## 2 Related Work and Security Landscape in mHealth
### Security Challenges Across Wearables, Mobile, and Backend Layers
Our study adds to this limited literature by conducting a legitimate cross-layer audit of an mHealth deployment, confirming fragile interdependent risks associated with insecure BLE communications, mobile permission abuse, and poorly configured containers back-end services. Building on prior mHealth systems that enabled patients to monitor their health using mobile and wearable devices, recent advancements have further enhanced real-time monitoring, remote diagnostics, and personalized treatment strategies. Due to the rapid growth of mHealth systems, particularly following the COVID-19 pandemic, as well as global adoption of telehealth, mHealth systems have been adopted widely in public health, as well as for new initiatives by startups, and for the incorporation into services in clinical systems. However, there has not been an equal advancement in coverage of issues relating to cybersecurity. The challenge that faces mHealth systems is largely due to mHealth architecture is fragile. The common use of mobile applications, and wearable devices means the architecture is less consistent when combining sensors, varying safeguards, fragmentation of legal and regulatory boundaries, with no specific mHealth application or device standardization. Mobile applications and wearable devices increasingly feature diverse sensor capabilities, raising corresponding concerns about firmware security. These devices often operate within differing trust boundaries, particularly in terms of network communication and functional access. Some wearable devices have access to secure communication options, while other devices (especially the low-cost devices that dominate the wearable device industry) cannot undergo inspection, manipulation and enforcement of security [22]. Wearable devices have transitioned in purpose from fitness to necessary devices of continuous health tracking and bio-monitoring, replacing traditional care models for chronic/bio monitoring care or pre-emptive health maintenance and development. Although wearable devices can provide useful services, the underlining issues is the mobile and wearable devices have limited resources, and insecure communication protocols. BLE communication has exploded in wearable communication, due to its low-energy applications, but has highly vulnerable, a complex feature set for poorly authenticated, unencrypted pairing (inherent) allowing unintended uses taking advantage of passive sniffing or injection attacks [20; 23; 24]. GATT profiles routinely have no access control protection, allowing sensitive health data (ex. heart rate, or temperature) to be accessed by any unauthorized party capable of intercepting the communication. Wearable devices emit BLE advertisements that can leak device identifiers and exhibit identifiable usage patterns, enabling user profiling through correlation of metadata. Despite these risks, their convenience to users often results in limited incentives to discourage their use. One more layer of risk associated with wearables and mobile devices is the Android environment (i.e., most wearable-server communication is included in the Android ecosystem). The Android environment provides vast integration possibilities while increasing complexity. Numerous published studies have evaluated issues such as excessive permissions (e.g., in health apps), persistent background services, or invisible pre-installed software. These applications and devices may continuously monitor user activities, covertly harvest sensitive data, or connect to industry-owned data servers without the user's knowledge [18; 19]. Firmware fragmentation presents a significant challenge across devices, as many deliver firmware updates in varying patch sizes, with some devices being susceptible to publicly disclosed vulnerabilities. This issue is particularly pronounced in low-resource environments, where older device models with outdated or improperly maintained firmware are commonly deployed. Increased risks across mHealth platforms further undermine the overall trust in these systems.