Courtney Hassenfeldt
ABSTRACT
The ongoing popularity of health and fitness applications catalyzes the need for exploring forensic artifacts produced by them. Sensitive Personal Identifiable Information (PII) is requested by the applications during account creation. Augmenting that with ongoing user activities, such as the user's walking paths, could potentially create exculpatory or inculpatory digital evidence. We conducted extensive manual analysis and explored forensic artifacts produced by (n = 13) popular Android mobile health and fitness applications. We also developed and implemented a tool that aided in the timely acquisition and identification of artifacts from the examined applications. Additionally, our work explored the type of data that may be collected from health and fitness web platforms, and Web Scraping mechanisms for data aggregation. The results clearly show that numerous artifacts may be recoverable, and that the tested web platforms pose serious privacy threats.
- 52% of users reuse their passwords. Panda Security, 2018. https://www.pandasecurity.com/mediacenter/security/password-reuse/.Google Scholar
- Apple health data used in murder trial. BBC News, 2018. https://www.bbc.com/news/technology-42663297.Google Scholar
- 10 notable facts about wearable technology. Medium, 2019. https://medium.com/@TechTalker/10-notable-facts-about-wearable-technology-c01c21070324.Google Scholar
- Subscriber share held by smartphone operating systems in the united states from 2012 to 2018. Statista, 2019. https://www.statista.com/statistics/266572/market-share-held-by-smartphone-platforms-in-the-united-states/.Google Scholar
- Linda Ackerman. Mobile health and fitness applications and information privacy. Privacy Rights Clearinghouse, San Diego, CA, 2013.Google Scholar
- Noora Al Mutawa, Ibrahim Baggili, and Andrew Marrington. Forensic analysis of social networking applications on mobile devices. Digital Investigation, 9:S24--S33, 2012.Google ScholarCross Ref
- Cosimo Anglano. Forensic analysis of whatsapp messenger on android smart-phones. Digital Investigation, 11(3):201--213, 2014. Google ScholarDigital Library
- Abdullah Azfar, Kim-Kwang Raymond Choo, and Lin Liu. Forensic taxonomy of popular android mhealth apps. 21st Americas Conference on Information Systems, 2015.Google Scholar
- Mona Bader and Ibrahim Baggili. iphone 3gs forensics: Logical analysis using apple itunes backup utility. 2010.Google Scholar
- Ibrahim Baggili, Jeff Oduro, Kyle Anthony, Frank Breitinger, and Glenn McGee. Watch what you wear: preliminary forensic analysis of smart watches. In 2015 10th International Conference on Availability, Reliability and Security, pages 303--311. IEEE, 2015. Google ScholarDigital Library
- Elizabeth Barber. What happens when you stalk your boyfriend on strava. WIRED, 2018. https://www.wired.com/story/strava-love-surveillance/.Google Scholar
- MF Breeuwsma. Forensic imaging of embedded systems using jtag (boundary-scan). digital investigation, 3(1):32--42, 2006. Google ScholarDigital Library
- Quang Do, Ben Martini, and Kim-Kwang Raymond Choo. Is the data on your wearable device secure? an android wear smartwatch case study. Software: Practice and Experience, 47(3):391--403, 2017. Google ScholarDigital Library
- William Enck, Damien Octeau, Patrick D McDaniel, and Swarat Chaudhuri. A study of android application security. In USENIX security symposium, volume 2, page 2, 2011. Google ScholarDigital Library
- Junbin Fang, Zoe Jiang, Kam-Pui Chow, Siu-Ming Yiu, Lucas Hui, Gang Zhou, Mengfei He, and Yanbin Tang. Forensic analysis of pirated chinese shanzhai mobile phones. In IFIP International Conference on Digital Forensics, pages 129--142. Springer, 2012.Google ScholarCross Ref
- Aya Fukami, Saugata Ghose, Yixin Luo, Yu Cai, and Onur Mutlu. Improving the reliability of chip-off forensic analysis of nand flash memory devices. Digital Investigation, 20:S1--S11, 2017. Google ScholarDigital Library
- Jenn Gidman. iphone app foils husband who murdered wife. Newser, 2018. http://www.newser.com/story/268299/iphone-app-foils-husband-who-murdered-wife.html.Google Scholar
- Cinthya Grajeda, Laura Sanchez, Ibrahim Baggili, Devon Clark, and Frank Breitinger. Experience constructing the artifact genome project (agp): Managing the domain's knowledge one artifact at a time. Digital Investigation, 26:S47--S58, 2018.Google ScholarDigital Library
- Cinthya Grajeda, Laura Sanchez, Ibrahim Baggili, Devon Clark, and Frank Breitinger. Experience constructing the artifact genome project (agp): Managing the domain's knowledge one artifact at a time. Digital Investigation, 26:S47--S58, 2018.Google ScholarDigital Library
- George Grispos, William Bradley Glisson, and Peter Cooper. A bleeding digital heart: Identifying residual data generation from smartphone applications interacting with medical devices, 2019.Google Scholar
- Trevor Haigh, Frank Breitinger, and Ibrahim Baggili. If i had a million cryptos: Cryptowallet application analysis and a trojan proof-of-concept. In International Conference on Digital Forensics and Cyber Crime, pages 45--65. Springer, 2018.Google Scholar
- Christine Hauser. Police use fitbit data to charge 90-year-old man in stepdaugh-terâĂŹs killing. NYTimes, 2018. https://www.nytimes.com/2018/10/03/us/fitbit-murder-arrest.html.Google Scholar
