  Mobile applications, mobile apps for short, have proven their usefulness in
enhancing service provisioning across a multitude of domains that range from
smart healthcare, to mobile commerce, and areas of context sensitive computing.
In recent years, a number of empirically grounded, survey-based studies have
been conducted to investigate secure development and usage of mHealth apps.
However, such studies rely on self reported behaviors documented via interviews
or survey questions that lack a practical, i.e. action based approach to
monitor and synthesise users actions and behaviors in security critical
scenarios. We conducted an empirical study, engaging participants with attack
simulation scenarios and analyse their actions, for investigating the security
awareness of mHealth app users via action-based research. We simulated some
common security attack scenarios in mHealth context and engaged a total of 105
app users to monitor their actions and analyse their behavior. We analysed
users data with statistical analysis including reliability and correlations
tests, descriptive analysis, and qualitative data analysis. Our results
indicate that whilst the minority of our participants perceived access
permissions positively, the majority had negative views by indicating that such
an app could violate or cost them to lose privacy. Users provide their consent,
granting permissions, without a careful review of privacy policies that leads
to undesired or malicious access to health critical data. The results also
indicated that 73.3% of our participants had denied at least one access
permission, and 36% of our participants preferred no authentication method. The
study complements existing research on secure usage of mHealth apps, simulates
security threats to monitor users actions, and provides empirically grounded
guidelines for secure development and usage of mobile health systems.
