Abstract—Mobile health (mHealth) apps are an ideal tool for
monitoring and tracking long-term health conditions; they are
becoming incredibly popular despite posing risks to personal data
privacy and security. In this paper, we propose a testing method
for Android mHealth apps which is designed using a threat
analysis, considering possible attack scenarios and vulnerabilities
specific to the domain. To demonstrate the method, we have
applied it to apps for managing hypertension and diabetes,
discovering a number of serious vulnerabilities in the most
popular applications. Here we summarise the results of that
case study, and discuss the experience of using a testing method
dedicated to the domain, rather than out-of-the-box Android
security testing methods. We hope that details presented here will
help design further, more automated, mHealth security testing
tools and methods.