## 3 System Architecture and Attack Surface
The PHGL-COVID platform utilized a multi-layer auditing approach comprised of all three components: the Galaxy Watch 7 wearable, the Samsung Galaxy A55 smartphone, and the containerized backend. This security testing used a combination of human-based inspection (manual configuration assessment, runtime analysis, behavior tracing) and tools (vulnerability scanners, reverse engineering tools, protocol analysis tools) to test real-world threat scenarios and discover any security implications [31]. The evaluation process began with reconnaissance, followed by static analysis, dynamic analysis, vulnerability analysis, and risk score. During the reconnaissance phase, exposed services, BLE profiles, installed apps, and network endpoints were mapped. The static and dynamic analysis phase examined firmware metadata from the firmware, behavior of APKs, and runtime observations from the phone and smartwatch. The vulnerability analysis phase included concrete threats such as injection attempts (DNS, SQL), CVE queries, and BLE attack scenarios (i.e., BLE spoofing). Lastly, in the risk score section, findings between layers were correlated to score their exploitability and the impact they may have on the system [39]. Each layer of the system necessitated tools based on its architecture. Table 2 presents the tools and techniques that were employed. For the backend, Trivy, OpenVAS, and Nikto were used to find CVEs and misconfigurations, and Docker Bench was used to provide a compliance check against its security benchmarks. On the mobile tablet, ADB, dumpsys, Frida, and MobSF were used to statically and dynamically inspect applications and capabilities. BLE traffic was recorded using Wireshark. On the wearable, BLEAH,  
Figure 1: System architecture and interaction flow in the PHGL-COVID platform, highlighting potential attack points. btmon, and GATT Tool were used to profile and sniff BLE characteristics, while nRF Connect was utilized for manual inspection of BLE UUIDs [40]. This method underscores the importance of full stack audit coverage and evaluating risks across layers which were not considered in other previous studies which looked at layers independently. The backend audit identified multiple risks from improperly managed container and service exposures. The first scans with nmap had exposed ports of 22 (SSH), 9090 (Zeus Admin), and 9500 (ISM Server). The latter audit showed that UPnP services and obsolete interfaces were exposed to the Internet. These services contained vulnerabilities from a lack of segmentation through deployments and exploitation from vulnerabilities exposed through insufficient deployment or lack of hardening, as is shown in Table 3. Additionally, Trivy scanning on six Docker images generated a list totaling 613 vulnerabilities, including 28 critical and 103 high risks issue affecting core libraries like OpenSSL, SQLite, Kerberos, and libexpat [41; 42; 43]. These vulnerabilities expose healthcare infrastructure to critical vulnerabilities consisting of remote code execution, privilege escalation and data compromise. The study recommended hardened base images, automated vulnerability scans as part of CI/CD pipelines and enforcement of isolation through tools like AppArmor and seccomp. Decommissioning UPnP and eliminating deprecated admin interfaces were also recommended [44]. In the mobile audit, the Galaxy A55 smartphone was audited via ADB and MobSF. The analysis found that the firmware was a type with a non-European Customer Software Code (CSC) configuration, meaning it would miss important security updates found in European firmware. Static and dynamic inspection exposed excessive permissions being granted to the pre-installed apps including access to system-level APIs such as SYSTEMALERTWINDOW and PACKAGEUSAGEESTATS. Frida hooking showed session tokens being maintained indefinitely after they had expired. In addition, Wireshark was used to demonstrate the unencrypted transmission of GATT characteristics within BLE traffic, as shown in Table 4.