far better given the massive transition to remote healthcare in the wake of COVID-19 lockdowns.

SAN FRANCISCO–(BUSINESS WIRE)–#IntertrustTech—Intertrust, the pioneer in digital rights management (DRM) technology and leading provider of application security solutions, released their 2020 Security Report on Global mHealth Apps today, revealing that 71% of healthcare and medical apps have at least one serious vulnerability that could lead to a breach of medical data. The report investigated 100 publicly available global mobile healthcare apps across a range of categories—including telehealth, medical device, health commerce, and COVID-tracking—to uncover the most critical mHealth app threats.

Cryptographic issues pose one of the most pervasive and serious threats, with 91% of the apps in the study failing one or more cryptographic tests. This means the encryption used in these medical apps can be easily broken by cybercriminals, potentially exposing confidential patient data, and enabling attackers to tamper with reported data, send illegitimate commands to connected medical devices, or otherwise use the application for malicious purposes.

The study’s overall findings suggest that the push to reshape care delivery under COVID-19 has often come at the expense of mobile application security.

“Unfortunately, there’s been a history of security vulnerabilities in the healthcare and medical space. Things are getting a lot better, but we still have a lot of work to do,” said Bill Horne, General Manager of the Secure Systems product group and Chief Technology Officer at Intertrust. “The good news is that application protection strategies and technologies can help healthcare organizations bring the security of their apps up to speed.”

The Intertrust security report on healthcare and medical mobile apps is based on an audit of 100 iOS and Android applications from healthcare organizations worldwide. All 100 apps were analyzed using an array of static application security testing (SAST) and dynamic application security testing (DAST) techniques based on the OWASP (Open Web Application Security Project) mobile app security guidelines.

The assessment revealed major security gaps in mobile medical apps across the board. Highlights from the report include:

71% of tested medical apps have at least one high level security vulnerability. A vulnerability is classified as high if it can be readily exploited and has the potential for significant damage or loss.
The vast majority of medical apps (91%) have mishandled and/or weak encryption that puts them at risk for data exposure and IP (intellectual property) theft.
34% of Android apps and 28% of iOS apps are vulnerable to encryption key extraction.
The majority of mHealth apps contain multiple security issues with data storage. For instance, 60% of tested Android apps stored information in SharedPreferences, leaving unencrypted data readily readable and editable by attackers and malicious apps.
When looking specifically at COVID-tracking apps, 85% leak data.
83% of the high-level threats discovered could have been mitigated using application protection technologies such as code obfuscation, tampering detection, and white-box cryptography.

Download the full Intertrust Security Report on Global mHealth Apps 2020.

Healthcare organizations can find more information on medical application protection here.

About Intertrust

Intertrust provides trusted computing products and services to leading global corporations–from mobile, consumer electronics and IoT manufacturers, to service providers and enterprise software platform companies. These products include the world’s leading digital rights management (DRM), software tamper resistance, and technologies to enable private data exchanges for various verticals including energy, entertainment, retail/marketing, automotive, fintech, and IoT. Founded in 1990, Intertrust is headquartered in Silicon Valley with regional offices in London, Tokyo, Mumbai, Bangalore, Beijing, Seoul, Riga, and Tallinn. The company has a legacy of invention, and its fundamental contributions in the areas of computer security and digital trust are globally recognized. Intertrust holds hundreds of patents that are key to Internet security, trust, and privacy management components of operating systems, trusted mobile code and networked operating environments, web services, and cloud computing.