## 4 Results and Comparative Analysis
### Layered Summary of Findings  
A multi-layer audit of the PHGL-COVID platform identified specific and interrelated vulnerabilities at the server backend layer, mobile interface layer, and wearable endpoint layer. Each layer has its own threat profile. Our findings clearly point to several possibilities for risk expansion across boundaries, with loosely coupled or trust-assumed interfaces presenting the most serious concerns moving data from one layer to another [42]. The server layer and use of defenseless Docker image, which also led to a staggering amount of known CVE's, 28 critical, impacted libraries such as zlib, libexpat and SQLite. These critical issues are common points of difficulty in containerized healthcare-based deployments, where keeping base images up to date is depriitized with potentially very dangerous consequences, remaining susceptible to potential privilege escalation/execution, along with memory corruption exploits. We also identified several exposed ports with legacy protocols such as UPnP all introduced attack surfaces that we neglected to mention because of a purported assumption that the hospital container boundary was a safe network boundary [51]. The wearable device, Galaxy Watch 7, exhibited vulnerabilities within the BLE communication stack. Multiple health-related GATT characteristics were exposed and significant portions of the BLE communications were available via plaintext BLE sessions with no authenticating barrier. This allowed for passive sniffing and exposure of data, despite secure boot being enabled, the SELinux policy on the system remaining permissive, and BLE advertising being enabled by default. Weaknesses in BLE security were cautiously raised in related literature and it was apparent runtime protections have limited enforcement in Wear OS environments [43; 52; 53]. The lack of boundary validation between trusted entities (e.g., phone \(\rightarrow\) watch and phone \(\rightarrow\) API) was a repeated finding across layers. That said, while architectures based on this assumption may be convenient, they are often quickly exploited to chain together low-complexity vulnerabilities, resulting in high-impact breach events and an increased likelihood of health information compromise. In the next subsection, we provide a structured comparison of attack vectors, exploitability potential, and mitigation status across layers. We used a multi-factor assessment model to classify risk that combined the CVSS v3.1 base score values with qualitative assessments of exploit complexity, privilege, and impact on core security properties (confidentiality, integrity, availability). We first classified each vulnerability or misconfiguration based on technical severity (e.g., memory corruption, token leakage, and insecure transport) as well as consideration of exploitability under realistic deployment conditions (e.g., user interaction, root or administrative access, and existence of public proof-of-concept code). In addition to just relying on CVSS baselines we also considered propagation potential, the potential for vulnerability in one layer (e.g., a wearable BLE misconfiguration), that may enable or be augmented by a vulnerability in another layer (e.g., mobile injection or exploit escalation on a backend through an abstraction layer). This amplification of risk across domains was an important factor in settling on final severity ratings. We aligned our classification to widely used best practice frameworks that all of the risks fit into, specifically OWASP Mobile Top 10 and Docker Security Benchmarks. There were many mobile-related issues, such as token persistence and abuse of background services, that were mapped to OWASP M2 (Insecure Data Storage) and M5 (Insufficient Cryptography); while backend issues would map to insecure defaults and gaps in container hardening classes, which are a view flags in CIS Docker Benchmark Level 1 policies.