modern mobile applications or apps use cloud-hosted http-based application programming interface (api) services and heavily rely on the internet infrastructure for data communication and storage to improve performance and leverage the power of the mobile device input validation and other business logic required for interfacing with web api services are typically implemented on the mobile client however when a web service implementation fails to thoroughly replicate input validation it gives rise to inconsistencies that could lead to attacks that can compromise user security and privacy developing automatic methods of auditing web apis for security remains challenging dr guofei gu associate professor in the department of computer science and engineering at texas a&m university and director of the success lab together with his doctoral students abner mendoza and guangliang yang are working to combat these security issues gu and his team analyzed 10 000 mobile apps and found that many of them are open to web api hijacking – something that potentially affects the privacy and security of tens of millions of business users and consumers globally the root of the threat lies in the inconsistencies that are often found between app and server logic in web api implementations for mobile apps gus team created the wardroid framework to crawl applications automatically carrying out reconnaissance and uncovering these kinds of inconsistencies using static analysis along with what kinds of http requests are accepted by the server once an attacker has the information on what these requests look like he or she can carry out their own actions by tweaking a few parameters as a simple example gu explains in a vulnerable shopping app/server a malicious user could shop for free by making some of the item prices in the shopping cart as negative (with tweaking some http parameters) which should not be allowed by the app but unfortunately can be accepted by the server after identifying many vulnerable real-world mobile apps/servers that affect millions of users gus team has communicated with the developers to help them fix the vulnerabilities this research has already generated real-world impacts their research paper was published in proceedings of the 2018 institute of electrical and electronics engineers (ieee) symposium on security & privacy (s&p18) one of the most prestigious top conferences in cybersecurity with an acceptance rate lower than 12 percent this work has also been reported in several media outlets including bleepingcomputer threatpost and securityboulevard and also generated extensive discussion on the popular technology social news website slashdot this is just one example of gus research on mobile app security at the same conference gus team had another research paper on mobile app security that identifies a new type of vulnerability named origin stripping vulnerabilities (osv) in modern hybrid mobile apps and introduces a new mitigation solution osv-free for more details on gus research on mobile security please visit his labs website gus innovations in network security technology were recently recognized with a college of engineering research impact award