A Digital Forensic Study of Mobile Health and Fitness Applications Courtney Hassenfeldt University of New Haven

University of New Haven Digital Commons @ New Haven Electrical & Computer Engineering and Computer Electrical & Computer Engineering and Computer Science Faculty Publications Science 8-2019 Map My Murder: A Digital Forensic Study of Mobile Health and Fitness Applications Courtney Hassenfeldt University of New Haven Shabana Baig University of New Haven Ibrahim Baggili University of New Haven, [email protected] Xiaolu Zhang University of Texas at San Antonio Follow this and additional works at: https://digitalcommons.newhaven.edu/ electricalcomputerengineering-facpubs Part of the Computer Engineering Commons, Electrical and Computer Engineering Commons, Forensic Science and Technology Commons, and the Information Security Commons Publisher Citation Hassenfeldt, C., Baig, S., Baggili, I., & Zhang, X. (2019, August). Map My Murder: A Digital Forensic Study of Mobile Health and Fitness Applications. In Proceedings of the 14th International Conference on Availability, Reliability and Security, ARES '19 (Article No. 42). ACM. Comments Dr. Baggili was appointed to the University of New Haven's Elder Family Endowed Chair in 2015. This is the authors' version of the paper published in ARES '19 Proceedings of the 14th International Conference on Availability, Reliability and Security by ACM. ISBN: 978-1-4503-7164-3 The ap per of record can be found at http://dx.doi.org/10.1145/3339252.3340515 Map My Murder! A Digital Forensic Study of Mobile Health and Fitness Applications Courtney Hassenfeldt Shabana Baig University of New Haven University of New Haven [email protected] [email protected] Ibrahim Baggili Xiaolu Zhang University of New Haven University of Texas at San Antonio [email protected] [email protected] ABSTRACT professionals. As of 2017, more than 325,000 ‘mhealth’ applications 1 The ongoing popularity of health and ftness applications catalyzes were available, Android being the leading platform . The mobile the need for exploring forensic artifacts produced by them. Sensitive health industry is expected to hold a market share of almost $37 2 Personal Identifable Information (PII) is requested by the appli- billion by 2019 and $60 billion by 2020 . cations during account creation. Augmenting that with ongoing However, the widespread use of mobile ftness/health technolo- user activities, such as the user’s walking paths, could potentially gies is just another catalyst for user data aggregation [5]. The large create exculpatory or inculpatory digital evidence. We conducted amount of sensitive personally identifable data stored by mobile extensive manual analysis and explored forensic artifacts produced health and ftness applications poses an extensive threat to our privacy. Yet, for digital sleuths, these user-data-rich applications by ¹n = 13º popular Android mobile health and ftness applications. We also developed and implemented a tool that aided in the timely are a treasure chest of digital evidence. In fact, evidence retrieved 3 acquisition and identifcation of artifacts from the examined ap- from such applications has already helped in solving real cases . plications. Additionally, our work explored the type of data that Our work focused on the collection and analysis of forensic may be collected from health and ftness web platforms, and Web artifacts retrieved from widely used mobile health and ftness ap- Scraping mechanisms for data aggregation. The results clearly show plications. The aim was to outline a template for digital forensic that numerous artifacts may be recoverable, and that the tested investigators to follow when examining an Android device with web platforms pose serious privacy threats. installed health and ftness application(s). In total, ¹n = 13º Android health and ftness applications were analyzed. A single application KEYWORDS had 50 million downloads at the time of this writing, illustrating the ubiquity of such software. To date, there has not been a com- Forensics, Artifacts, Applications, Health, Fitness. prehensive forensic analysis of these applications, and thus our ACM Reference Format: contributions are as follows: Courtney Hassenfeldt, Shabana Baig, Ibrahim Baggili, and Xiaolu Zhang. 2019. Map My Murder! A Digital Forensic Study of Mobile Health and • Our work has produced a comprehensive collection of An- Fitness Applications. In Proceedings of the 14th International Conference droid health and ftness application digital forensic artifacts, on Availability, Reliability and Security (ARES 2019) (ARES ’19), August 26– which are shared on the Artifact Genome Project [18]. 