- Andrew Hoog. Android forensics: investigation, analysis and mobile security for Google Android. Elsevier, 2011. Google ScholarDigital Library
- Bart Jansen. Strava fitness tracking map reveals military bases, movements in war zones. USA Today, 2018. https://www.usatoday.com/story/news/world/2018/01/29/strava-war-zones/1073975001/.Google Scholar
- Serim Kang, Soram Kim, and Jongsung Kim. Forensic analysis for iot fitness trackers and its application. Peer-to-Peer Networking and Applications, pages 1--10, 2018.Google ScholarCross Ref
- Filip Karpisek, Ibrahim Baggili, and Frank Breitinger. Whatsapp network forensics: Decrypting and understanding the whatsapp call signaling messages. Digital Investigation, 15:110--118, 2015. Google ScholarDigital Library
- Jeff Lessard and Gary C Kessler. Android Forensics: Simplifying Cell Phone Examinations. Small Scale Digital Device Forensics Journal, 4(1):1--12, 2010.Google Scholar
- Alex Levinson, Bill Stackpole, and Daryl Johnson. Third party application forensics on apple mobile devices. In 2011 44th Hawaii International Conference on System Sciences, pages 1--9. IEEE, 2011. Google ScholarDigital Library
- Hafizah Mansor, Konstantinos Markantonakis, Raja Naeem Akram, Keith Mayes, and Iakovos Gurulian. Log your car: The non-invasive vehicle forensics. In 2016 IEEE Trustcom/BigDataSE/ISPA, pages 974--982. IEEE, 2016.Google ScholarCross Ref
- Farhood Norouzizadeh Dezfouli, Ali Dehghantanha, Brett Eterovic-Soric, and Kim-Kwang Raymond Choo. Investigating social networking applications on smartphones detecting facebook, twitter, linkedin and google+ artefacts on android and ios platforms. Australian journal of forensic sciences, 48(4):469--488, 2016.Google Scholar
- Michael Rucker. Mobile health apps and technology. verywellhealth, 2018. https://www.verywellhealth.com/mobile-health-4014014.Google Scholar
- Mark Russell. Shoe fits in 'frenzied killing' case. The Age, 2013. https://www.theage.com.au/national/victoria/shoe-fits-in-frenzied-killing-case-20130628-2p2c4.html.Google Scholar
- Robert Schmicker, Frank Breitinger, and Ibrahim Baggili. Androparse-an android feature extraction framework and dataset. In International Conference on Digital Forensics and Cyber Crime, pages 66--88. Springer, 2018.Google Scholar
- Brent Schrotenboer. Kellen winslow trial day 5: How bike location data incriminated him. USA Today, 2019. https://www.usatoday.com/story/sports/2019/05/28/kellen-winslow-trial-cycling-clues-hurt-ex-nfl-star-criminal-case/1267080001/.Google Scholar
- David Sharos. Social media has 'emboldened' stalkers, officials say. The Chicago Tribune, 2018. https://www.chicagotribune.com/suburbs/aurora-beacon-news/ct-abn-stalking-st-0118-20180117-story.html.Google Scholar
- Onno Van Eijk and Mark Roeloffs. Forensic acquisition and analysis of the random access memory of tomtom gps navigation systems. Digital Investigation, 6(3-4):179--188, 2010. Google ScholarDigital Library
- Daniel Walnycky, Ibrahim Baggili, Andrew Marrington, Jason Moore, and Frank Breitinger. Network and device forensic analysis of android social-messaging applications. Digital Investigation, 14:S77--S84, 2015. Google ScholarDigital Library
- Songyang Wu, Yong Zhang, Xupeng Wang, Xiong Xiong, and Lin Du. Forensic analysis of wechat on android smartphones. Digital investigation, 21:3--10, 2017.Google Scholar
- Seung Jei Yang, Jung Ho Choi, Ki Bom Kim, and Taejoo Chang. New acquisition method based on firmware update protocols for android smartphones. Digital Investigation, 14:S68--S76, 2015. Google ScholarDigital Library
- Xiaolu Zhang, Ibrahim Baggili, and Frank Breitinger. Breaking into the vault: Privacy, security and forensic analysis of android vault applications. Computers & Security, 70:516--531, 2017.Google ScholarCross Ref
- Xiaolu Zhang, Frank Breitinger, and Ibrahim Baggili. Rapid android parser for investigating dex files (rapid). Digital Investigation, 17:28--39, 2016. Google ScholarDigital Library
- Fan Zhou, Yitao Yang, Zhaokun Ding, and Guozi Sun. Dump and analysis of android volatile memory on wechat. In 2015 IEEE International Conference on Communications (ICC), pages 7151--7156. IEEE, 2015.Google ScholarCross Ref
Recommendations
Experience constructing the Artifact Genome Project (AGP): Managing the domain's knowledge one artifact at a time
AbstractWhile various tools have been created to assist the digital forensics community with acquiring, processing, and organizing evidence and indicating the existence of artifacts, very few attempts have been made to establish a centralized ...
Summarization of Neonatal Video EEG for Seizure and Artifact Detection
Monitoring neonatal EEG signal is useful in identifying neonatal convulsions or seizures. For neonates, seizures can be electrographic, electro clinical, or both simultaneously. Electrographic seizure is identified via recorded EEG signal, while electro ...
Methodological Review: Health GIS and HIV/AIDS studies: Perspective and retrospective
GIS (Geographic Information System) is a useful tool that aids and assists in health research, health education, planning, monitoring and evaluation of health programmes that are meant to control and eradicate certain life threatening diseases and ...
Comments