The Journal of mHealth Vol 3 Issue 1 (Feb/Mar 2016) | Page 19

Industry News

Report finds that 80% of
‘Approved’ mHealth Apps have at
Least Two Major Security Flaws
Arxan Technologies has announced the
publication of its 5th Annual State of
Application Security Report. The new
research is based on the analysis of
126 popular mobile health and finance
apps from the US, UK, Germany, and
Japan, as well as a study examining security perspectives of consumers and app
security professionals.
Arxan discovered a wide disparity between
consumer confidence in the level of security incorporated into mobile health and
finance apps and the degree to which
organisations address known application
vulnerabilities.
While the majority of app users and
app executives indicate that they believe
their apps to be secure, nearly all the
apps Arxan assessed, including popular
banking and payment apps and FDAapproved health apps, proved to be vulnerable to at least two of the top ten serious security risks.
The research suggests that consumers
and app executives believe their mobile
health and finance apps are secure.  A
combined 84 per cent of mobile app
users and mobile app executives believe
that their mobile health and finance apps
are “adequately secure,” and 63 per cent
believe that app providers are doing
“everything they can” to protect their
mobile health and finance apps.
In reality, the majority of mobile health
and finance apps contain critical security
vulnerabilities. 90 per cent of the mobile
health and finance apps tested had at
least two of the Open Web Application
Security Project (OWASP) Mobile Top
10 Risks. More than 80 per cent of the
health apps tested that were approved
by the US Food and Drug Administration (FDA) or the UK National Health
Service (NHS) were also found to have
at least two of the OWASP Mobile Top
10 Risks.
The security and safety risks are real

and significant. 98 per cent of the
mobile apps tested lacked binary protection – this was the most prevalent
security vulnerability identified. 83 per
cent of the mobile apps had insufficient
transport layer protection. Such vulnerabilities could result in application code
tampering, reverse-engineering, privacy
violations, and data theft. In addition
to sensitive data being taken, the vulnerabilities could lead to a health app being
reprogrammed to deliver a lethal dose of
medication, or a finance app to redirect
the transfer of money.

mobile app security is an important element in customer retention. Baking in
robust mobile app security is not only a
smart technology investment to keep the
bad guys out, but also a smart business
investment to help organisations differentiate from the competition and to
achieve customer loyalty based on trust.”
Research findings specific to the health
market includes:

Most consumers would change providers if they knew their apps were not
secure. 80 per cent of mobile app users
would change providers if they knew the
apps they were using were not secure. 82
per cent would change providers if they
knew alternative apps offered by similar
service providers were more secure.

Mobile health apps approved by
regulatory/governing bodies are just
as vulnerable as other mobile apps.
84 per cent of the US FDA-approved
apps tested did not adequately address at
least two of the OWASP Mobile Top 10
Risks. Similarly, 80 per cent of the apps
tested that were formerly approved by
the UK NHS did not adequately address
at least two of the OWASP Mobile Top
10 Risks.

“Mobile apps are often used by organisations to help keep customers ‘sticky,’ yet
in the rush to bring new apps to market,
organisations tend to overlook critical
security measures that are proving crucial to consumer loyalty,” said Patrick
Kehoe, CMO of Arxan Technologies.
“Our research in Arxan’s 2016 State of
App Security Report demonstrates that

Most of the mobile health apps were
susceptible to application code tampering and reverse-engineering. 95
per cent of the FDA-approved apps,
and 100 per cent of the apps formerly
approved by the NHS, lacked binary
protection, which could result in privacy
violations, theft of personal health
information, and tampering. n

The Journal of mHealth

17