29, 2019, Canterbury, United Kingdom. UK, August 26-29, 2019, 12 pages. • Our work provides a novel method for triaging data poten- https://doi.org/10.1145/3339252.3340515 tially stored on a mobile device. • Our devised method is also implemented in a tool that aids in 1 INTRODUCTION that automation of the acquisition and analysis of evidence Mobile/smart devices are being used as powerful self-health mon- retrieved from health and ftness applications on Android. 4 itoring tools. This movement is considered to have more impact • As an auxiliary contribution, our work provides insight into on health care than immobile health facilities [31]. Due to the ad- privacy fndings related to the amount of user data made vancement of mobile health, there are now ample applications and public by some of the health and ftness applications. wearable technologies that address not just our health and ftness concerns, but treatments as well. The number of mobile health The rest of this paper includes related work in Section 2. Section 3 applications has increased enormously for both consumers and shares the employed methodology. We then discuss the experimen- tal results and fndings in Section 4, followed by the discussion Permission to make digital or hard copies of all or part of this work for personal or of our fndings in Section 5. Lastly in Section 6, we conclude and classroom use is granted without fee provided that copies are not made or distributed for proft or commercial advantage and that copies bear this notice and the full citation discuss future work. on the frst page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specifc permission and/or a fee. Request permissions from [email protected]. 1https://research2guidance.com/325000-mobile-health-apps-available-in-2017/ 2 ARES ’19, August 26–29, 2019, Canterbury, United Kingdom https://www.statista.com/topics/2263/mhealth/ © 2019 Association for Computing Machinery. 3http://www.newser.com/story/268299/iphone-app-foils-husband-who-murdered-wife. ACM ISBN 978-1-4503-7164-3/19/08...$15.00 html https://doi.org/10.1145/3339252.3340515 4The tool may be downloaded from https://www.unhcfreg.com/datasetsandtools. ARES ’19, August 26–29, 2019, Canterbury, United Kingdom Hassenfeldt, et al. 2 RELATED WORK mechanisms of the application(s). For large scale application analy- Mobile forensics and application analysis are not new topics. As sis, [41] focused on in-memory analysis of large application datasets. early as the frst generation of smartphones, Bader et al., [9] con- AndroParse, an extendable feature dataset of 67,703 benign and ducted the frst forensic analysis on the iPhone 3Gs. That early 46,683 malicious Android applications [33] has also been created work aimed at fnding signifcant evidence such as e-mail mes- by researchers. sages, text and multimedia from the logical backup of the phone. In the application analysis domain, work has focused on the In 2011, research investigating 3rd party mobile applications on manual analysis of social applications for Android/iOS [6, 30, 37]. the iPhone was conducted [28]. The research focused on analyzing Other work has focused on single widely used mobile applications, built-in application data stored in fles with standardized formats such as WhatsApp [7, 26], and WeChat [38, 42]. Researchers have like databases, JSON and XML. also analyzed cryptowallets [21], and application valuts [40]. Android and iOS now occupy the majority of the mobile market Other relevant work by [20] studied medical information from and this is refected in mobile forensics research. While data privacy both Android and iOS applications associated with a physical medi- has become paramount, digital forensic researchers continue to seek cal device. Related work has also focused on wearable devices such solutions for extracting digital evidence from the changing mobile as ftness trackers [25] and smart watches [10, 13]. landscape. Lastly, it is important to note that there is some previous work In Section 2.1, we share work that improved data acquisition and in the area of health/ftness application analysis. [8] examined 40 application analysis on smart phones. In Section 2.2, we discuss popular Android health applications in 2015. In their work, user case studies that focused on sharing forensic solutions for mobile credentials, location and more personal information was discovered. devices or applications. Since 2015, some of the applications examined by [8] are no longer in use or have been signifcantly updated (e.g. MyFitnessPal was 2.1 Data Acquisition Approaches examined in version 3.6.1 and its current version is 18.9.2). Most importantly, this past work did not introduce an automation tool Starting from the frst generation of mobile devices, data acquisition to aid in the

Load more