Automated Security Testing for Applications Integrating Third-Party Services

Modern applications have become increasingly complex in both function and construction. Commerce websites use inferred user preferences to show relevant merchandise, banking websites implement complex transaction protocols, social networks need to safeguard sensitive user information, and mobile applications incorporate authentication, sharing, and payment mechanisms. Third-party services have become a common way to implement these functionalities, e↵ectively making most applications today large mashups of both code and services from numerous parties. Widespread integration of third-party services into web and mobile applications raises a critical problem: how to ensure desired security and privacy properties for programs integrating third-party services.